Edit tour

Windows Analysis Report
Google_Chrome.exe

Overview

General Information

Sample name:	Google_Chrome.exe
Analysis ID:	1523595
MD5:	b82c3d4143ea779b06ef4fbc965db624
SHA1:	52172ad1a88ea85f679d8bf13f2567145a64f24b
SHA256:	b87ef5f2289241d1f437924bee4cccfbb16554a6a71d23f6fd930ff5c7c30dd8
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

Google_Chrome.exe (PID: 5812 cmdline: "C:\Users\user\Desktop\Google_Chrome.exe" MD5: B82C3D4143EA779B06EF4FBC965DB624)

BitLockerToGo.exe (PID: 3496 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["relaxatinownio.shop", "licenseodqwmqn.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "reggwardssdqw.shop", "tesecuuweqo.shop", "eemmbryequo.shop", "tendencctywop.shop"], "Build id": "05eF0T--Cpanel"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:26.995229+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49736	172.67.209.193	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:26.995229+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49736	172.67.209.193	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.300963+0200	2055879	1	Domain Observed Used for C2 Detected	192.168.2.4	55605	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.232694+0200	2055881	1	Domain Observed Used for C2 Detected	192.168.2.4	59926	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.245096+0200	2055883	1	Domain Observed Used for C2 Detected	192.168.2.4	62908	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.284854+0200	2055885	1	Domain Observed Used for C2 Detected	192.168.2.4	54907	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.270855+0200	2055887	1	Domain Observed Used for C2 Detected	192.168.2.4	56888	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.220696+0200	2055891	1	Domain Observed Used for C2 Detected	192.168.2.4	60010	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.258808+0200	2055893	1	Domain Observed Used for C2 Detected	192.168.2.4	63406	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T20:15:24.313067+0200	2055895	1	Domain Observed Used for C2 Detected	192.168.2.4	61554	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.Google_Chrome.exe.159a000.1.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["relaxatinownio.shop", "licenseodqwmqn.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "reggwardssdqw.shop", "tesecuuweqo.shop", "eemmbryequo.shop", "tendencctywop.shop"], "Build id": "05eF0T--Cpanel"}

Multi AV Scanner detection for submitted file

Source: Google_Chrome.exe

ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Google_Chrome.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: tryyudjasudqo.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: eemmbryequo.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: reggwardssdqw.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: relaxatinownio.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: tesecuuweqo.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: licenseodqwmqn.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: keennylrwmqlw.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmp	String decryptor: 05eF0T--Cpanel

Source: Google_Chrome.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: Google_Chrome.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Google_Chrome.exe, 00000000.00000002.1935422366.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Google_Chrome.exe, 00000000.00000002.1935422366.0000000001560000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-10h]	1_2_02C702B8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h	1_2_02C702B8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_02C6F9B1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+0Ch]	1_2_02C3F140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	1_2_02C72EC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], dx	1_2_02C6FF03
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2EE0190Fh	1_2_02C6FF03
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	1_2_02C70477
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	1_2_02C4AAC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+14h]	1_2_02C312F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C54A4F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	1_2_02C54A4F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, word ptr [edx]	1_2_02C54A4F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_02C52200
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_02C56230
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_02C493C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	1_2_02C72380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C58B4F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C3EB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C3EB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [edi+01h], 00000000h	1_2_02C530CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esi+eax]	1_2_02C4B054
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esi+eax]	1_2_02C4B054
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_02C4B054
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_02C4B054
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+14h]	1_2_02C42001
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+48h]	1_2_02C4A1C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+64h]	1_2_02C591C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+ebp+02h], 0000h	1_2_02C5998F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], bl	1_2_02C3D140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_02C53940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push eax	1_2_02C686C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ebx	1_2_02C3E6E5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	1_2_02C6C696
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	1_2_02C736A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	1_2_02C6D630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_02C5AFD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+10h]	1_2_02C547E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+10h]	1_2_02C547E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebp	1_2_02C39F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ebp	1_2_02C39F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C587AA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_02C657B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_02C35770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_02C4FCFF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_02C52480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_02C4CC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ecx	1_2_02C4CC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_02C6CC30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_02C6AD90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	1_2_02C70554
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	1_2_02C70554
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 625B6034h	1_2_02C70554
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [ebp-10h]	1_2_02C71D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_02C52D6A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	1_2_02C52D6A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	1_2_02C5CD06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	1_2_02C5B510

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055879 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop) : 192.168.2.4:55605 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055881 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop) : 192.168.2.4:59926 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055887 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop) : 192.168.2.4:56888 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055895 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop) : 192.168.2.4:61554 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055891 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop) : 192.168.2.4:60010 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055885 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop) : 192.168.2.4:54907 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055883 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop) : 192.168.2.4:62908 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055893 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop) : 192.168.2.4:63406 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49736 -> 172.67.209.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 172.67.209.193:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: relaxatinownio.shop
Source: Malware configuration extractor	URLs: licenseodqwmqn.shop
Source: Malware configuration extractor	URLs: tryyudjasudqo.shop
Source: Malware configuration extractor	URLs: keennylrwmqlw.shop
Source: Malware configuration extractor	URLs: reggwardssdqw.shop
Source: Malware configuration extractor	URLs: tesecuuweqo.shop
Source: Malware configuration extractor	URLs: eemmbryequo.shop
Source: Malware configuration extractor	URLs: tendencctywop.shop

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: tendencctywop.shop
Source: global traffic	DNS traffic detected: DNS query: keennylrwmqlw.shop
Source: global traffic	DNS traffic detected: DNS query: licenseodqwmqn.shop
Source: global traffic	DNS traffic detected: DNS query: tesecuuweqo.shop
Source: global traffic	DNS traffic detected: DNS query: relaxatinownio.shop
Source: global traffic	DNS traffic detected: DNS query: reggwardssdqw.shop
Source: global traffic	DNS traffic detected: DNS query: eemmbryequo.shop
Source: global traffic	DNS traffic detected: DNS query: tryyudjasudqo.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampow
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=0qXC
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=TlXuhKjTdHfu&l=e
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/V
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store:443/api
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.st
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steamp
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E6D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptc
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02C62D80 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_02C62D80

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02C62D80 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_02C62D80

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02C62EF0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_02C62EF0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3F140	1_2_02C3F140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3F7C0	1_2_02C3F7C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C392C5	1_2_02C392C5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C312F0	1_2_02C312F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C73AF0	1_2_02C73AF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3BA90	1_2_02C3BA90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C54A4F	1_2_02C54A4F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C5BD10	1_2_02C5BD10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C72262	1_2_02C72262
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C40A70	1_2_02C40A70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C5E223	1_2_02C5E223
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C42A2C	1_2_02C42A2C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C40BE0	1_2_02C40BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C72380	1_2_02C72380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3138D	1_2_02C3138D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C36BB0	1_2_02C36BB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C423B0	1_2_02C423B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C62B60	1_2_02C62B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C44374	1_2_02C44374
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C57370	1_2_02C57370
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C67B00	1_2_02C67B00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3EB20	1_2_02C3EB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C71330	1_2_02C71330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C530CB	1_2_02C530CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C71840	1_2_02C71840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C4B054	1_2_02C4B054
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C4E070	1_2_02C4E070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C31000	1_2_02C31000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C40000	1_2_02C40000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C42001	1_2_02C42001
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C4A1C0	1_2_02C4A1C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C37980	1_2_02C37980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C55198	1_2_02C55198
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C599B5	1_2_02C599B5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C53940	1_2_02C53940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C68965	1_2_02C68965
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C39909	1_2_02C39909
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C74110	1_2_02C74110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3913D	1_2_02C3913D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C34EC0	1_2_02C34EC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C726B0	1_2_02C726B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C53640	1_2_02C53640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C57640	1_2_02C57640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C58E63	1_2_02C58E63
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C53624	1_2_02C53624
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C6D630	1_2_02C6D630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3D7D0	1_2_02C3D7D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3FFDE	1_2_02C3FFDE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C737E0	1_2_02C737E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C70FE0	1_2_02C70FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3AF80	1_2_02C3AF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C39F80	1_2_02C39F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C33790	1_2_02C33790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C5C752	1_2_02C5C752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C70750	1_2_02C70750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C36F70	1_2_02C36F70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C56F10	1_2_02C56F10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C52480	1_2_02C52480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C4CC90	1_2_02C4CC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C3A4A0	1_2_02C3A4A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C58C5E	1_2_02C58C5E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C42C3C	1_2_02C42C3C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C73DE0	1_2_02C73DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C565A2	1_2_02C565A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C71D50	1_2_02C71D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C52D6A	1_2_02C52D6A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C5CD06	1_2_02C5CD06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C5BD10	1_2_02C5BD10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C49D22	1_2_02C49D22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_02C43D23	1_2_02C43D23

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02C3C590 appears 47 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02C3DF50 appears 178 times

Source: Google_Chrome.exe, 00000000.00000002.1934375018.0000000000D89000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGoogle Chrome.exe DVarFileInfo$ vs Google_Chrome.exe
Source: Google_Chrome.exe, 00000000.00000002.1935422366.0000000001560000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Google_Chrome.exe
Source: Google_Chrome.exe	Binary or memory string: OriginalFilenameGoogle Chrome.exe DVarFileInfo$ vs Google_Chrome.exe

Source: Google_Chrome.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@10/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02C60AC0 CoCreateInstance,

1_2_02C60AC0

Source: Google_Chrome.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Google_Chrome.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Google_Chrome.exe

ReversingLabs: Detection: 70%

Source: Google_Chrome.exe	String found in binary or memory: net/addrselect.go
Source: Google_Chrome.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\Google_Chrome.exe "C:\Users\user\Desktop\Google_Chrome.exe"
Source: C:\Users\user\Desktop\Google_Chrome.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Google_Chrome.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Google_Chrome.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior

Source: Google_Chrome.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Google_Chrome.exe

Static file information: File size 4921344 > 1048576

Source: Google_Chrome.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x221c00
Source: Google_Chrome.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x24ec00

Source: Google_Chrome.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Google_Chrome.exe, 00000000.00000002.1935422366.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Google_Chrome.exe, 00000000.00000002.1935422366.0000000001560000.00000004.00001000.00020000.00000000.sdmp

Source: Google_Chrome.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\Google_Chrome.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6836

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpZ
Source: Google_Chrome.exe, 00000000.00000002.1934429611.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_02C6F5F0 LdrInitializeThunk,

1_2_02C6F5F0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Google_Chrome.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C30000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Google_Chrome.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C30000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tryyudjasudqo.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eemmbryequo.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reggwardssdqw.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: relaxatinownio.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tesecuuweqo.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tendencctywop.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licenseodqwmqn.shop
Source: Google_Chrome.exe, 00000000.00000002.1934798769.00000000014D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keennylrwmqlw.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2A5B008	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C30000	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C31000	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C75000	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C78000	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C88000	Jump to behavior

Source: C:\Users\user\Desktop\Google_Chrome.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Google_Chrome.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Google_Chrome.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Google_Chrome.exe	71%	ReversingLabs	Win32.Spyware.Lummastealer
Google_Chrome.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
gravvitywio.store	172.67.209.193	true	true	unknown
tryyudjasudqo.shop	unknown	unknown	true	unknown
keennylrwmqlw.shop	unknown	unknown	true	unknown
reggwardssdqw.shop	unknown	unknown	true	unknown
tesecuuweqo.shop	unknown	unknown	true	unknown
tendencctywop.shop	unknown	unknown	true	unknown
eemmbryequo.shop	unknown	unknown	true	unknown
licenseodqwmqn.shop	unknown	unknown	true	unknown
relaxatinownio.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
relaxatinownio.shop	true		unknown
keennylrwmqlw.shop	true		unknown
tendencctywop.shop	true		unknown
tryyudjasudqo.shop	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
tesecuuweqo.shop	true		unknown
eemmbryequo.shop	true		unknown
reggwardssdqw.shop	true		unknown
licenseodqwmqn.shop	true		unknown
https://gravvitywio.store/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptc	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steambroadcast-test.akamaized/	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.st	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://checkout.steampow	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.steamp	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gravvitywio.store:443/api	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E81000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=0qXC	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gravvitywio.store/V	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=TlXuhKjTdHfu&l=e	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	BitLockerToGo.exe, 00000001.00000002.1962738078.0000000002EFA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E5B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1962601858.0000000002E6D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949590183.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	BitLockerToGo.exe, 00000001.00000003.1962305445.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1949536021.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
172.67.209.193	gravvitywio.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523595
Start date and time:	2024-10-01 20:14:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Google_Chrome.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@10/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 85% Number of executed functions: 12 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Google_Chrome.exe, PID 5812 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Google_Chrome.exe

Simulations

Behavior and APIs

Time	Type	Description
14:15:23	API Interceptor	2x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.209.193	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
172.67.209.193	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gravvitywio.store	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC	Browse	104.21.16.12
steamcommunity.com	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	vFjfAgq5PM.msi	Get hash	malicious	Amadey	Browse	2.19.126.136
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	88.221.169.152
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	184.28.90.27
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	184.28.88.176
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Message_2477367.eml	Get hash	malicious	Unknown	Browse	184.28.90.27
CLOUDFLARENETUS	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	Translink_rishi.vasandani_Advice81108.pdf	Get hash	malicious	Unknown	Browse	104.18.42.178
	https://hwvtu.us17.list-manage.com/track/click?u=b34582412f60404066a5f49b0&id=a034dac789&e=6353042e9a	Get hash	malicious	Unknown	Browse	104.18.69.40
	upd_9686786.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	172.67.74.152
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	104.26.12.205
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	104.22.74.216
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.183.74
	file.exe	Get hash	malicious	LummaC	Browse	104.21.77.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	test.xlsm	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	ZJh3V10O2e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	tomarket_app.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193
	SecuriteInfo.com.PUA.Win32.Lutimani.SMA.20966.14164.dll	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.47735772157448
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Google_Chrome.exe
File size:	4'921'344 bytes
MD5:	b82c3d4143ea779b06ef4fbc965db624
SHA1:	52172ad1a88ea85f679d8bf13f2567145a64f24b
SHA256:	b87ef5f2289241d1f437924bee4cccfbb16554a6a71d23f6fd930ff5c7c30dd8
SHA512:	561dc26a6ea6fb0694af632fe4ba8aef927d8e1c0159ea5d8d72c45cf50cf522d3296c7382eda1891746202feacac6ae5e17cbd8502dc1b09926f0a7023593fa
SSDEEP:	49152:MRTNHl10MKCLvJpx2CmAtIh5aGBLWAHrLPjQd4R+j0kYHuE36+OhS0gxf30F5cEC:oTNHl7d2Hd5lXHpKvhgZkF5
TLSH:	F7363811FAC785F5E9031934506BA27F5730AE098B34DB9BEB507B6AF9376920C36309
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........J..............."..\......`........ G...@...........................M.......L...@................................

File Icon


Icon Hash:	28236ae4b692c637

Static PE Info

General

Entrypoint:	0x471760
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Entrypoint Preview

Instruction
jmp 00007F64A51127A0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007F64A50EF176h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007F64A5114C04h
cld
call 00007F64A5113C8Eh
call 00007F64A51128C9h
add esp, 08h
ret
jmp 00007F64A5114AB0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007F64A5114AB1h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4bc000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d9000	0x327c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bd000	0x1a60c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4729c0	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x221b88	0x221c00	ab70e55ad895869c15c459092f901fba	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x223000	0x24eba0	0x24ec00	320724d65cb04e12967b059377161ef8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x472000	0x49f80	0x22800	2d19425a43797935d35317b95e88c77b	False	0.4301474750905797	data	4.932928119055307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4bc000	0x44c	0x600	4fb56c95a5562a4bcc77f4014f9e37fa	False	0.357421875	OpenPGP Public Key	3.8675703135794492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x4bd000	0x1a60c	0x1a800	2e099bd6a246db4f5870c69597814f10	False	0.6015625	data	6.649813179570731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x4d8000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x4d9000	0x327c	0x3400	7c58c13455990538d196e65154328078	False	0.3993389423076923	data	5.294660262195849	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4d9130	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.41504149377593363
RT_GROUP_ICON	0x4db6d8	0x14	data			1.1
RT_VERSION	0x4db6ec	0x564	data			0.3072463768115942
RT_MANIFEST	0x4dbc50	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T20:15:24.220696+0200	2055891	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)	1	192.168.2.4	60010	1.1.1.1	53	UDP
2024-10-01T20:15:24.232694+0200	2055881	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)	1	192.168.2.4	59926	1.1.1.1	53	UDP
2024-10-01T20:15:24.245096+0200	2055883	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)	1	192.168.2.4	62908	1.1.1.1	53	UDP
2024-10-01T20:15:24.258808+0200	2055893	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)	1	192.168.2.4	63406	1.1.1.1	53	UDP
2024-10-01T20:15:24.270855+0200	2055887	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)	1	192.168.2.4	56888	1.1.1.1	53	UDP
2024-10-01T20:15:24.284854+0200	2055885	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)	1	192.168.2.4	54907	1.1.1.1	53	UDP
2024-10-01T20:15:24.300963+0200	2055879	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)	1	192.168.2.4	55605	1.1.1.1	53	UDP
2024-10-01T20:15:24.313067+0200	2055895	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)	1	192.168.2.4	61554	1.1.1.1	53	UDP
2024-10-01T20:15:26.995229+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49736	172.67.209.193	443	TCP
2024-10-01T20:15:26.995229+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	172.67.209.193	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 20:15:24.340842962 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:24.340872049 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:24.340945005 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:24.369396925 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:24.369422913 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.051172018 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.051245928 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.054790020 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.054804087 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.055058002 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.098830938 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.171237946 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.215394974 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588512897 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588572025 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588592052 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.588617086 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588643074 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588660002 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.588666916 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588670969 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.588697910 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588722944 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.588737965 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.588756084 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.630098104 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.687107086 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.687130928 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.687174082 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.687189102 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.687208891 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.687220097 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.687251091 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.687274933 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.692344904 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.692400932 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.692435026 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.692481995 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.692492008 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.692583084 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.692631006 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.712966919 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.712986946 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.712999105 CEST	49733	443	192.168.2.4	104.102.49.254
Oct 1, 2024 20:15:25.713004112 CEST	443	49733	104.102.49.254	192.168.2.4
Oct 1, 2024 20:15:25.744131088 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:25.744189024 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:25.744262934 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:25.744609118 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:25.744640112 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.249895096 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.250005007 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.253806114 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.253832102 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.254062891 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.261658907 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.261698008 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.261771917 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.995255947 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.995345116 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.995410919 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.995596886 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.995625973 CEST	443	49736	172.67.209.193	192.168.2.4
Oct 1, 2024 20:15:26.995644093 CEST	49736	443	192.168.2.4	172.67.209.193
Oct 1, 2024 20:15:26.995651007 CEST	443	49736	172.67.209.193	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 20:15:24.220695972 CEST	60010	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.230619907 CEST	53	60010	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.232693911 CEST	59926	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.242696047 CEST	53	59926	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.245095968 CEST	62908	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.254477024 CEST	53	62908	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.258807898 CEST	63406	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.269575119 CEST	53	63406	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.270854950 CEST	56888	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.281819105 CEST	53	56888	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.284853935 CEST	54907	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.294207096 CEST	53	54907	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.300962925 CEST	55605	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.310463905 CEST	53	55605	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.313066959 CEST	61554	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.322681904 CEST	53	61554	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:24.325129986 CEST	61792	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:24.335666895 CEST	53	61792	1.1.1.1	192.168.2.4
Oct 1, 2024 20:15:25.728353977 CEST	60529	53	192.168.2.4	1.1.1.1
Oct 1, 2024 20:15:25.740187883 CEST	53	60529	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 20:15:24.220695972 CEST	192.168.2.4	1.1.1.1	0xde04	Standard query (0)	tendencctywop.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.232693911 CEST	192.168.2.4	1.1.1.1	0x42a5	Standard query (0)	keennylrwmqlw.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.245095968 CEST	192.168.2.4	1.1.1.1	0x5792	Standard query (0)	licenseodqwmqn.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.258807898 CEST	192.168.2.4	1.1.1.1	0x939f	Standard query (0)	tesecuuweqo.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.270854950 CEST	192.168.2.4	1.1.1.1	0x2996	Standard query (0)	relaxatinownio.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.284853935 CEST	192.168.2.4	1.1.1.1	0xbb17	Standard query (0)	reggwardssdqw.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.300962925 CEST	192.168.2.4	1.1.1.1	0xc028	Standard query (0)	eemmbryequo.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.313066959 CEST	192.168.2.4	1.1.1.1	0x42c1	Standard query (0)	tryyudjasudqo.shop	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.325129986 CEST	192.168.2.4	1.1.1.1	0x3696	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:25.728353977 CEST	192.168.2.4	1.1.1.1	0x96b9	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 20:15:24.230619907 CEST	1.1.1.1	192.168.2.4	0xde04	Name error (3)	tendencctywop.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.242696047 CEST	1.1.1.1	192.168.2.4	0x42a5	Name error (3)	keennylrwmqlw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.254477024 CEST	1.1.1.1	192.168.2.4	0x5792	Name error (3)	licenseodqwmqn.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.269575119 CEST	1.1.1.1	192.168.2.4	0x939f	Name error (3)	tesecuuweqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.281819105 CEST	1.1.1.1	192.168.2.4	0x2996	Name error (3)	relaxatinownio.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.294207096 CEST	1.1.1.1	192.168.2.4	0xbb17	Name error (3)	reggwardssdqw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.310463905 CEST	1.1.1.1	192.168.2.4	0xc028	Name error (3)	eemmbryequo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.322681904 CEST	1.1.1.1	192.168.2.4	0x42c1	Name error (3)	tryyudjasudqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:24.335666895 CEST	1.1.1.1	192.168.2.4	0x3696	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:25.740187883 CEST	1.1.1.1	192.168.2.4	0x96b9	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false
Oct 1, 2024 20:15:25.740187883 CEST	1.1.1.1	192.168.2.4	0x96b9	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

gravvitywio.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.102.49.254	443	3496	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:15:25 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-01 18:15:25 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 01 Oct 2024 18:15:25 GMT Content-Length: 34678 Connection: close Set-Cookie: sessionid=81281b1add1d89c1e58099e6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-01 18:15:25 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-01 18:15:25 UTC	16384	IN	Data Raw: 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f Data Ascii: ss': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_actio
2024-10-01 18:15:25 UTC	3768	IN	Data Raw: 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a Data Ascii: eLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content ">
2024-10-01 18:15:25 UTC	12	IN	Data Raw: 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: dy></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	172.67.209.193	443	3496	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:15:26 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-01 18:15:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-01 18:15:26 UTC	772	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:15:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=duqkq6imfo80k6b2c0up593d9a; expires=Sat, 25 Jan 2025 12:02:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cB2vQfCm67EmmdO4bUFGgAsbeUMnKI%2Fb7lG43X3ws2ymuML9XsUsXOl9rDkSc%2BY2UEJRnCuVca9TUtLrAmsX2nE2OnjZsQdNegeyoA7MEHnzNSX0MMSNCFVIlKAQwKW4o8X7aw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cbe70275c218c1d-EWR
2024-10-01 18:15:26 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-01 18:15:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:15:04
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\Google_Chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Google_Chrome.exe"
Imagebase:	0x8b0000
File size:	4'921'344 bytes
MD5 hash:	B82C3D4143EA779B06EF4FBC965DB624
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:15:16
Start date:	01/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x440000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	45.9%
Total number of Nodes:	85
Total number of Limit Nodes:	6

Executed Functions

Function 02C3F7C0 Relevance: 23.0, Strings: 18, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3[7], xrefs: 02C3F923
c#R%, xrefs: 02C3F889
tW:Y, xrefs: 02C3F918
Lo+q, xrefs: 02C3F95A
O+s-, xrefs: 02C3F89F
uCtE, xrefs: 02C3F8E1
?1, xrefs: 02C3FED0, 02C3FEE1, 02C3FED4, 02C3FEF9
dGnI, xrefs: 02C3F8EC
wI, xrefs: 02C3FD18
T'J), xrefs: 02C3F894
}3Y5, xrefs: 02C3F8B5
KH, xrefs: 02C3FD08
47, xrefs: 02C3FC17
C{, xrefs: 02C3FD10
K/L1, xrefs: 02C3F8AA
35, xrefs: 02C3FC0F
?1, xrefs: 02C3FC48
;_~a, xrefs: 02C3F92E

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 3[7]$47$;_~a$C{$K/L1$KH$Lo+q$O+s-$T'J)$c#R%$dGnI$tW:Y$uCtE$wI$}3Y5$35$?1$?1
API String ID: 0-3860861081
Opcode ID: a74d6588c1e273e6122cc927749ec2dcd05b87d91f17b8393feecc4f785d7c04
Instruction ID: 5d7fec1f16c128b5ff66f895f69c6ec7952426d184d4b37071a36c85e9d9c0a8
Opcode Fuzzy Hash: a74d6588c1e273e6122cc927749ec2dcd05b87d91f17b8393feecc4f785d7c04
Instruction Fuzzy Hash: A21273B8548381CBD324CF24D894B6BBBF5EB8A704F118E2CE6C99B250D7759815CB92

Function 02C3F140 Relevance: 20.8, Strings: 16, Instructions: 821
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>M"S, xrefs: 02C3F275
ME, xrefs: 02C3F351
[-I3, xrefs: 02C3F405
9I>O, xrefs: 02C3F26B
?1, xrefs: 02C3FED0, 02C3FEE1, 02C3FED4, 02C3FEF9
N5:;, xrefs: 02C3F419
[)[/, xrefs: 02C3F3FB
wI, xrefs: 02C3FD18
KH, xrefs: 02C3FD08
Y$_, xrefs: 02C3F293
B1A7, xrefs: 02C3F40F
47, xrefs: 02C3FC17
/Q6W, xrefs: 02C3F27F
C{, xrefs: 02C3FD10
35, xrefs: 02C3FC0F
?1, xrefs: 02C3FC48

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: /Q6W$47$9I>O$>M"S$B1A7$C{$KH$ME$N5:;$[)[/$[-I3$wI$35$?1$?1$Y$_
API String ID: 0-3722392735
Opcode ID: be8b9073e3a577a1b06aa62ff9d7d4d51c0202d45a589fab59d66bd2c3e49af8
Instruction ID: e140cf44e2712a96c5401d35c001be62fc44f43f2c93689c0bffb9b3da6ad401
Opcode Fuzzy Hash: be8b9073e3a577a1b06aa62ff9d7d4d51c0202d45a589fab59d66bd2c3e49af8
Instruction Fuzzy Hash: 1E52A6B5604B41CFD324CF25D894B6BBBF5FB89314F108E2CE59A8B690D774A818CB91

Function 02C702B8 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sgh, xrefs: 02C70420
%sgh, xrefs: 02C70340

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %sgh$%sgh
API String ID: 0-986295974
Opcode ID: 0d818eb4186c13186a29d77df21d10cb6f6156a7c7f8c4286350cefb69b2bf51
Instruction ID: bb7ca85d2e34b40cbd472e7a1875519dfb40612ef6c90fcacecb1bafe646545f
Opcode Fuzzy Hash: 0d818eb4186c13186a29d77df21d10cb6f6156a7c7f8c4286350cefb69b2bf51
Instruction Fuzzy Hash: 7A41F375F052069BDB18CEA8CC91B7EBBB2FB89321F244528E516F72D0D730E9108B64

Function 02C6F5F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(02C41D5D,00000000,00000001,00000000), ref: 02C6F61E

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 02C72EC0 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 02C72F85

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3659f8a6448830f2177cbffc1c98f3b8da135cb0e4f44988768530f04b2338cd
Instruction ID: 967cd3dd8fb17320c0d2b1a3e9831f2e41da5c0ccaffb0daacb0ce48549cf492
Opcode Fuzzy Hash: 3659f8a6448830f2177cbffc1c98f3b8da135cb0e4f44988768530f04b2338cd
Instruction Fuzzy Hash: 1741F3B5A083508BC724CF14C891B2BBBF1FFC5318F188A5CE98A5B391E3359904DB96

Function 02C70477 Relevance: 1.3, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4`[b, xrefs: 02C70520

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: 15f16c12c1f2883b63bea30dbeddbc8434a7a44105d3d679da70d05aaf0cb26e
Instruction ID: f44d6aeff22f44a897844cd98d445c850c40cc51c7378e6d47a086359c50d7ce
Opcode Fuzzy Hash: 15f16c12c1f2883b63bea30dbeddbc8434a7a44105d3d679da70d05aaf0cb26e
Instruction Fuzzy Hash: F3318976E5020A9BDB1CCF54D8A0A7EB772FB88315F24461CD413A7284CB30A911CB98

Function 02C6FF03 Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9560db5fa74c8020146d3f999f8c64186924281869ab87a5bf3425ea167263c
Instruction ID: f8e9ecc35ebd34335a2b38d8554fa888040e4e89ff4aeaf45939136f4d7dfc57
Opcode Fuzzy Hash: e9560db5fa74c8020146d3f999f8c64186924281869ab87a5bf3425ea167263c
Instruction Fuzzy Hash: 4061B0B5A002158FDB18CF64C8A177FBBB2FF89324F18945CD446AB395D7369A01CB94

Function 02C6F9B1 Relevance: .1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ea3c7db0503f9c7c5baf450f94bf13bbeb779227df80a5ac66cd3d4ff34f9b
Instruction ID: 770c691b0b69b48afa9c807f5507463a20116c1ba46f2d08ed4eed6e003247c6
Opcode Fuzzy Hash: 32ea3c7db0503f9c7c5baf450f94bf13bbeb779227df80a5ac66cd3d4ff34f9b
Instruction Fuzzy Hash: 634189B5E402168BCB18CF58D8A0A7EB7B2FF89314F24591CC413A3795C730A901CBA4

Function 02C3CC70 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 173
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 02C3CC81
GetCurrentThreadId.KERNEL32 ref: 02C3CC96
GetCurrentProcessId.KERNEL32 ref: 02C3CC9C
ExitProcess.KERNEL32 ref: 02C3CEC3

Strings

GDEB, xrefs: 02C3CE76
C@AN, xrefs: 02C3CE51

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: C@AN$GDEB
API String ID: 1029096631-2942872560
Opcode ID: 72fdc27eb0c50c1c326fc0927002f095827125439e1ab67385ef486699960d9c
Instruction ID: 1a595b8ab3150cc0c455b690a6fa4a83f5886304d48f511023cfb69b84fffc16
Opcode Fuzzy Hash: 72fdc27eb0c50c1c326fc0927002f095827125439e1ab67385ef486699960d9c
Instruction Fuzzy Hash: 8751777460C2808BC305EF28D590A1EFBE2AFA5304F188D2DE1C9D7352D73AD955CB56

Function 02C6F532 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7272f4aba2fc8de84788222be658a23f197b0db8d0f66346b1ab198021cbbd98
Instruction ID: d3abd7422935f53ec49c422cab227ff603a0aa1b650ff578a7b9ac34709b5cb9
Opcode Fuzzy Hash: 7272f4aba2fc8de84788222be658a23f197b0db8d0f66346b1ab198021cbbd98
Instruction Fuzzy Hash: 2011E3B19092409BD314EF29E98462FB3E7EBC4210F55CA5CD4C253614D375DC26CB92

Function 02C6C6C0 Relevance: 1.5, APIs: 1, Instructions: 47
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 02C6C748

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fc8df475d7a06fdaa32bc948d227770a118f4711be084353cd7f5da29d07918b
Instruction ID: 4c577b3373e6196d91d960e2027d25b1302813423d5020f663eb6459f131b60f
Opcode Fuzzy Hash: fc8df475d7a06fdaa32bc948d227770a118f4711be084353cd7f5da29d07918b
Instruction Fuzzy Hash: 29018C7420C2408BD309EF18D4A4A2EFBE6EF95314F158A5DE5CA076A1C7319C61CB86

Function 02C6C6A2 Relevance: 1.5, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 02C6C6A8

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2aaf3cfa0d6f6e90580f4974301879921fe5992a8a30b3605e27b00a597392a7
Instruction ID: 83cb560f140d74a8042f8fbcb9fad8ec121fea719df0ae04ec3e43aa067db7dd
Opcode Fuzzy Hash: 2aaf3cfa0d6f6e90580f4974301879921fe5992a8a30b3605e27b00a597392a7
Instruction Fuzzy Hash: 89B012704400005BEA012B18BC05B603614EB00204F300480F414480D2D1124CB3D588

Non-executed Functions

Function 02C55198 Relevance: 28.1, Strings: 22, Instructions: 564COMMON

Download Yara Rule

Strings

SF, xrefs: 02C55D40
_D, xrefs: 02C55D56
L;r9, xrefs: 02C55314
hg, xrefs: 02C556B5
<\, xrefs: 02C55D4B
ww, xrefs: 02C552A6
]Z, xrefs: 02C55D61
ss, xrefs: 02C55543
ep, xrefs: 02C55290
,{6y, xrefs: 02C55677
:o'm, xrefs: 02C55698
e'o%, xrefs: 02C555FE
/-, xrefs: 02C55BB0
wr, xrefs: 02C5529B
l3e1, xrefs: 02C5532A
}c, xrefs: 02C55538
j'J%, xrefs: 02C55361
$;, xrefs: 02C55BD8
4`[b, xrefs: 02C550D0
r+|), xrefs: 02C55340
tEzG, xrefs: 02C55905
#!, xrefs: 02C55BBB

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $;$,{6y$4`[b$:o'm$<\$L;r9$SF$]Z$_D$e'o%$ep$hg$j'J%$l3e1$r+|)$ss$tEzG$wr$ww$}c$#!$/-
API String ID: 0-598095080
Opcode ID: 5adc9497d99873c76068ffe22cb820e5c46c190fd305cfe12151098bad0e2ae9
Instruction ID: 2cce24ef0bc5b4ebf66931d9f2e985fe5debe3dfa2a13d405a2bcef5550fe88d
Opcode Fuzzy Hash: 5adc9497d99873c76068ffe22cb820e5c46c190fd305cfe12151098bad0e2ae9
Instruction Fuzzy Hash: E462C7B51093818BE338CF11D490BDFBAE2BBD6344F908A2DC9DE5B644DB7054498FA6

Function 02C40BE0 Relevance: 24.2, APIs: 4, Strings: 9, Instructions: 1452COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02C40CF4
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 02C40D16
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 02C410CE

Strings

XWRI, xrefs: 02C41571
z_~], xrefs: 02C41B41
NP]V, xrefs: 02C40DB7
IK, xrefs: 02C416C1
yq, xrefs: 02C41ACA
SRQ, xrefs: 02C41B56
}vw1, xrefs: 02C41563
~ivw, xrefs: 02C40F95
4`[b, xrefs: 02C41D36

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: Initialize$DirectorySecuritySystem
String ID: SRQ$4`[b$NP]V$XWRI$yq$z_~]$}vw1$~ivw$IK
API String ID: 1379780170-3077396563
Opcode ID: 85f6a67a99ef92621e1f29984d7ee8c7769b3a1c7a3c679743229fa34459086a
Instruction ID: 803db8ac63bb55036901eaa075c06b494d2686bc40315df42a95df03e71985e1
Opcode Fuzzy Hash: 85f6a67a99ef92621e1f29984d7ee8c7769b3a1c7a3c679743229fa34459086a
Instruction Fuzzy Hash: 57B2A7B4500B408BD324CF29C590727BBF2FF86704F188A5CD8AA8BB96D735E955CB91

Function 02C4B054 Relevance: 23.8, Strings: 18, Instructions: 1288COMMON

Download Yara Rule

Strings

(, xrefs: 02C4C1F6
,+*), xrefs: 02C4BDB5
LKJI, xrefs: 02C4BE0D
tu, xrefs: 02C4B4ED
5, xrefs: 02C4BDEC
HGFE, xrefs: 02C4BE18
dcba, xrefs: 02C4BE7B
$#"!, xrefs: 02C4BDCB
<;:, xrefs: 02C4BDE1
lkji, xrefs: 02C4BE65
4, xrefs: 02C4BDF7
!./,, xrefs: 02C4BD3C
(), xrefs: 02C4C550
ONM, xrefs: 02C4BE02
, xrefs: 02C4C13D, 02C4BEDE, 02C4C144
?>, xrefs: 02C4BDD6
su, xrefs: 02C4B231
@_^], xrefs: 02C4BE2E

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ?>$!./,$$#"!$($()$,+*)$4$<;:$@_^]$HGFE$LKJI$dcba$lkji$tu$ONM$su$5$
API String ID: 0-3379369873
Opcode ID: 0fa6ef5f0d778f2c503277e649ee39bf24845c8da92429ca0612167a55c95955
Instruction ID: c993bb792bd6689260f18d6e7b2941d1d92b284163f8a4207f57513fd9364e1a
Opcode Fuzzy Hash: 0fa6ef5f0d778f2c503277e649ee39bf24845c8da92429ca0612167a55c95955
Instruction Fuzzy Hash: 40B244B45093828BD370DF18C484BAFBBF2EFC5348F54892DE5998B251DB369985CB42

Function 02C5BD10 Relevance: 16.1, Strings: 12, Instructions: 1130COMMON

Download Yara Rule

Strings

wx,, xrefs: 02C5BF2A
J(Z, xrefs: 02C5BD31
$"\, xrefs: 02C5BEE4
OHI>, xrefs: 02C5BEB2
ggxz, xrefs: 02C5BDD8
JNGL, xrefs: 02C5BEBC
J$R, xrefs: 02C5E42E
Bk=9, xrefs: 02C5E33C
>!%, xrefs: 02C5BEDA
{l`~, xrefs: 02C5BDE2
NOHI, xrefs: 02C5BF5C
`xhr, xrefs: 02C5E662

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $"\$Bk=9$J$R$J(Z$JNGL$NOHI$OHI>$`xhr$ggxz$wx,${l`~$>!%
API String ID: 0-2323244691
Opcode ID: df2e177ad938d2406b5b89fc47b2a1be76e3ca4fbb9e74b471a7ccaf139d3f78
Instruction ID: baa807725f056a5836cdaf450709d4bb0948fb6fd3e0afd16d7503ac5bcaaa75
Opcode Fuzzy Hash: df2e177ad938d2406b5b89fc47b2a1be76e3ca4fbb9e74b471a7ccaf139d3f78
Instruction Fuzzy Hash: 0C928870104B928BD325CF3AC4A07A7BBE1AF96305F18495DD8EB8B382D735A645CF94

Function 02C42A2C Relevance: 15.7, Strings: 12, Instructions: 653COMMON

Download Yara Rule

Strings

<57&, xrefs: 02C43238
Tw, xrefs: 02C432BC
RTM5, xrefs: 02C4320C
=o;&, xrefs: 02C43222
//j9, xrefs: 02C43217
eo, xrefs: 02C4351A
>'b , xrefs: 02C4322D
,<;,, xrefs: 02C4324E
7'r!, xrefs: 02C43259
QXLC, xrefs: 02C432F8
:, xrefs: 02C435B3
#,%}, xrefs: 02C43243

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: #,%}$,<;,$//j9$7'r!$:$<57&$=o;&$>'b $QXLC$RTM5$Tw$eo
API String ID: 0-2033785059
Opcode ID: 57a82e570ed2cf63e6c8c4041ed4d3fedb1f021822ecb3d4569a395082a7a4d6
Instruction ID: 7464512ab2e8f7b5b95f2c7fe7bfd1e34f75201aa8fa9867dd1e11d6a09a1952
Opcode Fuzzy Hash: 57a82e570ed2cf63e6c8c4041ed4d3fedb1f021822ecb3d4569a395082a7a4d6
Instruction Fuzzy Hash: DB2290B19083819BD725CF28D890B6FBBF2AFC6304F144D6DE48A97251DB35D905CB92

Function 02C4CC90 Relevance: 12.4, Strings: 9, Instructions: 1145COMMON

Download Yara Rule

Strings

kXD], xrefs: 02C4D2B8
s}, xrefs: 02C4D40F
T, xrefs: 02C4D65C
DE, xrefs: 02C4CE3E
OMNV, xrefs: 02C4D269
{ze, xrefs: 02C4D41F
'9++, xrefs: 02C4D271
`c, xrefs: 02C4D279
B, xrefs: 02C4D280

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '9++$B$DE$OMNV$T$`c$kXD]$s}${ze
API String ID: 0-2673826114
Opcode ID: 41d7280871b5386fd4e8c10cb7091f36c08137f18ef9fc2f134dcb5520ba8e00
Instruction ID: 7d9fe42674997265f01f2440789ff1b70bb47319630fbf1e733ef590afb5f751
Opcode Fuzzy Hash: 41d7280871b5386fd4e8c10cb7091f36c08137f18ef9fc2f134dcb5520ba8e00
Instruction Fuzzy Hash: 87828AB060C3408BD314EF25C49066FBBF2EF96718F14891CE5CA8B392DB759909CB96

Function 02C31000 Relevance: 12.0, Strings: 9, Instructions: 763COMMON

Download Yara Rule

Strings

gfff, xrefs: 02C32308
+, xrefs: 02C32238
0123456789abcdefxp, xrefs: 02C3144E, 02C314BB
gfff, xrefs: 02C32354
gfff, xrefs: 02C32293
A, xrefs: 02C3221F
0123456789ABCDEFXP, xrefs: 02C31442, 02C314AB
W, xrefs: 02C31F9F
gfff, xrefs: 02C322A8

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$A$gfff$gfff$gfff$gfff$W
API String ID: 0-2303242756
Opcode ID: d4f1b744fe91e8fc2f6c03d3ce4f666a0ea0e50b81871ee620c7e2115f8eb3c5
Instruction ID: 030288bfc16b6fdfc01d8dda2fc9cd31908ab1246b164226c98b3fa5da8bf798
Opcode Fuzzy Hash: d4f1b744fe91e8fc2f6c03d3ce4f666a0ea0e50b81871ee620c7e2115f8eb3c5
Instruction Fuzzy Hash: A342F971A083818FD719CE29C49036ABBE2AFC5314F1C8A6DE8D9D7391D775D906CB82

Function 02C3D140 Relevance: 11.5, Strings: 9, Instructions: 230COMMON

Download Yara Rule

Strings

r}C}, xrefs: 02C3D27B
-XnS, xrefs: 02C3D25B
wyEH, xrefs: 02C3D28B
txZf, xrefs: 02C3D2AB
,(^^, xrefs: 02C3D253
fgK6, xrefs: 02C3D26B
}I{@, xrefs: 02C3D293
oRSV, xrefs: 02C3D263
p8&B, xrefs: 02C3D283

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,(^^$-XnS$fgK6$oRSV$p8&B$r}C}$txZf$wyEH$}I{@
API String ID: 0-34003872
Opcode ID: 5edc215fc6f1cbd33954a3d6f6557b6057eb2ec007fd91bc2fdd3e3d5a444ffc
Instruction ID: 34784ddd7e7699184d213b5e1bf89473aba23c80ae2b84f0b78073884113dae5
Opcode Fuzzy Hash: 5edc215fc6f1cbd33954a3d6f6557b6057eb2ec007fd91bc2fdd3e3d5a444ffc
Instruction Fuzzy Hash: E571CB7190D3928BD312CF25C15071BFFF2AFD6640F188A8CE8C51B259C3759A4ACB96

Function 02C40000 Relevance: 9.5, Strings: 7, Instructions: 702COMMON

Download Yara Rule

Strings

MK, xrefs: 02C408CA
QW, xrefs: 02C400CE
`ac, xrefs: 02C403A6
TT, xrefs: 02C4019F
S[, xrefs: 02C401AA
SI, xrefs: 02C408BA
Kf, xrefs: 02C40488, 02C4048C

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Kf$MK$SI$S[$TT$`ac$QW
API String ID: 0-1897345799
Opcode ID: 40e04b412f8d3bedbb7d8d9f3776216bbf987e953c15d320aca8c4352d90ffa1
Instruction ID: 9939fb71b7083e981b638b0a53a7c071b296d08f8edcb27ce37fca4c75e0af4b
Opcode Fuzzy Hash: 40e04b412f8d3bedbb7d8d9f3776216bbf987e953c15d320aca8c4352d90ffa1
Instruction Fuzzy Hash: BC4253B454C3419BD328DF25D890B6BBBE2EFD9304F148E1CE6CA4B291DB749844CB92

Function 02C68965 Relevance: 9.4, APIs: 6, Instructions: 381COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02C689A4
SysStringLen.OLEAUT32(1B8E19F9), ref: 02C68A63
VariantClear.OLEAUT32(?), ref: 02C68BEB
SysFreeString.OLEAUT32(?), ref: 02C68D4A
SysFreeString.OLEAUT32(?), ref: 02C68D4F
SysFreeString.OLEAUT32(?), ref: 02C68D62

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: String$Free$Variant$ClearInit
String ID:
API String ID: 4205145696-0
Opcode ID: f5ad0e7cf36fac8c15297e907deb86143afe9218bd5cf33ff8552c9fb71d355d
Instruction ID: c86a7afa8dc2c10135c1eb63294228981f4c0436f115402b1a213a65bd5db6fe
Opcode Fuzzy Hash: f5ad0e7cf36fac8c15297e907deb86143afe9218bd5cf33ff8552c9fb71d355d
Instruction Fuzzy Hash: 9CD1DB75604702CFD324CF25C894B26BBB2FF99310F148A2DD1828BB91D736B969CB80

Function 02C62D80 Relevance: 9.1, APIs: 6, Instructions: 111clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02C62DA2
GetWindowLongW.USER32 ref: 02C62DCD
GetClipboardData.USER32 ref: 02C62DDD
GlobalLock.KERNEL32 ref: 02C62DF7
GlobalUnlock.KERNEL32 ref: 02C62ED3
CloseClipboard.USER32 ref: 02C62ED9

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: d2c5925179dfc0d8956fd5521c0bc67b47430e456326f099c5c8dd90b1c7cce0
Instruction ID: 14ddeeb847d90bd8279cc3d8376bc45db88b103c080d9ab41c6a9b40ec0f7e75
Opcode Fuzzy Hash: d2c5925179dfc0d8956fd5521c0bc67b47430e456326f099c5c8dd90b1c7cce0
Instruction Fuzzy Hash: 914195709087858ED721ABBC988976FBFF1AB42220F048F6CD4E6876C1D7309559C7A3

Function 02C312F0 Relevance: 8.5, Strings: 6, Instructions: 955COMMON

Download Yara Rule

Strings

0, xrefs: 02C31E51
0, xrefs: 02C31EFC
u, xrefs: 02C31701
W, xrefs: 02C31F9F
, xrefs: 02C328BD
0, xrefs: 02C324B7

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $0$0$0$u$W
API String ID: 0-3205528186
Opcode ID: 7d74512d420b54fdd145d1463f25ef5d504b7f44432dac892a7b77c8f69d66b3
Instruction ID: fb3509a848eaed8f6ae56379a83d2cf9fc8b53c991c4685ff873038562e933d5
Opcode Fuzzy Hash: 7d74512d420b54fdd145d1463f25ef5d504b7f44432dac892a7b77c8f69d66b3
Instruction Fuzzy Hash: 33721871A083818FC71ACE28C59075ABBE1AFC9344F188E6DE8D997391D775DE05CB82

Function 02C57640 Relevance: 8.3, Strings: 6, Instructions: 791COMMON

Download Yara Rule

Strings

ylU{, xrefs: 02C57B0A
yfc, xrefs: 02C57A98
4`[b, xrefs: 02C57EE0
DD, xrefs: 02C5801F
ybl`, xrefs: 02C57AFA
}zso, xrefs: 02C57AF2

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: yfc$4`[b$DD$ybl`$ylU{$}zso
API String ID: 0-3693036141
Opcode ID: b1c9662835dff23d6a8ba4ad827819b74ea5ef766f85bc4b1876d87bb79d4c16
Instruction ID: 42bf04a9bb7f122a31d0b2e9de7728ce1dd11965f47b7a745f207c79092bc56f
Opcode Fuzzy Hash: b1c9662835dff23d6a8ba4ad827819b74ea5ef766f85bc4b1876d87bb79d4c16
Instruction Fuzzy Hash: B842BBB1A083918FD318DF28D49062BFBE2AFC9344F148A6DE8D687251D734D999CB52

Function 02C57370 Relevance: 8.1, Strings: 6, Instructions: 556COMMON

Download Yara Rule

Strings

ylU{, xrefs: 02C57B0A
yfc, xrefs: 02C57A98
4`[b, xrefs: 02C57EE0
DD, xrefs: 02C5801F
ybl`, xrefs: 02C57AFA
}zso, xrefs: 02C57AF2

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: yfc$4`[b$DD$ybl`$ylU{$}zso
API String ID: 0-3693036141
Opcode ID: 82907403bdbcbbcd7a87660c64d61a853b66f4bc13716109b13e53291255fb45
Instruction ID: 3fb13e8247e8d0f81633e116d2b0e13c6221b1ac9ef814bfb51078b8ac819254
Opcode Fuzzy Hash: 82907403bdbcbbcd7a87660c64d61a853b66f4bc13716109b13e53291255fb45
Instruction Fuzzy Hash: 750297B16083808BD318DF29D4A0A2FBBE2EFC5344F548A2DE9D28B351D774D995CB46

Function 02C53940 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 554COMMON

Download Yara Rule

Strings

hi, xrefs: 02C53E8C
hk, xrefs: 02C53FF1
pz, xrefs: 02C53CDB

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: hi$hk$pz
API String ID: 0-3399549940
Opcode ID: 99d0fe78253d4d3d873e7697c22f906609739ef0af71d49a465f2d41f2dedf5d
Instruction ID: c39a89889ef267e6f72b5b05e2ae7e96c89b82a4a60904045cb29945ed349e9f
Opcode Fuzzy Hash: 99d0fe78253d4d3d873e7697c22f906609739ef0af71d49a465f2d41f2dedf5d
Instruction Fuzzy Hash: 381273B420C3809BD314DF19C890A2EBBF1EF95748F048A6CE4D68B250E779D945CF9A

Function 02C3138D Relevance: 6.6, Strings: 5, Instructions: 343COMMON

Download Yara Rule

Strings

gfff, xrefs: 02C31FBC
0123456789abcdefxp, xrefs: 02C31394
-, xrefs: 02C31FA4
E, xrefs: 02C3138D
gfff, xrefs: 02C31FDB

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$0123456789abcdefxp$E$gfff$gfff
API String ID: 0-289536268
Opcode ID: 75eba9c2598e30735c2cd6664ea26915bf59d5babafe8e871b8ee27db4f7fc92
Instruction ID: 09c06e8d30058bc5570f0644b62d103d7ddf72584bbc41abe5801d4cef0b372d
Opcode Fuzzy Hash: 75eba9c2598e30735c2cd6664ea26915bf59d5babafe8e871b8ee27db4f7fc92
Instruction Fuzzy Hash: AFD1A43160C3928FC716CE29C48426AFBE1AFD9304F088A6DE8D997356D374DA05CB92

Function 02C5998F Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

@A, xrefs: 02C59886
\9b7, xrefs: 02C598A6
Q1:O, xrefs: 02C59866
G5M3, xrefs: 02C5985E
lM%K, xrefs: 02C5986E

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @A$G5M3$Q1:O$\9b7$lM%K
API String ID: 0-4206551269
Opcode ID: 0f126e07ca9e4ce3007ac912366309720f54404b01fa678ee32dcd74d47b8d09
Instruction ID: c3f1d1af7f8184c57693e9300873735f939501e352cb18fec28bea0346edd770
Opcode Fuzzy Hash: 0f126e07ca9e4ce3007ac912366309720f54404b01fa678ee32dcd74d47b8d09
Instruction Fuzzy Hash: 22519DB4A48301CBD324DF14D85176BB7B1FFC5319F048A5CE8C98B291E7389A55CB6A

Function 02C5CD06 Relevance: 6.0, Strings: 4, Instructions: 1034COMMON

Download Yara Rule

Strings

&@>T, xrefs: 02C5D5FF
`d2a, xrefs: 02C5D609
DB, xrefs: 02C5D8EE
%3"4, xrefs: 02C5D081

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %3"4$&@>T$DB$`d2a
API String ID: 0-1229532068
Opcode ID: dce18e26fccd7528f756c9f544d4623246f4afed3a8e79592d6c3b1560c809cc
Instruction ID: f58928dff075ba4cf87708e694a3a5d1d3fa02269913ff9a938155ffd2f23012
Opcode Fuzzy Hash: dce18e26fccd7528f756c9f544d4623246f4afed3a8e79592d6c3b1560c809cc
Instruction Fuzzy Hash: 4E72C370105B528BE329CF25C1A0BA3BBE2AF96304F14896EC4EB87792D735F585CB54

Function 02C3FFDE Relevance: 5.6, Strings: 4, Instructions: 612COMMON

Download Yara Rule

Strings

MK, xrefs: 02C408CA
`ac, xrefs: 02C403A6
SI, xrefs: 02C408BA
Kf, xrefs: 02C40488, 02C4048C

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Kf$MK$SI$`ac
API String ID: 0-4288373128
Opcode ID: 173648067d33571f4ccf463645359c4341e8427e061327f3a094234b0621c971
Instruction ID: 7ef165759756e9d1e7367d5f02f07cf5c928c1f0d4a6fcb4762d9272d0837512
Opcode Fuzzy Hash: 173648067d33571f4ccf463645359c4341e8427e061327f3a094234b0621c971
Instruction Fuzzy Hash: C81272B464C3019BD318DF24D894B2BBBF2EFD9704F048A2CE6CA87291DB759814DB52

Function 02C62EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02C62F39
GetSystemMetrics.USER32 ref: 02C62F4C

Strings

, xrefs: 02C63042

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 6e8a9fe85b3bdd5b25cf00f3e7f466089622c4ccd7d02986901d84c14fe6ca01
Instruction ID: 9a57c7cea62d12bf556af6fd1620ebe46b491c879e31a2edf2e65b6fd7aa516c
Opcode Fuzzy Hash: 6e8a9fe85b3bdd5b25cf00f3e7f466089622c4ccd7d02986901d84c14fe6ca01
Instruction Fuzzy Hash: 48D137F06093858BD3B0DF54C69878FBBF0BB85708F508A5DD4E89A250DBB45589CB87

Function 02C3D7D0 Relevance: 5.4, Strings: 4, Instructions: 438COMMON

Download Yara Rule

Strings

Kf, xrefs: 02C3DBD6
@, xrefs: 02C3DAD0
DC, xrefs: 02C3DCFA
G#, xrefs: 02C3DBDE

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @$DC$G#$Kf
API String ID: 0-1342140213
Opcode ID: 873123e911ec9ba20fc3daa199a3c57ac46ac9522e25fb620b50fbdc684703d7
Instruction ID: 911707ca949315ffaa17d743bf1914a48c2200864461173b52e3539f0234ecbe
Opcode Fuzzy Hash: 873123e911ec9ba20fc3daa199a3c57ac46ac9522e25fb620b50fbdc684703d7
Instruction Fuzzy Hash: 6AF154B420C3409BE319DF28D490A2FBBE6EB99708F148D2CE1C68B351D7359915CB97

Function 02C54A4F Relevance: 5.4, Strings: 4, Instructions: 386COMMON

Download Yara Rule

Strings

`a, xrefs: 02C54B90
U3C5, xrefs: 02C54A88
<KJM, xrefs: 02C54A98
C7HI, xrefs: 02C54A90

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: <KJM$C7HI$U3C5$`a
API String ID: 0-3065358329
Opcode ID: 754be6c001131820ad81e2c98c0c846e25569660726924eeb8db835b5ec30602
Instruction ID: aa63a4a4781dad0435a9a45256efe41476056e0889c57e9962085bf55a5491ab
Opcode Fuzzy Hash: 754be6c001131820ad81e2c98c0c846e25569660726924eeb8db835b5ec30602
Instruction Fuzzy Hash: 51D1BE76508762CBC328DF28C49066BB3F2FF99740F19891CE8C19B260E770E995CB95

Function 02C599B5 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

"|lp, xrefs: 02C59A61
{vux, xrefs: 02C59AA6
jlbo, xrefs: 02C59A59
bdjg, xrefs: 02C59A69

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "|lp$bdjg$jlbo${vux
API String ID: 0-1197034700
Opcode ID: 8501867df1eb8c34bd429c9268e26be5f0bfb4cfffc859769ec9ed3ec01d8f43
Instruction ID: d9f082679a6e4731a188c8635b1c221061065033845a159c7c3d65f37a0bd81e
Opcode Fuzzy Hash: 8501867df1eb8c34bd429c9268e26be5f0bfb4cfffc859769ec9ed3ec01d8f43
Instruction Fuzzy Hash: B7C1BCB1508381CBD324DF18C89176BBBE2EFC5308F048A6DE4D98B292E735E555CB96

Function 02C547E2 Relevance: 5.1, Strings: 4, Instructions: 112COMMON

Download Yara Rule

Strings

dUbS, xrefs: 02C547FE
xIfW, xrefs: 02C54858
XY, xrefs: 02C5481F
`Qn_, xrefs: 02C54809

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: XY$`Qn_$dUbS$xIfW
API String ID: 0-4017241727
Opcode ID: 5a419d02a1d9c2fce1dce638c7dc7c88bc4a215c312605dfb5a8be42bd752236
Instruction ID: aab83cee50d6545ca9cc76fe437f2a760dd61062570ac2315061d76119b28fa4
Opcode Fuzzy Hash: 5a419d02a1d9c2fce1dce638c7dc7c88bc4a215c312605dfb5a8be42bd752236
Instruction Fuzzy Hash: D23169B5609391CBD328CF15C4A17ABB7B2FFC6304F08985CD88A8B751DB349586CB96

Function 02C5E223 Relevance: 4.3, Strings: 3, Instructions: 538COMMON

Download Yara Rule

Strings

J$R, xrefs: 02C5E42E
Bk=9, xrefs: 02C5E33C
`xhr, xrefs: 02C5E662

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Bk=9$J$R$`xhr
API String ID: 0-1656375010
Opcode ID: 6cc340210d5641de6ee9fc7568cd623cf083526cc2d0bc616701579c32b273b9
Instruction ID: 62801e6799187cb5e06a4f1ed6191e28a2487bcdb153c69f44f2f93692be1040
Opcode Fuzzy Hash: 6cc340210d5641de6ee9fc7568cd623cf083526cc2d0bc616701579c32b273b9
Instruction Fuzzy Hash: BE126870144B928BD329CF39C4A0BA7BBE1AF56305F44485DD8EB8B682C739B645CF94

Function 02C3EB20 Relevance: 4.2, Strings: 3, Instructions: 445COMMON

Download Yara Rule

Strings

~, xrefs: 02C3EFB5
xy, xrefs: 02C3ED17
ur, xrefs: 02C3ED94

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ur$xy$~
API String ID: 0-3798557645
Opcode ID: 56bd465af7c7b316054a5c85d349cd56496ec8c84a0835200afc603b45afdbf0
Instruction ID: 15b0d669dae02bdbfd38fbf1eccdaa92d85b0a24c880d964b8ee20c404caaf49
Opcode Fuzzy Hash: 56bd465af7c7b316054a5c85d349cd56496ec8c84a0835200afc603b45afdbf0
Instruction Fuzzy Hash: 24F19AB150C3808BD316DF19C09072AFBE2AFDA618F188E1DE4D99B351D336D945CB96

Function 02C4E070 Relevance: 4.2, Strings: 3, Instructions: 427COMMON

Download Yara Rule

Strings

blav, xrefs: 02C4E116
6 5X, xrefs: 02C4E329
X, xrefs: 02C4E214

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 6 5X$X$blav
API String ID: 0-4234986367
Opcode ID: 1ee50f5d156b7190e5a63b343e18eff7b3b63ca204635532979168294ce09d54
Instruction ID: 40eef5133203edb88db474ef2e45cb294d5c0c80381a8d62726483b918429e3d
Opcode Fuzzy Hash: 1ee50f5d156b7190e5a63b343e18eff7b3b63ca204635532979168294ce09d54
Instruction Fuzzy Hash: BAE1987560C3809BD305DF29C890A2FBBE6BFD9314F088D2CE5C987252DB35A915CB92

Function 02C42C3C Relevance: 3.0, Strings: 2, Instructions: 507COMMON

Download Yara Rule

Strings

", xrefs: 02C43B4D
my, xrefs: 02C437EA

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$my
API String ID: 0-3987835623
Opcode ID: 7be97a07927eebec08c3a66ee86d7b80e0bcc17c9aa085c69cc05938801438c4
Instruction ID: c6c2f41f0e467d1a2555ac5dc2f90b4e675fb9b8769ac66f35d6d70aad9a9315
Opcode Fuzzy Hash: 7be97a07927eebec08c3a66ee86d7b80e0bcc17c9aa085c69cc05938801438c4
Instruction Fuzzy Hash: 2CF1ACB19083818FD714DF28C880B6FBBE6EFC6348F14496DE58987291EB35DA45CB52

Function 02C52480 Relevance: 3.0, Strings: 2, Instructions: 497COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C52980
@CBM, xrefs: 02C52711

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b$@CBM
API String ID: 2994545307-914015261
Opcode ID: bf9049ae2d284e3015637580840c9f00fd0a136e92d0dc8e42c9b5b0f9a5e11e
Instruction ID: e92264cc432eab718df91471dec63700472e9b4deed4f9c0ce8a6b68e9cf7a63
Opcode Fuzzy Hash: bf9049ae2d284e3015637580840c9f00fd0a136e92d0dc8e42c9b5b0f9a5e11e
Instruction Fuzzy Hash: 5CD1D0726082109BD715DF28C8A1A2BB7F1EF95314F09481CECC597351E339EA85CBA7

Function 02C4A1C0 Relevance: 3.0, Strings: 2, Instructions: 484COMMON

Download Yara Rule

Strings

xO, xrefs: 02C4A6BA
4`[b, xrefs: 02C4A630

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$xO
API String ID: 0-2409915359
Opcode ID: 80d48caad59ed5a65338df088eb842b51935de4bd6427d57880e5d0e5568aa1d
Instruction ID: b884ca801ecf0064157ff1621d85b6159572a619cd7aaae9f65a51fd76076c90
Opcode Fuzzy Hash: 80d48caad59ed5a65338df088eb842b51935de4bd6427d57880e5d0e5568aa1d
Instruction Fuzzy Hash: 04F1D1B55883418BD330DF18C8A0BAFB7F1EFCA354F04096CE5998B291EB359955CB52

Function 02C33790 Relevance: 2.9, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

Inf, xrefs: 02C337E7
NaN, xrefs: 02C337EE

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 4f4fb7ba4210511b16d348a1e146f6b0748806e54bc3a5b03a29847b647f5bf7
Instruction ID: 43a2ebcd3e6e915378146fb03956ed5ac9e7c21f96f6af87805638667f7f03d5
Opcode Fuzzy Hash: 4f4fb7ba4210511b16d348a1e146f6b0748806e54bc3a5b03a29847b647f5bf7
Instruction Fuzzy Hash: AFE110B2A083419BC705CF29C88065EBBE1EBC8754F148E6EF89997390E775DD458BC2

Function 02C5C752 Relevance: 2.9, Strings: 2, Instructions: 422COMMON

Download Yara Rule

Strings

drE, xrefs: 02C5C9B1
YJJW, xrefs: 02C5C8AB

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: drE$YJJW
API String ID: 0-53790862
Opcode ID: f56662e003d03a21006cd843c7705f7bd2603a34dc6301022bbb071cd3a4ffe3
Instruction ID: 56fc4de3e735b448a4b2def146481240e62d94c33060032a057e0d77eb51238f
Opcode Fuzzy Hash: f56662e003d03a21006cd843c7705f7bd2603a34dc6301022bbb071cd3a4ffe3
Instruction Fuzzy Hash: F2F19B70509B818BE325CB39C0A0BE7BBE1EF56304F54895EC8EB8B282C739B545CB54

Function 02C565A2 Relevance: 2.9, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

o<m, xrefs: 02C56930
4`[b, xrefs: 02C56A90

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$o<m
API String ID: 0-3792609330
Opcode ID: acf6978b8e2ddac1c90b661314b861c5668f7dfc92eec3ec52fdd3ec803e2b74
Instruction ID: 4350b4337094d0f09ed0250c789d4a4fca72cc1d58f2ac3d207bb2aedc546deb
Opcode Fuzzy Hash: acf6978b8e2ddac1c90b661314b861c5668f7dfc92eec3ec52fdd3ec803e2b74
Instruction Fuzzy Hash: E3E1BBB5D00215CFDB14CFA8D881BAEBBB1FF58304F6485A8E902AB346D7359955CFA0

Function 02C4FCFF Relevance: 2.9, Strings: 2, Instructions: 386COMMON

Download Yara Rule

Strings

{}, xrefs: 02C4FFDF
qu, xrefs: 02C50101

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: qu${}
API String ID: 0-3870973077
Opcode ID: 8dd12eef349a279ce9aafdfa030070cb88d5f3d9b3ba69b3ba902d2d12a707c8
Instruction ID: 62fa2862b3fe201ec5fce27dddde6f4c95974105db2ee0d1560ae82bc34c9769
Opcode Fuzzy Hash: 8dd12eef349a279ce9aafdfa030070cb88d5f3d9b3ba69b3ba902d2d12a707c8
Instruction Fuzzy Hash: D0D1CCB49003268FCB24CF68C891A6BBBB1FF49304B048A4CD8559F795E731E951CBE1

Function 02C591C0 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

y, xrefs: 02C59423
E|, xrefs: 02C594E6

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: E|$y
API String ID: 0-4277912986
Opcode ID: bd37e0dae42185fd40d24df12a44fdb1a5f9eaa70d22f6c1e78af516ea71e1fb
Instruction ID: cc129d91b16ddb2e5489ff7f97996d3cd9118314e2b390302f3f4b161750ee21
Opcode Fuzzy Hash: bd37e0dae42185fd40d24df12a44fdb1a5f9eaa70d22f6c1e78af516ea71e1fb
Instruction Fuzzy Hash: 94B1127150C3918BD328CF18D59076FBBE2BBC5B08F11491CE8A967391DB34EA49CB96

Function 02C70554 Relevance: 2.6, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C70520
4`[b, xrefs: 02C705E0

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b
API String ID: 0-3640500014
Opcode ID: 60f35ddd4fcb996abdc100b50a5848368632ce6a2618e1961eac4f2a27bc8584
Instruction ID: 3a6e20c842ec983c2a3d26bb973785603ccae3ff1df904242f46a11714c047b4
Opcode Fuzzy Hash: 60f35ddd4fcb996abdc100b50a5848368632ce6a2618e1961eac4f2a27bc8584
Instruction Fuzzy Hash: 91417EB6E1061A8BDB1CCF54C8A0ABEB772FFC9321F29552CC55267754C730AA01CB98

Function 02C72380 Relevance: 2.0, Strings: 1, Instructions: 729COMMON

Download Yara Rule

Strings

48fa, xrefs: 02C72436

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 48fa
API String ID: 0-2103941421
Opcode ID: bde2053d109b3c72a71e8fb8a13e13c96a2c32a839ea2abb8215c9fdb9af428f
Instruction ID: 986bfa689b3c1e9492f6613c9e6960c8c9fef080a0bff5d1d3a80debb28b2112
Opcode Fuzzy Hash: bde2053d109b3c72a71e8fb8a13e13c96a2c32a839ea2abb8215c9fdb9af428f
Instruction Fuzzy Hash: 8F32D232A08251CFC708CF28D8A066EB7F2FFC9314F198A6DD996A7355D731A915CB81

Function 02C72262 Relevance: 2.0, Strings: 1, Instructions: 718COMMON

Download Yara Rule

Strings

48fa, xrefs: 02C72436

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 48fa
API String ID: 0-2103941421
Opcode ID: 20e5815c15014806ed7587590dacf1fc4a35694c7c3744910a17d059f14d68cb
Instruction ID: aa7955d730e8a0203830c4157951027ddc8fd97872362d96e6e7d32e9d7d00d5
Opcode Fuzzy Hash: 20e5815c15014806ed7587590dacf1fc4a35694c7c3744910a17d059f14d68cb
Instruction Fuzzy Hash: 8A32D036A08211CFC704CF28D49066EB7F2FFC9314F198AADD999A7355D731A925CB82

Function 02C6D630 Relevance: 1.9, Strings: 1, Instructions: 633COMMON

Download Yara Rule

Strings

f, xrefs: 02C6D7F8

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 60005b4fa2376ceaae6ecf28c54b62ddc4871fcaa22356efd124a688b08bc52f
Instruction ID: b95b82b174207e8da7b18d756bb6a2a6985d8927a5afcbb50f33852aba4476ce
Opcode Fuzzy Hash: 60005b4fa2376ceaae6ecf28c54b62ddc4871fcaa22356efd124a688b08bc52f
Instruction Fuzzy Hash: 12329B716083419FC715CF29C8D4B2ABBE2EFC8318F188A2DE49687395D735E945CB92

Function 02C34EC0 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 02C35280

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 539639fa26a5195ab459d83ac66ada9bf45b8b8b47e6d014b642c28865758c51
Instruction ID: 5b193ed84004b2dc24ad5baa04e540fcbe30242c89e3eb1a7895e1323e072e7f
Opcode Fuzzy Hash: 539639fa26a5195ab459d83ac66ada9bf45b8b8b47e6d014b642c28865758c51
Instruction Fuzzy Hash: 3E127DB2A083418BD7278E55C440327B7E2BFD8398F9D8D6DD8994B341E7B5D905C781

Function 02C52200 Relevance: 1.8, APIs: 1, Instructions: 257comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(02C76BA0,00000000,00000001,02C76B90), ref: 02C52229

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: eadb2f9e7b8008b8a4dc49203d9c874bbcef087973bd61e1beee696d9333c783
Instruction ID: 9351b3d1ab9801396cefa920a332203c53c1e3447780435c05298f508e7a8435
Opcode Fuzzy Hash: eadb2f9e7b8008b8a4dc49203d9c874bbcef087973bd61e1beee696d9333c783
Instruction Fuzzy Hash: 8461EFB16003149BDB209F64CC95BAB33E8EF85368F044958ED8A8B290E775E985C766

Function 02C4AAC0 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbd045d54eb0a0591d33d9f740fbfa77f5d245b6bf8695b32ff57ed30be0780
Instruction ID: bcbc67d08de9888b1fec2f052f6341d53d8fc2651e6fbc35236d1d29c496a55f
Opcode Fuzzy Hash: 9bbd045d54eb0a0591d33d9f740fbfa77f5d245b6bf8695b32ff57ed30be0780
Instruction Fuzzy Hash: 2F619E72548351CFC720CF28C890A9BB7F1FF8A314F054A58E8AA9B391D731E945DB92

Function 02C49D22 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C4A0C0

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 5ca2820fd9dadf6990ecbc79e78a40701b0bf94e5c8c9a9af17ecd90926a34a4
Instruction ID: 2c4b3fbbfe83b439783b7e50471dce3304f90ef1c7d781e56512a6c605f85a8b
Opcode Fuzzy Hash: 5ca2820fd9dadf6990ecbc79e78a40701b0bf94e5c8c9a9af17ecd90926a34a4
Instruction Fuzzy Hash: F1B1E971508211CBDB19DF24C8A173BB3F2EFD5314F088A6CE5828B395E735A915DB92

Function 02C5B510 Relevance: 1.7, Strings: 1, Instructions: 414COMMON

Download Yara Rule

Strings

", xrefs: 02C5B808

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 9ca36c17f560dc583c782172b9ae7f5a300f49fd9a9337744eaf9c4914b19756
Instruction ID: 9b6ed3af241baf7b4be7e026158f344a8295bd6da671d220ad1e057ed4b5ddcc
Opcode Fuzzy Hash: 9ca36c17f560dc583c782172b9ae7f5a300f49fd9a9337744eaf9c4914b19756
Instruction Fuzzy Hash: D8D12972A083255BD715CE24C49076BBFE6AFC4358F088A2DEC9587385E734DE84CB95

Function 02C71840 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

P, xrefs: 02C719E3

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: e10512a6829860a7fd07763b0844628c44e9ec270e46c04213fcac6410d9495d
Instruction ID: afb9fa98d276ad96e9b3137250072b5143a3e95d8a4bf725991e271fafb1daf2
Opcode Fuzzy Hash: e10512a6829860a7fd07763b0844628c44e9ec270e46c04213fcac6410d9495d
Instruction Fuzzy Hash: D8D1D7725082648FD726CE18949071FB7E1EBC5728F1A8A2CE8B96B394C7B19D46C7C1

Function 02C71330 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

{zy, xrefs: 02C7137C

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: {zy
API String ID: 0-2415058467
Opcode ID: 016762e4dea88ac4c1a9fde93ffad309b72d2d9a180de50fbbd37758c07e4b74
Instruction ID: 9677fb9931b7b918003a1365df80d5ce0ee5634d70f5850cce5ab33f656cb9a2
Opcode Fuzzy Hash: 016762e4dea88ac4c1a9fde93ffad309b72d2d9a180de50fbbd37758c07e4b74
Instruction Fuzzy Hash: 66B1D072A083504BD328DF29DC81B6BB7E6EFC5318F08492DE999C7341E775E9058B92

Function 02C423B0 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

A, xrefs: 02C424EA

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-837457580
Opcode ID: 34d2eed3cbd1066b0bdc967201848a3df874e15fd9732b88f2f319ead93d1e20
Instruction ID: 688da9daa51b2a4098cb4dadabc58ca2e19cf510dc96b39b28446387c475be54
Opcode Fuzzy Hash: 34d2eed3cbd1066b0bdc967201848a3df874e15fd9732b88f2f319ead93d1e20
Instruction Fuzzy Hash: 26C138765083809BD328CF28D891B9FBBE2EF85708F14892DE9C987241EB35D945CB57

Function 02C70FE0 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02C71170

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 097e5c402fdca5ba0e5876b05e888f2772380f5b1a939ca4e93eb754cca9354d
Instruction ID: b78cbbc69171cb9902cc838f0f5c0f958f37e0de1078132cd5d01277927ea776
Opcode Fuzzy Hash: 097e5c402fdca5ba0e5876b05e888f2772380f5b1a939ca4e93eb754cca9354d
Instruction Fuzzy Hash: 8C81D1716083419BE724CF14DC90B6BB7E6EFC8358F188D2CE99997391E770A950CB92

Function 02C3A4A0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 02C3A5D6

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 1534b9535c00f8d2ea48f6b19659165e18c4af433301a72ffca75c3dbec6447c
Instruction ID: 772744049c528e416a38cb3b74e76a8bbf8929bdbdcb0b3af17e82d6b7668e68
Opcode Fuzzy Hash: 1534b9535c00f8d2ea48f6b19659165e18c4af433301a72ffca75c3dbec6447c
Instruction Fuzzy Hash: EFB14A711087819FC325CF18C88465BFBE0AFA9604F444E2DE5D997782D631EA18CBA7

Function 02C736A0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

@, xrefs: 02C73709

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b3ddea0d1a3ca53d9ccbb5af063ad8d3adb02a98e71e82d21843c059c1d55180
Instruction ID: 902a72984d14e6ef228788f4c0b3e942475a803b796f637839d0c2a6f734f3d7
Opcode Fuzzy Hash: b3ddea0d1a3ca53d9ccbb5af063ad8d3adb02a98e71e82d21843c059c1d55180
Instruction Fuzzy Hash: 7631A9B55083448BC314DF18D4C1A2BBBF6FFC9364F15892DE68887291E335E918CB96

Function 02C3BA90 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63a77b745610fe45f65243b0b179b1350dccda77ed11f5986965fa3b61d970b
Instruction ID: 1a58efef8cef9e9ab06aac138ce3ff87ab6473b47735b80930b225de2a685a33
Opcode Fuzzy Hash: f63a77b745610fe45f65243b0b179b1350dccda77ed11f5986965fa3b61d970b
Instruction Fuzzy Hash: 7D42F6326087118BC726DF19D88027EB3E2FFC4718F158E2ED9D697285D735AA51CB82

Function 02C3AF80 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e54f90b1e743f491b1821a663b8f80dee88dcc7613926e75e6bc9215da5e5b
Instruction ID: da6ebb88773e0a2d900f95d6d936b1a8e6ce63bdc2f29eb16607dbe8b3d1951f
Opcode Fuzzy Hash: 37e54f90b1e743f491b1821a663b8f80dee88dcc7613926e75e6bc9215da5e5b
Instruction Fuzzy Hash: 4852A670908B848FE736CB24C4847A7BBE1EFC1318F144C2DC5DB46A82D379AA85CB56

Function 02C36F70 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6a18067365e01a6f77ed5db0a260f161c32405b9802bd05d7a07b983164fb8
Instruction ID: afc7780ac441481b9056f68505ab3d344771121bd15820e1b3da4dff3440c893
Opcode Fuzzy Hash: dd6a18067365e01a6f77ed5db0a260f161c32405b9802bd05d7a07b983164fb8
Instruction Fuzzy Hash: E852D2B15083458FCB16CF29C0906AAFBE1FFC9318F198A6DE89957341D735D949CB81

Function 02C530CB Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28bf91df0a6a5892dadf683415b2846bc6faa4f7ac46d46b2f5c06bd6e1c86b
Instruction ID: df63e01e546ad47b786b6902f9b2ee5bfd77ba4efdb31738b6d4b1eafdc8313a
Opcode Fuzzy Hash: e28bf91df0a6a5892dadf683415b2846bc6faa4f7ac46d46b2f5c06bd6e1c86b
Instruction Fuzzy Hash: 1B12C071E44256CFDB14CF68D890BAEB7B2FF48351F1589A8D846E7280D734A9A4CF60

Function 02C37980 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4648cb6c432836a9828ca6e9ee8ed61addb13803aab8ed944b22370f72a396
Instruction ID: 4070f6f1ac11305ee8990a9f17eafce24f4db48ab75e66769e306f97530e1b92
Opcode Fuzzy Hash: ee4648cb6c432836a9828ca6e9ee8ed61addb13803aab8ed944b22370f72a396
Instruction Fuzzy Hash: 553212B0514B118FC36ACF29C59066AFBF2BF85610B505E2ED6978BF90D336B948CB50

Function 02C70750 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fe5bf5a248296257e38fbdbe79487f3ece7c8d7f71838f03b80825a9d7836e
Instruction ID: 82c04978a2c0a06d832c2ab867f956d813ef4ac17c350b5bb5c52b44fe3eb30b
Opcode Fuzzy Hash: b3fe5bf5a248296257e38fbdbe79487f3ece7c8d7f71838f03b80825a9d7836e
Instruction Fuzzy Hash: 6E02ED35A08391CFC715CF28D0D062AB7E2FF9A314F198E6DD89687391D730A969CB91

Function 02C726B0 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85112579b24e9f9be2184944190f9a2f088abf21a5b0b3ddf3ebf2227af631f2
Instruction ID: ef15dd1fbd074af695ba57078edf822377800eb5f9caa0c13fd6aabad567ba9f
Opcode Fuzzy Hash: 85112579b24e9f9be2184944190f9a2f088abf21a5b0b3ddf3ebf2227af631f2
Instruction Fuzzy Hash: 48F1F576A08211CFDB08CF28C49066EB7B2FFC9314F198A6DD89A67395C731AD15CB91

Function 02C39F80 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c3c08cd74c75003adddda90d935eb9156ff7235cfe28111bf5b203fa3afef9
Instruction ID: b6fb2f5eb0c77ef8438a2052681fd2723a335c3732595a56e6b321f410c45284
Opcode Fuzzy Hash: d5c3c08cd74c75003adddda90d935eb9156ff7235cfe28111bf5b203fa3afef9
Instruction Fuzzy Hash: 62F1A9712083418FC329CF29C885A2BBBE2EF99304F049D1DE4DA47791E371E958CB96

Function 02C43D23 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcf2b964c28a2bb1d3a041d22427b5d85781d6f1e2c3738db7fa9a32df7bfe2
Instruction ID: 933772c2f591c2571fd7f7934eac98888f72417bb3f3fc94654f693ba91e58db
Opcode Fuzzy Hash: cdcf2b964c28a2bb1d3a041d22427b5d85781d6f1e2c3738db7fa9a32df7bfe2
Instruction Fuzzy Hash: 64E15AB55183809BD328CF28C880BAFBBE6EFC9704F14896DE489C7251EB35D945CB56

Function 02C56F10 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7b40ec9469ae5d80e9c142cbe9d05646eb9197d6f4560d26a598b3a2637208b7
Instruction ID: a4784bebd27974012f7dd8151962943a657649c267e96d9d68c215a898cbb101
Opcode Fuzzy Hash: 7b40ec9469ae5d80e9c142cbe9d05646eb9197d6f4560d26a598b3a2637208b7
Instruction Fuzzy Hash: 51B1BD71A083518BD710DF28C880B2BF7E2EF95314F14892DE9858B251E735D9C9CB9A

Function 02C44374 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5227e3d759d5e1a1f4152100a01a7192d121574a5d92d5fe6e418da271bccc1
Instruction ID: 1fecaecfc464d9c7d7056a26283ec8dc45d6a86c80b0f22ffe16d167cabc213f
Opcode Fuzzy Hash: e5227e3d759d5e1a1f4152100a01a7192d121574a5d92d5fe6e418da271bccc1
Instruction Fuzzy Hash: 79D10572908311CBC729DF24D880B6B77F6EFC9314F180A6DE49697291EB34D955CB82

Function 02C71D50 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6214f46ac4153071c70fdbe6c2a5f1d6ca75d79a3c238d38867211fe6798319c
Instruction ID: 5d072a78d5734812416e6b15cf1273a379cd8b3b3454cf4d7c0a5d4bdb093786
Opcode Fuzzy Hash: 6214f46ac4153071c70fdbe6c2a5f1d6ca75d79a3c238d38867211fe6798319c
Instruction Fuzzy Hash: D2D1BA76A08216CFCB04CF68D891AAEB7F1FF89304F1989A9E855E7351D330E954CB91

Function 02C392C5 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbcac24d8566dca226ec2f50fc968bef9bf8325e9bab42c68c42f266dcec70e
Instruction ID: 17cdfa3977ad9b7791f2cbd3e0d1bcd456e13f204f34b3fa0d5ca34cd70c2747
Opcode Fuzzy Hash: ccbcac24d8566dca226ec2f50fc968bef9bf8325e9bab42c68c42f266dcec70e
Instruction Fuzzy Hash: 93E16674500601DFD764CF29C458B46BBF2BF48314F088A6DE58A8BB52D375EAA8DF90

Function 02C52D6A Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e63ac2a596df99d346da5e4fc5575c45b14a3d92ff568c4b376ef54bb996a8
Instruction ID: c96efccac0f892dcf894c3eb15b1c4deabff06645db2c14b7323525e8727b9ab
Opcode Fuzzy Hash: f4e63ac2a596df99d346da5e4fc5575c45b14a3d92ff568c4b376ef54bb996a8
Instruction Fuzzy Hash: DFA1D3B1E00269CBDB24CFA8C890BAEBBB1FF85304F148599D855EB341D7319986CF94

Function 02C73DE0 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0882afafdf8b2e2ff504458fe8d04984ce55459e2f942b0e26c7e81279bf468b
Instruction ID: d10a7bfa393efbd6b1e86ed3b038254113c0efda6beb8ae78d5901a26a9c989e
Opcode Fuzzy Hash: 0882afafdf8b2e2ff504458fe8d04984ce55459e2f942b0e26c7e81279bf468b
Instruction Fuzzy Hash: B691BE752083829FC724DF18D880A2AB3F2EFC8754F18896CE9858B355E731ED51DB92

Function 02C74110 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 16ec13ba478654115dae39bd795ca29c32824813c968888b6ffed33d4e6607a8
Instruction ID: 43afee40090c126f654e703c3cc3d0dd107ccbbca2c3b66b2ea2ada24fcc3b4a
Opcode Fuzzy Hash: 16ec13ba478654115dae39bd795ca29c32824813c968888b6ffed33d4e6607a8
Instruction Fuzzy Hash: 6B81BD716083419BD728DF18E880A2BBBF2FFD5304F15892CE9998B351D731E955CB92

Function 02C737E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28cdf2e955e32a59922bacdd7a7b6408cf6ef00971eb75c151011e15a63c6529
Instruction ID: 39714458309234d8ba6f2250d8272b0fa71ca1f866cffd0bd2a1cc2ac2284fef
Opcode Fuzzy Hash: 28cdf2e955e32a59922bacdd7a7b6408cf6ef00971eb75c151011e15a63c6529
Instruction Fuzzy Hash: 3691B0746083819BD311DF28C880A2BB7E2EFC4764F18C9ADE8C59B365D731E851DB92

Function 02C73AF0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b074b9fb0a4457d7c8ca02acbad55976dbdc3f178dc083ff245854115cc4aa
Instruction ID: 9afcd9e15e6f79f7cc5dc909c3b41a6ea9df5c87a65efda06c96230397139d71
Opcode Fuzzy Hash: e3b074b9fb0a4457d7c8ca02acbad55976dbdc3f178dc083ff245854115cc4aa
Instruction Fuzzy Hash: C691FF746083918BD728DF18C480A2BB3A2FFD8714F1989ACE9864B355E731E951DB82

Function 02C58E63 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa217ebe77588713f2a726c3e0a4d9a5eb1e2abce5d6bb41eb40740f029a5
Instruction ID: 303276227fcf7228b76cb72dfe250dd559a973a31fdc9a4e73186ee50a202702
Opcode Fuzzy Hash: bf2aa217ebe77588713f2a726c3e0a4d9a5eb1e2abce5d6bb41eb40740f029a5
Instruction Fuzzy Hash: 97911631948394DFD7148F38984035A7BE2EF8A324F098BADE9A55B2D1D731DE94CB81

Function 02C53640 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270d9e43cbf77a9d138b5ceaa942952f6488379acb11666d08c2fa0a33519029
Instruction ID: 2e51b6bb5e5c64a942f2717ef06cc226d822c90fe87202ffbfa6e5da4056bea3
Opcode Fuzzy Hash: 270d9e43cbf77a9d138b5ceaa942952f6488379acb11666d08c2fa0a33519029
Instruction Fuzzy Hash: 8781BC70E44156CFDB18CF68D890BAEB7B2FB88351F1589A9D846E7380C730A9A5CF50

Function 02C53624 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6af336cf7d3f8e0cfb4ec4e2a35498c42dbbd46ec69ea3398a0de4776237ea1
Instruction ID: 603a3e71de9c3c384a2c6dcea17f2943f0f3360f9d5b560739b51cdf63eab5c5
Opcode Fuzzy Hash: a6af336cf7d3f8e0cfb4ec4e2a35498c42dbbd46ec69ea3398a0de4776237ea1
Instruction Fuzzy Hash: 8181CB70E44156CFDB18CF68D890BAEB7B2FB88351F1589A9D846E7380C730A9A4CF50

Function 02C56230 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d43af2e3d8e0da42577eb0ed57251ddc4e1a5d7c7798d1be1c0247532a141da
Instruction ID: af1c37eb95f2589c43d137c5af47d2e3e09d19a1ac8ed6c30b0e5f911feeb9ec
Opcode Fuzzy Hash: 8d43af2e3d8e0da42577eb0ed57251ddc4e1a5d7c7798d1be1c0247532a141da
Instruction Fuzzy Hash: 6D819AB05083508BC314DF18C891A2BBBF5EFD5358F549A1DE8C68B361E735D988CB8A

Function 02C42001 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b12071444cb1722fe9fbbd646eaa67904f132a836ecc959de4573a062cd964
Instruction ID: cedbbd33ad80349315c74378817d1fce429f497e7c23b39f15e717553a127d34
Opcode Fuzzy Hash: b8b12071444cb1722fe9fbbd646eaa67904f132a836ecc959de4573a062cd964
Instruction Fuzzy Hash: FF716BB56183828BD324DF28E991B6BB7F6EB86305F084C2DE485D7241D739D909CB63

Function 02C6CC30 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dea81bc45bbf68106d20a3ddaf793a1ec77eaf1b375e41768a07dc6d4fa2b0
Instruction ID: 5eb3ff91a5456ebd4a8b0827cbc466a390eee9dab0cef7db8548318367d06d7c
Opcode Fuzzy Hash: c7dea81bc45bbf68106d20a3ddaf793a1ec77eaf1b375e41768a07dc6d4fa2b0
Instruction Fuzzy Hash: 9F61BC32A093909BC710DE28C8C866BBBE6EFD5754F19891EE8D497351D330EE15CB92

Function 02C62B60 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa25ddc050b3063a8a4f0fc2cbb0044647d2b15f892d6b5c7de86e2a78acbfc
Instruction ID: fae7639e0dd11c3c3db60bb1135fb7a03dd00090f08531a478f7e5e17f30e708
Opcode Fuzzy Hash: faa25ddc050b3063a8a4f0fc2cbb0044647d2b15f892d6b5c7de86e2a78acbfc
Instruction Fuzzy Hash: F4511636A4DE818BE3288D3D5CA93B66A434BD2330F2D876EDDF28B3D1D9654805C342

Function 02C67B00 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2818a53b562a8d8d139867ab5be757a3c7bb28c2bf908974e3aa663b3f12f80
Instruction ID: fcfeeadb268310cbfdadabd679b4c6e8d10efae8f059a843ac7509c82aaab2cc
Opcode Fuzzy Hash: d2818a53b562a8d8d139867ab5be757a3c7bb28c2bf908974e3aa663b3f12f80
Instruction Fuzzy Hash: 8B5159B16087549FE314DF29D49476BBBE1BBC4318F044E2DE4E987390E779D6088B82

Function 02C39909 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b659a33f71228a517c19803842b453b5be9bbb5b554a36091d75b1dc4b0e1c4e
Instruction ID: d2054eaa20432caf004422ba713b70f2e52c010084de544f3a187c12e751dc21
Opcode Fuzzy Hash: b659a33f71228a517c19803842b453b5be9bbb5b554a36091d75b1dc4b0e1c4e
Instruction Fuzzy Hash: 2A812335205B81CFD364CF29C584A52BBE2BF99310F488A5DD8868BB82C771F959CF90

Function 02C58C5E Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003aa0cd8d9040f22a04125a2e22f4d8d12c093799e87939308d2c34ca993448
Instruction ID: 1328e8a8059838ca44a1e2c33e3410309380481cc14c9e7f2cfb06154ad11028
Opcode Fuzzy Hash: 003aa0cd8d9040f22a04125a2e22f4d8d12c093799e87939308d2c34ca993448
Instruction Fuzzy Hash: 5951E5716157118FC725CF28C89076ABBE1EFC9314F198A2DE89AC7391DB30E985CB85

Function 02C35770 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4cb0c6a97202be561aa53f208f76790bd0bbd2fa907a74af6638c9ee3ec635
Instruction ID: 0d7c883f37a58a6f4dbbb236be75a69e87953173e5157044c5b87841690e7f85
Opcode Fuzzy Hash: 8f4cb0c6a97202be561aa53f208f76790bd0bbd2fa907a74af6638c9ee3ec635
Instruction Fuzzy Hash: 9551C1B5A043019FC715DF18C48092AB7E1FFC9368F554A6CE8999B351DB31ED42CB92

Function 02C3913D Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c529857608f0be036f1235d54aad17ff4e0fab91eb1718037b34acc379034fd3
Instruction ID: b13c8df030c5774a8b09a0051c756ad89f507efb11f91afc3e7d66b373de46b7
Opcode Fuzzy Hash: c529857608f0be036f1235d54aad17ff4e0fab91eb1718037b34acc379034fd3
Instruction Fuzzy Hash: F0519D36A04600CFD728CF29D86036A77A3FBC4318F2E8A7DC24647B81C775A856DB40

Function 02C40A70 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534d77208df51454a822cc607029ed2b05759650490a6164e5e13a060220da93
Instruction ID: 29d85c54f6ec9012dadc77b8b7bd1de2b3e66ffd7269684abef02c3be91cc643
Opcode Fuzzy Hash: 534d77208df51454a822cc607029ed2b05759650490a6164e5e13a060220da93
Instruction Fuzzy Hash: 4741166275C3900FC31CCE7D889022ABAD29BC5224F19873EF1A6C77D1EA74C645D750

Function 02C60AC0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ced871314c2253b8577523b1f2aeedcc0d1376e9691763f117d0084d983844
Instruction ID: aa6e98bd86d98a0b613d19ad012914853b0acd0e0db28846cb46f5a700c79d35
Opcode Fuzzy Hash: 31ced871314c2253b8577523b1f2aeedcc0d1376e9691763f117d0084d983844
Instruction Fuzzy Hash: C281F9F02593868BE3B18F51CA8C78FBBE4BBD5708F505E9D94E81A251CB750648CB82

Function 02C587AA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2babff33bd3ac6118b67e39872226853aa8cbf970ba94ee2ef4f12ec6b538c
Instruction ID: 1d8d2d588859c356215c3972d7b5290f3eb5f6de9a752550dd833182203e078b
Opcode Fuzzy Hash: ab2babff33bd3ac6118b67e39872226853aa8cbf970ba94ee2ef4f12ec6b538c
Instruction Fuzzy Hash: 8B3169B6A08390CBC311AF58E89175ABBF4EF95709F000E6DE9C58B201E336C994DB57

Function 02C58B4F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42310aaf3ede9c86dc3430a605e0e0f0a52ca84d22bf0e8b78ec55de7bdf758b
Instruction ID: bf1fdc399ce6f2a2dfd565ef6faf6313492115191814d87bf56277272ffb484d
Opcode Fuzzy Hash: 42310aaf3ede9c86dc3430a605e0e0f0a52ca84d22bf0e8b78ec55de7bdf758b
Instruction Fuzzy Hash: F02187B1908390CBC311AF58D890A5BBBF4EF85708F001E2CE9C18B301D33AC995DB56

Function 02C36BB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2e00ac9c5da6bcf805d5ff4a24faa489fceec623ff8f9fcd01979c9d5b00ed
Instruction ID: eaa69774202e479c1db0df9ece6efb1f178e1ce3d6e94e0495c86b4ad395384f
Opcode Fuzzy Hash: ef2e00ac9c5da6bcf805d5ff4a24faa489fceec623ff8f9fcd01979c9d5b00ed
Instruction Fuzzy Hash: 42113A37F24A220BF751CEB6E8C4716A756EBC921476A0E34EE41D7206C732F925D190

Function 02C657B0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 53814e8c24d5d90f30cf21585da5314451efabe06febe90f61e80686ecd4f5fe
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: C4110233A451D04EC3228D3C84845B5BFA30ED7174BE98399E4B89B2D2D6238A8AC350

Function 02C5AFD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fdde6e3120968f9835ce1991c723ab0c04d1f205f56e764b90d1801335abc3
Instruction ID: fd684bd1b16cf52649d1eb972dc016b13a00aabd78999cc9e1635a2b8d25b31c
Opcode Fuzzy Hash: 11fdde6e3120968f9835ce1991c723ab0c04d1f205f56e764b90d1801335abc3
Instruction Fuzzy Hash: A401B1F360031147DB219E1198C0B2FBAA96FC8708F08092CDD199B205FB76EE45EAD9

Function 02C493C0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ebfe7c9b2f055f3c23c326fc3b2ad9be9a42fa70a070a38dfb9b7e5e8440bc
Instruction ID: 4ea45409df17c602377207b78648014845e6fe4786d1c795f6ffe301e737d880
Opcode Fuzzy Hash: a7ebfe7c9b2f055f3c23c326fc3b2ad9be9a42fa70a070a38dfb9b7e5e8440bc
Instruction Fuzzy Hash: 69F0ECB1A0412067DB328954DCC1F37FBACCBC7254F192415E94657541D5719445C3E5

Function 02C686C0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a5cd1840b749a412b3d61370cb4e41c4a01d24e6c1c2b5e6623894b536f429
Instruction ID: 4250bafb8fe5e74b94accb2c34979d695909cd694ad4390bf6405627ebf5610c
Opcode Fuzzy Hash: c2a5cd1840b749a412b3d61370cb4e41c4a01d24e6c1c2b5e6623894b536f429
Instruction Fuzzy Hash: E4F0FEB4D00B00BB8260BF3EC947913BFF8E646260B50562DE89597795E630E8598BD7

Function 02C6AD90 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 7d55cf1ed13d24ab9773afd83f03aa92f598d531b37ff764c569f2cabc7ce46a
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: A3D0A761608321479B74CE19E444977F7F0EBC7B12F89955EF682F3248D730D841C2A9

Function 02C3E6E5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df760e229ae107fde57cb5a9a1969b65ee98563086816aed79493087490a20b5
Instruction ID: 23a278391d9f21865de3bb7bc8555c87daedf8a97e8fa92a146dde8eface5754
Opcode Fuzzy Hash: df760e229ae107fde57cb5a9a1969b65ee98563086816aed79493087490a20b5
Instruction Fuzzy Hash: A4D05E31B5040A4BCB0CCE2CCC515B4B3AAABCB204B09E23AA201DB396EA20E4118644

Function 02C6C696 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a2867feaabaf832bf5f8bf36e2e641c9241cc45a757e7bcea6a985ea0c9326
Instruction ID: b83eed6ce08554cb49a8afc48a18b938da9205b05c0cfb218e60285e8480b179
Opcode Fuzzy Hash: 17a2867feaabaf832bf5f8bf36e2e641c9241cc45a757e7bcea6a985ea0c9326
Instruction Fuzzy Hash: 3B900220E881428682048D009240975E239569B101F20BA008109330055360D817455D

Function 02C5FDB6 Relevance: 63.2, APIs: 1, Strings: 35, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02C5FE66

Strings

K, xrefs: 02C6000C
U, xrefs: 02C5FFFC
Q, xrefs: 02C5FFDC
I, xrefs: 02C6001C
F, xrefs: 02C5FED4
C, xrefs: 02C6004C
], xrefs: 02C5FFBC
h, xrefs: 02C5FEF4
P, xrefs: 02C5FF14
G, xrefs: 02C6006C
_, xrefs: 02C5FF34
E, xrefs: 02C6007C
_, xrefs: 02C5FF44
0, xrefs: 02C60160
D, xrefs: 02C5FEA4
[, xrefs: 02C5FF8C
A, xrefs: 02C6005C
y, xrefs: 02C5FEC4
W, xrefs: 02C5FFEC
~, xrefs: 02C600B4
I, xrefs: 02C5FF64
_, xrefs: 02C5FFAC
y, xrefs: 02C6009C
q, xrefs: 02C5FE84
9, xrefs: 02C5FF74
{, xrefs: 02C6008C
A, xrefs: 02C5FE94
}, xrefs: 02C600BC
M, xrefs: 02C6003C
E, xrefs: 02C5FEB4
O, xrefs: 02C6002C
S, xrefs: 02C5FFCC
^, xrefs: 02C5FF24
6, xrefs: 02C5FF84
Y, xrefs: 02C5FF9C

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: 0$6$9$A$A$C$D$E$E$F$G$I$I$K$M$O$P$Q$S$U$W$Y$[$]$^$_$_$_$h$q$y$y${$}$~
API String ID: 2525500382-294067926
Opcode ID: 2892ccd40fce733412b2a3c45a611213bf5628d31d529ee12b531d3b90550c9b
Instruction ID: 7e84618aeaf7462fed2de44a45649d01f7ffcd10572cb7beb63e0c7e13c41e6e
Opcode Fuzzy Hash: 2892ccd40fce733412b2a3c45a611213bf5628d31d529ee12b531d3b90550c9b
Instruction Fuzzy Hash: 2DA1917000CBC68ED3368A2884487DBBED16BA6324F084A9DD5EC4A2E2D3B94545DB67

Function 02C60F0D Relevance: 54.4, APIs: 1, Strings: 30, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02C60FD2

Strings

B, xrefs: 02C610DB
D, xrefs: 02C60FFF
E, xrefs: 02C610C7
F, xrefs: 02C6101D
', xrefs: 02C61077
0, xrefs: 02C611C7
p, xrefs: 02C6108B
r, xrefs: 02C6109F
l, xrefs: 02C610EF
P, xrefs: 02C61045
9, xrefs: 02C61013
Y, xrefs: 02C610BD
\, xrefs: 02C60F3B
t, xrefs: 02C61081
A, xrefs: 02C610A9
%, xrefs: 02C60F1B
[, xrefs: 02C610E5
E, xrefs: 02C610F9
f, xrefs: 02C610D1
E, xrefs: 02C61009
J, xrefs: 02C610B3
i, xrefs: 02C61103
V, xrefs: 02C6110D
_, xrefs: 02C61059
E, xrefs: 02C61095
(, xrefs: 02C61031
_, xrefs: 02C61063
A, xrefs: 02C60FF5
%, xrefs: 02C60F2B
^, xrefs: 02C6104F

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: %$%$'$($0$9$A$A$B$D$E$E$E$E$F$J$P$V$Y$[$\$^$_$_$f$i$l$p$r$t
API String ID: 2525500382-3365854356
Opcode ID: f16abd313cff75e6c0556b2d75daa1a998fb2aaaa05323db7edd032d5c10053c
Instruction ID: c8d04fcc296c90dd3265357cff837c972fbcaa594f2b64a8a7497001e972f824
Opcode Fuzzy Hash: f16abd313cff75e6c0556b2d75daa1a998fb2aaaa05323db7edd032d5c10053c
Instruction Fuzzy Hash: B091926000C7C18AD362CA3C948875FBFE16BA7228F484B9DE1E94B3D2D7B58545C767

Function 02C61B6A Relevance: 54.4, APIs: 1, Strings: 30, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02C61C28

Strings

Y, xrefs: 02C61D13
D, xrefs: 02C61C55
i, xrefs: 02C61D59
_, xrefs: 02C61CB9
r, xrefs: 02C61CF5
\, xrefs: 02C61B91
B, xrefs: 02C61D31
0, xrefs: 02C61E16
[, xrefs: 02C61D3B
_, xrefs: 02C61CAF
t, xrefs: 02C61CD7
l, xrefs: 02C61D45
E, xrefs: 02C61CEB
V, xrefs: 02C61D63
^, xrefs: 02C61CA5
(, xrefs: 02C61C87
%, xrefs: 02C61B81
', xrefs: 02C61CCD
A, xrefs: 02C61C4B
%, xrefs: 02C61B71
E, xrefs: 02C61C5F
E, xrefs: 02C61D4F
P, xrefs: 02C61C9B
f, xrefs: 02C61D27
p, xrefs: 02C61CE1
E, xrefs: 02C61D1D
A, xrefs: 02C61CFF
J, xrefs: 02C61D09
9, xrefs: 02C61C69
F, xrefs: 02C61C73

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: %$%$'$($0$9$A$A$B$D$E$E$E$E$F$J$P$V$Y$[$\$^$_$_$f$i$l$p$r$t
API String ID: 2525500382-3365854356
Opcode ID: c2fa59e2ac5ea0d3187d130a5a468ac92cf5706c028eeca5c06cdbef162008f4
Instruction ID: 29017f397f886d51d04c9eae713f4ca9391b0230436966a3766b141c733cd6ed
Opcode Fuzzy Hash: c2fa59e2ac5ea0d3187d130a5a468ac92cf5706c028eeca5c06cdbef162008f4
Instruction Fuzzy Hash: 3481806000CBC18AD322DA3C958875FBFE15BA7228F484B9DE1E94A3D2D3B58545CB67

Function 02C6263C Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 88COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02C6267B

Strings

-, xrefs: 02C62709
3, xrefs: 02C62749
Y, xrefs: 02C626E1
Q, xrefs: 02C62721
[, xrefs: 02C626F1
%, xrefs: 02C626C1
9, xrefs: 02C626E9
', xrefs: 02C626D1
], xrefs: 02C62701
U, xrefs: 02C62741
_, xrefs: 02C62711
S, xrefs: 02C62731
I, xrefs: 02C62761
!, xrefs: 02C626A1
#, xrefs: 02C626B1
H, xrefs: 02C62759
W, xrefs: 02C62751
3, xrefs: 02C62729
B, xrefs: 02C626C9

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: !$#$%$'$-$3$3$9$B$H$I$Q$S$U$W$Y$[$]$_
API String ID: 1927566239-378982635
Opcode ID: d3b63d9853076de3b5e571f73e221a2277704c665afdce4e5e8eb6595cc6c694
Instruction ID: b6d82c95a1544f4c0cc4e81d496c07ee859bd1a8fb1e4c238118f11cb1bfb7e3
Opcode Fuzzy Hash: d3b63d9853076de3b5e571f73e221a2277704c665afdce4e5e8eb6595cc6c694
Instruction Fuzzy Hash: 8251C17050C3C18AD336CB68D4587DFBAE0AB92314F088D5ED5E96B282C7B94549CB63

Function 02C61674 Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 75COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02C6169B

Strings

', xrefs: 02C616F1
B, xrefs: 02C616E9
I, xrefs: 02C61781
_, xrefs: 02C61731
[, xrefs: 02C61711
], xrefs: 02C61721
3, xrefs: 02C61769
!, xrefs: 02C616C1
S, xrefs: 02C61751
3, xrefs: 02C61749
H, xrefs: 02C61779
Y, xrefs: 02C61701
%, xrefs: 02C616E1
Q, xrefs: 02C61741
-, xrefs: 02C61729
9, xrefs: 02C61709
W, xrefs: 02C61771
#, xrefs: 02C616D1
U, xrefs: 02C61761

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: !$#$%$'$-$3$3$9$B$H$I$Q$S$U$W$Y$[$]$_
API String ID: 1927566239-378982635
Opcode ID: bf0c23ed68c976a500fa40e1dae38cf77704f3b5b6c82dd6a40cb7a51aa2a6f5
Instruction ID: 9edaea32da2dbead8780e8e5ab11c1b06f9ab3340393a1e9366bccd562f76c0a
Opcode Fuzzy Hash: bf0c23ed68c976a500fa40e1dae38cf77704f3b5b6c82dd6a40cb7a51aa2a6f5
Instruction Fuzzy Hash: A0419F7010C7C18AD332CB68D55879FBEE06BA2318F488D9ED5D96B282C7B94549CB63

Function 02C69066 Relevance: 31.7, APIs: 4, Strings: 14, Instructions: 212memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02C68E38
SysAllocString.OLEAUT32(?), ref: 02C68EF4
SysAllocString.OLEAUT32(?), ref: 02C68F88
SysAllocString.OLEAUT32(?), ref: 02C69044

Strings

l3u5, xrefs: 02C68E4A
"_kQ, xrefs: 02C68FCA
9k?m, xrefs: 02C68E90
9k?m, xrefs: 02C68FDF
q7bI, xrefs: 02C68FA0
bS3U, xrefs: 02C68FD1
hKpM, xrefs: 02C68E58
l3u5, xrefs: 02C68F99
bS3U, xrefs: 02C68E82
1[!], xrefs: 02C68FC3
1[!], xrefs: 02C68E74
q7bI, xrefs: 02C68E51
"_kQ, xrefs: 02C68E7B
hKpM, xrefs: 02C68FA7

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: "_kQ$"_kQ$1[!]$1[!]$9k?m$9k?m$bS3U$bS3U$hKpM$hKpM$l3u5$l3u5$q7bI$q7bI
API String ID: 2525500382-2445104418
Opcode ID: c1254d5f2ebb463fc0897320c720e2f3d1750baa98d4b3261fda069278390071
Instruction ID: 0a3752a36d05e1ff3a0519ec84c71de68a125dd04033183e0f0be9de76cfaca2
Opcode Fuzzy Hash: c1254d5f2ebb463fc0897320c720e2f3d1750baa98d4b3261fda069278390071
Instruction Fuzzy Hash: 3C81E5B8600642CFD324CF29C494A16FBF2FF59700B259A9DE1868B756D739E885CF84

Function 02C601B2 Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 86COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C601C4
VariantInit.OLEAUT32 ref: 02C601D7

Strings

%, xrefs: 02C60267
F, xrefs: 02C60203
_, xrefs: 02C60217
+, xrefs: 02C6027B
H, xrefs: 02C6020D
), xrefs: 02C60249
A, xrefs: 02C601F9
+, xrefs: 02C6023F
L, xrefs: 02C6022B
#, xrefs: 02C60253
q, xrefs: 02C601EF
P, xrefs: 02C60221
, xrefs: 02C60271

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $#$%$)$+$+$A$F$H$L$P$_$q
API String ID: 2610073882-4140598507
Opcode ID: 3af54b4cac3f4e5b82f84c284bdd4a7830704e54b24d2a3042f9649970e81b0d
Instruction ID: 7e8f1213596c1dd8f71132c09ca25dbf4c8c3b60b304475f75d38b893dd87723
Opcode Fuzzy Hash: 3af54b4cac3f4e5b82f84c284bdd4a7830704e54b24d2a3042f9649970e81b0d
Instruction Fuzzy Hash: 1641BF7000C7C19ED362DB79948865AFFE06BA6228F481E8DF5E45B3E2C3758549CB63

Function 02C61E9D Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C61EA7
VariantInit.OLEAUT32 ref: 02C61EBA

Strings

}, xrefs: 02C61F16
e, xrefs: 02C61EEE
a, xrefs: 02C61EDA
u, xrefs: 02C61F41
w, xrefs: 02C61F51
y, xrefs: 02C61F02
g, xrefs: 02C61EF8
c, xrefs: 02C61EE4
, xrefs: 02C61F1B
{, xrefs: 02C61F0C
v, xrefs: 02C61F49
s, xrefs: 02C61F34
q, xrefs: 02C61F2A

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $a$c$e$g$q$s$u$v$w$y${$}
API String ID: 2610073882-4032568888
Opcode ID: 1ee4fa18b3c7a892eaaec3d00ce8525a5ddd89589d1bea513f066255493f56a4
Instruction ID: b5a351479fba0da62804a7be63002b96e3dae89693e9ad92a6bdb9bf5bb3924c
Opcode Fuzzy Hash: 1ee4fa18b3c7a892eaaec3d00ce8525a5ddd89589d1bea513f066255493f56a4
Instruction Fuzzy Hash: AF41B27040C7C1CEE365DB28C05879BBFE0AB92308F18485CE5D94B392D7BA9548DB63

Function 02C5F723 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 84COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02C5F72D
VariantInit.OLEAUT32 ref: 02C5F740

Strings

#, xrefs: 02C5F7A3
n, xrefs: 02C5F7AB
+, xrefs: 02C5F7E3
!, xrefs: 02C5F7B3
%, xrefs: 02C5F793
-, xrefs: 02C5F7D3
', xrefs: 02C5F783
), xrefs: 02C5F7F3
;, xrefs: 02C5F763
9, xrefs: 02C5F773
/, xrefs: 02C5F7C3

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$%$'$)$+$-$/$9$;$n
API String ID: 2610073882-2266243175
Opcode ID: c004a19d2c1d1cc4e51f85c7f832b3c7cd6e4a8985053862c07ef26c32b259e2
Instruction ID: 13464cd3af1d64f431cbefe761638e5ebafc08243e384c009c745969fe73ee6c
Opcode Fuzzy Hash: c004a19d2c1d1cc4e51f85c7f832b3c7cd6e4a8985053862c07ef26c32b259e2
Instruction Fuzzy Hash: 9C41A37510C7C18ED3329B28844879BBFE1AF96314F084E9DE4E84B392C7B58549CB63

Function 02C68DCC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02C68E38
SysAllocString.OLEAUT32(?), ref: 02C68EF4

Strings

l3u5, xrefs: 02C68E4A
9k?m, xrefs: 02C68E90
bS3U, xrefs: 02C68E82
1[!], xrefs: 02C68E74
q7bI, xrefs: 02C68E51
"_kQ, xrefs: 02C68E7B
hKpM, xrefs: 02C68E58

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2525500382-1023481837
Opcode ID: 78ceaab5158ddc987ad61fb18d3bcbdf52b59e4bdc28c3b02f3c7de0c3106dce
Instruction ID: 530900c50c8cfd4478a311d6f0c89b4aa39cc2108b74643c7ea6b88336eada1b
Opcode Fuzzy Hash: 78ceaab5158ddc987ad61fb18d3bcbdf52b59e4bdc28c3b02f3c7de0c3106dce
Instruction Fuzzy Hash: 244118B5600682CFD324CF29C494B56FBF2FF99700B158A9CE1858B752D739E986CB84

Function 02C5FA4A Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 69COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02C5FA5B

Strings

T, xrefs: 02C5FA96
e, xrefs: 02C5FAC6
b, xrefs: 02C5FAD6
a, xrefs: 02C5FAB6
c, xrefs: 02C5FA86
R, xrefs: 02C5FAA6

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: R$T$a$b$c$e
API String ID: 1927566239-2761824072
Opcode ID: 02e12088b435dad1a7e358904c630283bcb45ffeabf3b51945f13a367cfc53dc
Instruction ID: 68f8eff2bd63ddc7c4f6e5eb84814c654df2f8d4e5cd650c93f2e084e58d3b21
Opcode Fuzzy Hash: 02e12088b435dad1a7e358904c630283bcb45ffeabf3b51945f13a367cfc53dc
Instruction Fuzzy Hash: B241F07000C7C18AD332DB68D59879EBBE0AB92714F044E5EE4E99B382C7718648CB63

Function 02C68915 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02C688B1
SysAllocString.OLEAUT32(?), ref: 02C688C1

Strings

7o=m, xrefs: 02C68845
Ig:e, xrefs: 02C68837

Memory Dump Source

Source File: 00000001.00000002.1962436529.0000000002C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 02C30000, based on PE: true

Associated: 00000001.00000002.1962420054.0000000002C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962467736.0000000002C75000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962483192.0000000002C78000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1962500432.0000000002C88000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c30000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: 7o=m$Ig:e
API String ID: 2525500382-1610144716
Opcode ID: 5fa7e337cf69486fb7ea151b0f19d452349ac33ad17a4fae9681584af98e93a4
Instruction ID: f96291b7efd2da6485b4d3a94541bd2569e8d9f356a1306b850271329a7b22f6
Opcode Fuzzy Hash: 5fa7e337cf69486fb7ea151b0f19d452349ac33ad17a4fae9681584af98e93a4
Instruction Fuzzy Hash: AE3146B8601A42DFE324CF29C594A26FBF1FF69B00B608A4DE1D5C7641C735B865CB80

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Google_Chrome.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Google_Chrome.exe

Function 02C3F7C0 Relevance: 23.0, Strings: 18, Instructions: 516
COMMON

Function 02C3F140 Relevance: 20.8, Strings: 16, Instructions: 821
COMMON

Function 02C702B8 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Function 02C6F5F0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 02C72EC0 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Function 02C70477 Relevance: 1.3, Strings: 1, Instructions: 89
COMMON

Function 02C6FF03 Relevance: .2, Instructions: 225
COMMON

Function 02C6F9B1 Relevance: .1, Instructions: 112
COMMON

Function 02C3CC70 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 173
threadCOMMON

Function 02C6F532 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 02C6C6C0 Relevance: 1.5, APIs: 1, Instructions: 47
memoryCOMMON

Function 02C6C6A2 Relevance: 1.5, APIs: 1, Instructions: 7
memoryCOMMON