Edit tour

Windows Analysis Report
N65c8rwdal.exe

Overview

General Information

Sample name:	N65c8rwdal.exe renamed because original name is a hash value
Original sample name:	660b29ad23f61f5565629f60cf59f848fc54c2c6ebe29883976468232a693745.exe
Analysis ID:	1524038
MD5:	ce773611c449cfa1f292fc805e532d2f
SHA1:	e566020de1c8557da9885dd36a6b7223c3567772
SHA256:	660b29ad23f61f5565629f60cf59f848fc54c2c6ebe29883976468232a693745
Tags:	exeGuizhouSixuandaTechnologyCoLtdsigneduser-JAMESWT_MHT
Infos:

Detection

LummaC, Go Injector, LummaC Stealer

Score:	93
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Go Injector

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

N65c8rwdal.exe (PID: 1848 cmdline: "C:\Users\user\Desktop\N65c8rwdal.exe" MD5: CE773611C449CFA1F292FC805E532D2F)

BitLockerToGo.exe (PID: 2472 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["relaxatinownio.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "tesecuuweqo.shop", "eemmbryequo.shop", "licenseodqwmqn.shop", "tendencctywop.shop", "reggwardssdqw.shop"], "Build id": "c2CoW0--1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
N65c8rwdal.exe	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2108992608.000000C00080E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000000.1685275237.00007FF730241000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000000.00000002.2111216784.00007FF730241000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Process Memory Space: N65c8rwdal.exe PID: 1848	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:55.706081+0200	2054653	1	A Network Trojan was detected	192.168.2.4	53478	172.67.209.193	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:55.706081+0200	2049836	1	A Network Trojan was detected	192.168.2.4	53478	172.67.209.193	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.109771+0200	2055879	1	Domain Observed Used for C2 Detected	192.168.2.4	59155	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.046046+0200	2055881	1	Domain Observed Used for C2 Detected	192.168.2.4	50101	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.058384+0200	2055883	1	Domain Observed Used for C2 Detected	192.168.2.4	51307	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.096189+0200	2055885	1	Domain Observed Used for C2 Detected	192.168.2.4	52454	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.084026+0200	2055887	1	Domain Observed Used for C2 Detected	192.168.2.4	54479	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.034351+0200	2055891	1	Domain Observed Used for C2 Detected	192.168.2.4	51181	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.071375+0200	2055893	1	Domain Observed Used for C2 Detected	192.168.2.4	64281	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T14:57:53.120977+0200	2055895	1	Domain Observed Used for C2 Detected	192.168.2.4	57213	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.N65c8rwdal.exe.c000554000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["relaxatinownio.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "tesecuuweqo.shop", "eemmbryequo.shop", "licenseodqwmqn.shop", "tendencctywop.shop", "reggwardssdqw.shop"], "Build id": "c2CoW0--1"}

Multi AV Scanner detection for submitted file

Source: N65c8rwdal.exe

ReversingLabs: Detection: 24%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tryyudjasudqo.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: eemmbryequo.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: reggwardssdqw.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: relaxatinownio.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tesecuuweqo.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: licenseodqwmqn.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: keennylrwmqlw.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String decryptor: c2CoW0--1

Source: N65c8rwdal.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:53475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.4:53478 version: TLS 1.2

Source: N65c8rwdal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0006B8000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2091088218.000001CA7F5E0000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2090871306.000001CA7F620000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0005DE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0006B8000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2091088218.000001CA7F5E0000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2090871306.000001CA7F620000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0005DE000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_02DBF0CD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor ebp, ebp	4_2_02D907BA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_02D9DAD1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	4_2_02DBCAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_02DBCAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	4_2_02D84AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor esi, esi	4_2_02DA7A67
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	4_2_02D90A10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000C0h]	4_2_02D91BDF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	4_2_02D91BDF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 625B6034h	4_2_02DA6390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	4_2_02D85BA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	4_2_02D9332C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_02DABB20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_02DA28F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	4_2_02DC28B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	4_2_02D87040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+54h]	4_2_02DAA067
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [ecx-01h]	4_2_02D81000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_02D8F1FC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_02D92998
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	4_2_02DBA180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	4_2_02D9D9BE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_02DC2150
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	4_2_02DA3108
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	4_2_02DA3108
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	4_2_02D8E965
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	4_2_02DA3108
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	4_2_02DA3108
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	4_2_02D8F134
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	4_2_02D94921
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	4_2_02DA2690
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	4_2_02D996B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-10h]	4_2_02DA3E59
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push 00000000h	4_2_02D83660
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_02DB4E60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	4_2_02DB8630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 625B6034h	4_2_02DB8630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_02DABE20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	4_2_02DBD7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	4_2_02D9279A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	4_2_02D92F92
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	4_2_02DC1790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor esi, esi	4_2_02DA7FB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then xor esi, esi	4_2_02DA7750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	4_2_02D92C84
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea edx, dword ptr [eax+01h]	4_2_02DAB4BE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebx+01h], 00000000h	4_2_02DA35E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	4_2_02D8DDB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	4_2_02DA3D0F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000D4h]	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], al	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+34h]	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	4_2_02DAC500

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055887 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop) : 192.168.2.4:54479 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055881 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop) : 192.168.2.4:50101 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055879 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop) : 192.168.2.4:59155 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055895 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop) : 192.168.2.4:57213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055891 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop) : 192.168.2.4:51181 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055893 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop) : 192.168.2.4:64281 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055883 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop) : 192.168.2.4:51307 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055885 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop) : 192.168.2.4:52454 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:53478 -> 172.67.209.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:53478 -> 172.67.209.193:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: relaxatinownio.shop
Source: Malware configuration extractor	URLs: tryyudjasudqo.shop
Source: Malware configuration extractor	URLs: keennylrwmqlw.shop
Source: Malware configuration extractor	URLs: tesecuuweqo.shop
Source: Malware configuration extractor	URLs: eemmbryequo.shop
Source: Malware configuration extractor	URLs: licenseodqwmqn.shop
Source: Malware configuration extractor	URLs: tendencctywop.shop
Source: Malware configuration extractor	URLs: reggwardssdqw.shop

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.209.193 172.67.209.193

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: tendencctywop.shop
Source: global traffic	DNS traffic detected: DNS query: keennylrwmqlw.shop
Source: global traffic	DNS traffic detected: DNS query: licenseodqwmqn.shop
Source: global traffic	DNS traffic detected: DNS query: tesecuuweqo.shop
Source: global traffic	DNS traffic detected: DNS query: relaxatinownio.shop
Source: global traffic	DNS traffic detected: DNS query: reggwardssdqw.shop
Source: global traffic	DNS traffic detected: DNS query: eemmbryequo.shop
Source: global traffic	DNS traffic detected: DNS query: tryyudjasudqo.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: N65c8rwdal.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: N65c8rwdal.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: N65c8rwdal.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: N65c8rwdal.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: N65c8rwdal.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: N65c8rwdal.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: N65c8rwdal.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: N65c8rwdal.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: N65c8rwdal.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: N65c8rwdal.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: N65c8rwdal.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: N65c8rwdal.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2134186080.0000000003381000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: N65c8rwdal.exe	String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: N65c8rwdal.exe	String found in binary or memory: https://golang.org/doc/faq#nil_errorx509:
Source: BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/)
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003346000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/7
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003346000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/G
Source: BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003346000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api7
Source: BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store:443/apifiles/76561199724331900
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: N65c8rwdal.exe	String found in binary or memory: https://management.azure.cominvalid
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/3y
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003312000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003312000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319001
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032F1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tendencctywop.shop/
Source: N65c8rwdal.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: N65c8rwdal.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 53478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53478

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:53475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.193:443 -> 192.168.2.4:53478 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 4_2_02DB2C80 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_02DB2C80

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 4_2_02DB2C80 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_02DB2C80

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 4_2_02DB2DF0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_02DB2DF0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2108992608.000000C00080E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D900A0	4_2_02D900A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8D1F0	4_2_02D8D1F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8F960	4_2_02D8F960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9DAD1	4_2_02D9DAD1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DAC2C0	4_2_02DAC2C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D942FE	4_2_02D942FE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DBCAF0	4_2_02DBCAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8F2E0	4_2_02D8F2E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D812E7	4_2_02D812E7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC2280	4_2_02DC2280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0AAF	4_2_02DC0AAF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA6A50	4_2_02DA6A50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC727B	4_2_02DC727B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA7A67	4_2_02DA7A67
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D90A10	4_2_02D90A10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0A20	4_2_02DC0A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D91BDF	4_2_02D91BDF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8CBF0	4_2_02D8CBF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8B390	4_2_02D8B390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0390	4_2_02DC0390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA3B8F	4_2_02DA3B8F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8A380	4_2_02D8A380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D87380	4_2_02D87380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA4B80	4_2_02DA4B80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9B35A	4_2_02D9B35A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D91353	4_2_02D91353
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB7340	4_2_02DB7340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA7300	4_2_02DA7300
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9332C	4_2_02D9332C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA28F0	4_2_02DA28F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC08B0	4_2_02DC08B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC28B0	4_2_02DC28B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB80A7	4_2_02DB80A7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D99850	4_2_02D99850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DAA067	4_2_02DAA067
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D81000	4_2_02D81000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB89E0	4_2_02DB89E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D92998	4_2_02D92998
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D91190	4_2_02D91190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9D1A6	4_2_02D9D1A6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA395E	4_2_02DA395E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9E920	4_2_02D9E920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8BEA0	4_2_02D8BEA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA3E59	4_2_02DA3E59
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D83660	4_2_02D83660
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D89E3D	4_2_02D89E3D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DBFE30	4_2_02DBFE30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB8630	4_2_02DB8630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0E30	4_2_02DC0E30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D93E28	4_2_02D93E28
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9A623	4_2_02D9A623
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9A623	4_2_02D9A623
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB27C0	4_2_02DB27C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA7FB0	4_2_02DA7FB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA7750	4_2_02DA7750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA8763	4_2_02DA8763
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8AF00	4_2_02D8AF00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9FCFB	4_2_02D9FCFB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D89C5D	4_2_02D89C5D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA3445	4_2_02DA3445
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0C10	4_2_02DC0C10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D89C0F	4_2_02D89C0F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D9ADCF	4_2_02D9ADCF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D87DC0	4_2_02D87DC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DBF5FC	4_2_02DBF5FC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA35E0	4_2_02DA35E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D8DDB0	4_2_02D8DDB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC25B0	4_2_02DC25B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DAB5A2	4_2_02DAB5A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA4D50	4_2_02DA4D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DB0D40	4_2_02DB0D40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DAC500	4_2_02DAC500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DA8533	4_2_02DA8533
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC0D20	4_2_02DC0D20

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02D8CA00 appears 66 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 02D9A000 appears 144 times

Source: N65c8rwdal.exe

Static PE information: Number of sections : 12 > 10

Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0006B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs N65c8rwdal.exe
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs N65c8rwdal.exe
Source: N65c8rwdal.exe, 00000000.00000003.2091088218.000001CA7F5E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs N65c8rwdal.exe
Source: N65c8rwdal.exe, 00000000.00000003.2090871306.000001CA7F620000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs N65c8rwdal.exe
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0005DE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs N65c8rwdal.exe

Source: 00000000.00000002.2108992608.000000C00080E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal93.troj.evad.winEXE@3/0@10/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 4_2_02DA2690 CoCreateInstance,

4_2_02DA2690

Source: C:\Users\user\Desktop\N65c8rwdal.exe

File created: C:\Users\Public\Libraries\bopdb.scif

Jump to behavior

Source: C:\Users\user\Desktop\N65c8rwdal.exe

File opened: C:\Windows\system32\2e06423a2e6c9ac3677f3fe4a22bb8b5180da5f547edd3e873b22c0fa61b486dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: N65c8rwdal.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\N65c8rwdal.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: N65c8rwdal.exe

ReversingLabs: Detection: 24%

Source: N65c8rwdal.exe	String found in binary or memory: net/addrselect.go
Source: N65c8rwdal.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: N65c8rwdal.exe	String found in binary or memory: HuHatEoCKu/load.go

Source: C:\Users\user\Desktop\N65c8rwdal.exe

File read: C:\Users\user\Desktop\N65c8rwdal.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\N65c8rwdal.exe "C:\Users\user\Desktop\N65c8rwdal.exe"
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\N65c8rwdal.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior

Source: N65c8rwdal.exe

Static PE information: certificate valid

Source: N65c8rwdal.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: N65c8rwdal.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: N65c8rwdal.exe

Static file information: File size 18659064 > 1048576

Source: N65c8rwdal.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x654e00
Source: N65c8rwdal.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xabe600

Source: N65c8rwdal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0006B8000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2091088218.000001CA7F5E0000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2090871306.000001CA7F620000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0005DE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0006B8000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2091088218.000001CA7F5E0000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000003.2090871306.000001CA7F620000.00000004.00001000.00020000.00000000.sdmp, N65c8rwdal.exe, 00000000.00000002.2108721596.000000C0005DE000.00000004.00001000.00020000.00000000.sdmp

Source: N65c8rwdal.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC53C7 push edx; ret	4_2_02DC53C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D973B0 push esi; ret	4_2_02D973B2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02D97378 push 0000001Ch; mov dword ptr [esp], esi	4_2_02D9737A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC56B0 push esp; retf	4_2_02DC56D8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4_2_02DC6F7B push ds; iretd	4_2_02DC6FA1

Source: C:\Users\user\Desktop\N65c8rwdal.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 2120

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: BitLockerToGo.exe, 00000004.00000002.2135824425.00000000032B8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: N65c8rwdal.exe, 00000000.00000002.2109166550.000001CA7E068000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@@

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 4_2_02DBE4E0 LdrInitializeThunk,

4_2_02DBE4E0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\N65c8rwdal.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2D80000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\N65c8rwdal.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2D80000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tryyudjasudqo.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eemmbryequo.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reggwardssdqw.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: relaxatinownio.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tesecuuweqo.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tendencctywop.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licenseodqwmqn.shop
Source: N65c8rwdal.exe, 00000000.00000002.2108721596.000000C000554000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keennylrwmqlw.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\N65c8rwdal.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2D80000			Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2F29008			Jump to behavior

Source: C:\Users\user\Desktop\N65c8rwdal.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Users\user\Desktop\N65c8rwdal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\N65c8rwdal.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Go Injector

Source: Yara match	File source: N65c8rwdal.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1685275237.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111216784.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N65c8rwdal.exe PID: 1848, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Go Injector

Source: Yara match	File source: N65c8rwdal.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1685275237.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111216784.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N65c8rwdal.exe PID: 1848, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
N65c8rwdal.exe	24%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://www.certum.pl/CPS0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
gravvitywio.store	172.67.209.193	true	true	unknown
tryyudjasudqo.shop	unknown	unknown	true	unknown
keennylrwmqlw.shop	unknown	unknown	true	unknown
reggwardssdqw.shop	unknown	unknown	true	unknown
tesecuuweqo.shop	unknown	unknown	true	unknown
tendencctywop.shop	unknown	unknown	true	unknown
eemmbryequo.shop	unknown	unknown	true	unknown
licenseodqwmqn.shop	unknown	unknown	true	unknown
relaxatinownio.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
relaxatinownio.shop	true		unknown
keennylrwmqlw.shop	true		unknown
tendencctywop.shop	true		unknown
tryyudjasudqo.shop	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
tesecuuweqo.shop	true		unknown
eemmbryequo.shop	true		unknown
reggwardssdqw.shop	true		unknown
licenseodqwmqn.shop	true		unknown
https://gravvitywio.store/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://golang.org/doc/faq#nil_errorx509:	N65c8rwdal.exe	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tendencctywop.shop/	BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032F1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/golang/protobuf/issues/1609):	N65c8rwdal.exe	false		unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/	BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.certum.pl/CPS0	N65c8rwdal.exe	false	URL Reputation: safe	unknown
https://steam.tv/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cevcsca2021.ocsp-certum.com07	N65c8rwdal.exe	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/)	BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	N65c8rwdal.exe	false		unknown
https://sketchfab.com	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gravvitywio.store/7	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003346000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store:443/apifiles/76561199724331900	BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032FA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://management.azure.cominvalid	N65c8rwdal.exe	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2134186080.0000000003381000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/3y	BitLockerToGo.exe, 00000004.00000002.2135995706.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/cevcsca2021.cer0	N65c8rwdal.exe	false		unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/G	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003346000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2135995706.000000000332E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.000000000332E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://subca.ocsp-certum.com02	N65c8rwdal.exe	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.certum.pl/ctnca2.crl0l	N65c8rwdal.exe	false		unknown
http://repository.certum.pl/ctnca2.cer09	N65c8rwdal.exe	false		unknown
https://steamcommunity.com/workshop/	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000002.2137184864.0000000003398000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	BitLockerToGo.exe, 00000004.00000003.2122433497.0000000003364000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122409679.0000000003380000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.certum.pl/CPS0	N65c8rwdal.exe	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	BitLockerToGo.exe, 00000004.00000002.2135995706.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2133020363.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2122376903.0000000003383000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000004.00000003.2132935455.000000000338F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
172.67.209.193	gravvitywio.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524038
Start date and time:	2024-10-02 14:56:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	N65c8rwdal.exe renamed because original name is a hash value
Original Sample Name:	660b29ad23f61f5565629f60cf59f848fc54c2c6ebe29883976468232a693745.exe
Detection:	MAL
Classification:	mal93.troj.evad.winEXE@3/0@10/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target N65c8rwdal.exe, PID 1848 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: N65c8rwdal.exe

Simulations

Behavior and APIs

Time	Type	Description
08:57:52	API Interceptor	2x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.209.193	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gravvitywio.store	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.16.12
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
steamcommunity.com	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Google_Chrome.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://finalstepgetshere.com/uploads/beta111.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	62-3590.pdf	Get hash	malicious	Unknown	Browse	96.17.64.189
	DV2mrnfX2d.exe	Get hash	malicious	Rhysida	Browse	23.56.162.185
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	2.19.126.151
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	104.102.21.248
	563299efce875400a8d9b44b96597c8e-sample (1).zip	Get hash	malicious	Unknown	Browse	104.118.8.10
CLOUDFLARENETUS	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.188.210
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	l5pPoBu9i3.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://www.freemangas.com	Get hash	malicious	Unknown	Browse	172.67.74.221
	caZq8MavwF.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	http://freemangas.com	Get hash	malicious	Unknown	Browse	104.26.11.241
	72LZTFDM58.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	https://app.glorify.com/file/1193241?format=90	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 172.67.209.193
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193
	FA_41_09_2024_.PDF	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.209.193
	AMG Cargo Logistic.docx	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.209.193
	file.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.209.193

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.156563679187176
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	N65c8rwdal.exe
File size:	18'659'064 bytes
MD5:	ce773611c449cfa1f292fc805e532d2f
SHA1:	e566020de1c8557da9885dd36a6b7223c3567772
SHA256:	660b29ad23f61f5565629f60cf59f848fc54c2c6ebe29883976468232a693745
SHA512:	fda38e2d29283def4a22bbe4e0efebdb0c4c67379f948d13974ad798606a9d6c5de0d5497f37e20bc7311d8f67153e1daaae47fe5a129d7fe467c3f8672b33a0
SSDEEP:	98304:ulgeEJa0XcEXqcob9U/pdjG6tqKuCWnlfGkEAnVVvOG7C7fRStS/x:ulFSqcobwpdjG6tXKnFGdAnVV2H7Rkax
TLSH:	51173943E8A544E5C0ADD574856292667B70BC888B3037E32F60F7693F76BC0AEB9750
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.Ne....................@..............................&...........`... ............................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4064a6e0, 0x1, 0x4064a6b0, 0x1, 0x4064e150, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	09/09/2024 10:06:13 09/09/2025 10:06:12
Subject Chain	CN="Guizhou Sixuanda Technology Co., Ltd.", O="Guizhou Sixuanda Technology Co., Ltd.", L=Guiyang, S=Guizhou, C=CN, SERIALNUMBER=91520100MA6DNNXK11, OID.1.3.6.1.4.1.311.60.2.1.1=Guiyang, OID.1.3.6.1.4.1.311.60.2.1.2=Guizhou, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	62A1343435FC5131E11FA8C871BB3A1B
Thumbprint SHA-1:	A3AFF46C5F8E2A1F750C570698B864E75553E61F
Thumbprint SHA-256:	87D45B86DFCC84C5EF8338026C26F34935DBAA383A7DD583F48675AF77C957A4
Serial:	332576FE101609502C23F70055B4A3BE

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0117E7F5h]
mov dword ptr [eax], 00000001h
call 00007FE55165E4AFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0117E7D5h]
mov dword ptr [eax], 00000000h
call 00007FE55165E48Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FE551CB27ACh
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FE55165E7C9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and ch, byte ptr [eax+62h]
xor al, 6Ah
cmp byte ptr [edx+47h], dl
push ecx
jp 00007FE55165E838h
insb
jne 00007FE55165E855h
outsd
popad
jnbe 00007FE55165E835h
xor byte ptr [edi+ebp+7Ah], dh
insb
xor dword ptr [ebp+32h], eax
outsb
inc ecx
jno 00007FE55165E82Bh
imul edx, dword ptr [edx+4Ah], 68h
xor eax, 4C537268h
pop edi
jnc 00007FE55165E821h
inc ebx
cmp dword ptr [ecx+43h], esp
inc dx
cmp byte ptr [ebx+4Eh], dl
jns 00007FE55165E83Ch
jbe 00007FE55165E845h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1244000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1245000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1249000	0x1f30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1181000	0x25350	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11c8e00	0x28f8	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124b000	0x20228	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x117f620	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1245494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x654c80	0x654e00	fda550a734580211cde89d844e8d9eb1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x656000	0x6b210	0x6b400	3fa6098a07bfe4242ed0ddd18ce5f785	False	0.29819984702797203	dBase III DBT, version number 0, next free block index 10, 1st item "go-ansiterm\011v0.0.0-20210617225240-d185dfc1b5a1\011h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8="	4.758040089307396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6c2000	0xabe470	0xabe600	ad908459379c27637b9c210df794fb4c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x1181000	0x25350	0x25400	ade85fddd8c07bbbedd37cfa9f33912e	False	0.39910601929530204	data	5.9332396503326095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x11a7000	0xc60	0xe00	226f09b83b99d40ae214b0e573668d0a	False	0.25892857142857145	data	3.997443827295808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x11a8000	0x9b500	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x1244000	0x4e	0x200	c99357cce46ad9740ecb4492761aef5b	False	0.130859375	data	0.9129839636227094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x1245000	0x1458	0x1600	195479b7fba0610d83cde5032001a0e2	False	0.2979403409090909	data	4.559843882253519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x1247000	0x70	0x200	75d20221d911ae980a5577dcc55cf7fd	False	0.08203125	data	0.47139462148086453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1248000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1249000	0x1f30	0x2000	a008a8e066291785e3c7a71cc85ea2b0	False	0.3314208984375	data	4.659902276453383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x124b000	0x20228	0x20400	0fd7b5011c0e5ab1baa7c4224d2ccda9	False	0.21373849321705427	data	5.444275683309625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x12491d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x12492fc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x1249864	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x1249b4c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_GROUP_ICON	0x124a3f4	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x124a434	0x4d0	data			0.2792207792207792
RT_MANIFEST	0x124a904	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x141242730

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T14:57:53.034351+0200	2055891	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)	1	192.168.2.4	51181	1.1.1.1	53	UDP
2024-10-02T14:57:53.046046+0200	2055881	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)	1	192.168.2.4	50101	1.1.1.1	53	UDP
2024-10-02T14:57:53.058384+0200	2055883	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)	1	192.168.2.4	51307	1.1.1.1	53	UDP
2024-10-02T14:57:53.071375+0200	2055893	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)	1	192.168.2.4	64281	1.1.1.1	53	UDP
2024-10-02T14:57:53.084026+0200	2055887	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)	1	192.168.2.4	54479	1.1.1.1	53	UDP
2024-10-02T14:57:53.096189+0200	2055885	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)	1	192.168.2.4	52454	1.1.1.1	53	UDP
2024-10-02T14:57:53.109771+0200	2055879	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)	1	192.168.2.4	59155	1.1.1.1	53	UDP
2024-10-02T14:57:53.120977+0200	2055895	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)	1	192.168.2.4	57213	1.1.1.1	53	UDP
2024-10-02T14:57:55.706081+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	53478	172.67.209.193	443	TCP
2024-10-02T14:57:55.706081+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	53478	172.67.209.193	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 14:57:53.147927046 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.147983074 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:53.148098946 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.151612043 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.151639938 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:53.824489117 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:53.824564934 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.836054087 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.836090088 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:53.836399078 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:53.887732029 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.944667101 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:53.987413883 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418662071 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418699026 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418706894 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418725014 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418732882 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418750048 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.418778896 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.418801069 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.418827057 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.524034977 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.524063110 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.524162054 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.524184942 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.524190903 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.525597095 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.529370070 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.529468060 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.529468060 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.531816959 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.649462938 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.649494886 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.649507999 CEST	53475	443	192.168.2.4	104.102.49.254
Oct 2, 2024 14:57:54.649513960 CEST	443	53475	104.102.49.254	192.168.2.4
Oct 2, 2024 14:57:54.676923037 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:54.676958084 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:54.677300930 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:54.677736044 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:54.677750111 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.154345036 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.154438019 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.156183958 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.156198978 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.156518936 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.157852888 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.158425093 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.158447027 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.706115961 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.706222057 CEST	443	53478	172.67.209.193	192.168.2.4
Oct 2, 2024 14:57:55.707143068 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.707143068 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:55.707143068 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:56.012732029 CEST	53478	443	192.168.2.4	172.67.209.193
Oct 2, 2024 14:57:56.012761116 CEST	443	53478	172.67.209.193	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 14:57:52.792064905 CEST	53	57359	162.159.36.2	192.168.2.4
Oct 2, 2024 14:57:53.034351110 CEST	51181	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.043817997 CEST	53	51181	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.046046019 CEST	50101	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.054792881 CEST	53	50101	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.058383942 CEST	51307	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.067482948 CEST	53	51307	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.071374893 CEST	64281	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.080862999 CEST	53	64281	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.084026098 CEST	54479	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.093161106 CEST	53	54479	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.096189022 CEST	52454	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.107214928 CEST	53	52454	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.109771013 CEST	59155	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.118643045 CEST	53	59155	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.120976925 CEST	57213	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.131154060 CEST	53	57213	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.135340929 CEST	49155	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:53.143120050 CEST	53	49155	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:53.279901981 CEST	53	63519	1.1.1.1	192.168.2.4
Oct 2, 2024 14:57:54.666655064 CEST	53671	53	192.168.2.4	1.1.1.1
Oct 2, 2024 14:57:54.676281929 CEST	53	53671	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 14:57:53.034351110 CEST	192.168.2.4	1.1.1.1	0x730b	Standard query (0)	tendencctywop.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.046046019 CEST	192.168.2.4	1.1.1.1	0xf44c	Standard query (0)	keennylrwmqlw.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.058383942 CEST	192.168.2.4	1.1.1.1	0xe692	Standard query (0)	licenseodqwmqn.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.071374893 CEST	192.168.2.4	1.1.1.1	0x875f	Standard query (0)	tesecuuweqo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.084026098 CEST	192.168.2.4	1.1.1.1	0xcff6	Standard query (0)	relaxatinownio.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.096189022 CEST	192.168.2.4	1.1.1.1	0xb04c	Standard query (0)	reggwardssdqw.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.109771013 CEST	192.168.2.4	1.1.1.1	0xc9cc	Standard query (0)	eemmbryequo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.120976925 CEST	192.168.2.4	1.1.1.1	0x1f48	Standard query (0)	tryyudjasudqo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.135340929 CEST	192.168.2.4	1.1.1.1	0xe307	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:54.666655064 CEST	192.168.2.4	1.1.1.1	0x6cd9	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 14:57:53.043817997 CEST	1.1.1.1	192.168.2.4	0x730b	Name error (3)	tendencctywop.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.054792881 CEST	1.1.1.1	192.168.2.4	0xf44c	Name error (3)	keennylrwmqlw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.067482948 CEST	1.1.1.1	192.168.2.4	0xe692	Name error (3)	licenseodqwmqn.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.080862999 CEST	1.1.1.1	192.168.2.4	0x875f	Name error (3)	tesecuuweqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.093161106 CEST	1.1.1.1	192.168.2.4	0xcff6	Name error (3)	relaxatinownio.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.107214928 CEST	1.1.1.1	192.168.2.4	0xb04c	Name error (3)	reggwardssdqw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.118643045 CEST	1.1.1.1	192.168.2.4	0xc9cc	Name error (3)	eemmbryequo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.131154060 CEST	1.1.1.1	192.168.2.4	0x1f48	Name error (3)	tryyudjasudqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:53.143120050 CEST	1.1.1.1	192.168.2.4	0xe307	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:54.676281929 CEST	1.1.1.1	192.168.2.4	0x6cd9	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 14:57:54.676281929 CEST	1.1.1.1	192.168.2.4	0x6cd9	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

gravvitywio.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	53475	104.102.49.254	443	2472	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 12:57:53 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 12:57:54 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 12:57:54 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=ddc48adf4c26a1daef2f018f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 12:57:54 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 12:57:54 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 12:57:54 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 12:57:54 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	53478	172.67.209.193	443	2472	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 12:57:55 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 12:57:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 12:57:55 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 12:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9cncbpgj2qomhcbc2mbpi698se; expires=Sun, 26 Jan 2025 06:44:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g125rCvDp5YRfqx%2FbATKd2xX25VbrzizXTZMuoOFL94ATzPBPuVyBv2tjBrjgLXTAivK1GSDnOHMqeRMNvUt087fZNQX6dMcyxxeGdwmgdAtrN2gATw8%2FJlyoBHIoenCoGZCXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc4dc68285f436d-EWR
2024-10-02 12:57:55 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 12:57:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:57:09
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\N65c8rwdal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\N65c8rwdal.exe"
Imagebase:	0x7ff72f4b0000
File size:	18'659'064 bytes
MD5 hash:	CE773611C449CFA1F292FC805E532D2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.2108992608.000000C00080E000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000000.1685275237.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000002.2111216784.00007FF730241000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:57:52
Start date:	02/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0x860000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40%
Total number of Nodes:	45
Total number of Limit Nodes:	6

Executed Functions

Function 02D900A0 Relevance: 12.9, Strings: 10, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|/s-, xrefs: 02D9013D
c;j9, xrefs: 02D9010F
-{(y, xrefs: 02D901B6
-g.e, xrefs: 02D901D7
vA, xrefs: 02D900B7
+w#u, xrefs: 02D901AB
W{, xrefs: 02D90316
j?n=, xrefs: 02D90117
$&!, xrefs: 02D903F6
a#B!, xrefs: 02D9011F

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +w#u$-g.e$-{(y$W{$a#B!$c;j9$j?n=$vA$|/s-$$&!
API String ID: 0-3312696060
Opcode ID: 5104a3ae996edee0b4129e7a1376ba17967b2f4f85549dda70ad093e6264be45
Instruction ID: 2ef05361e83f4bfb17d176e29463a12dd22bb818a9df9ea8766a1783fdd87d74
Opcode Fuzzy Hash: 5104a3ae996edee0b4129e7a1376ba17967b2f4f85549dda70ad093e6264be45
Instruction Fuzzy Hash: 40E13EB460C3828BE328DF14D590B6FBBF2ABD5700F248A1CE6C90B344D7719805CB96

Function 02D8D1F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 193
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 02D8D201
GetCurrentThreadId.KERNEL32 ref: 02D8D216
GetCurrentProcessId.KERNEL32 ref: 02D8D21C
ExitProcess.KERNEL32 ref: 02D8D470

Strings

IHON, xrefs: 02D8D416
MLCB, xrefs: 02D8D3F7

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: IHON$MLCB
API String ID: 1029096631-2389202908
Opcode ID: f92aa6fce77104fc3c6ff43867925d966c8b0ab2ffc36324dbf98de3bdb0f4d7
Instruction ID: 9f1dd646da10798c72c3e0f2a5f850059c3266a9a5bbc8d8c226b8639729b5a4
Opcode Fuzzy Hash: f92aa6fce77104fc3c6ff43867925d966c8b0ab2ffc36324dbf98de3bdb0f4d7
Instruction Fuzzy Hash: 756145B561C2419BD305EF28D490A1EBBE2EFA9704F28892CE0C9C7391D73ADC51CB56

Function 02D8F960 Relevance: 7.0, Strings: 5, Instructions: 732
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;, xrefs: 02D8FACE
5{1y, xrefs: 02D8FEAD
$&!, xrefs: 02D903F6
:2, xrefs: 02D8FAC4
$#, xrefs: 02D8FAB0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $#$5{1y$:2$;$$&!
API String ID: 0-3781735934
Opcode ID: e531a4019da60bda14134a87ad835054d78a82053b2c8cdd019ae1d77464e973
Instruction ID: 0d27b0f773523d35ffe70b3047a1d56341cdcdb0e885cfd6875c631e5383858c
Opcode Fuzzy Hash: e531a4019da60bda14134a87ad835054d78a82053b2c8cdd019ae1d77464e973
Instruction Fuzzy Hash: 6E5255B5604B028FD324CF25C490B5BBBF2FB85714F248A1CE5AA8BB94D774A815CF81

Function 02DBE4E0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(02D92619,?,00000001,?), ref: 02DBE50E

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 02D907BA Relevance: .3, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0aa4c74aa8be4971246c9c64a766133e8a50a933820dc33610fe3f77428bfc
Instruction ID: d2f8dddef48f23c8acfea0fd58943cd7ef071337d3a35938888ef91c3fb05695
Opcode Fuzzy Hash: 8d0aa4c74aa8be4971246c9c64a766133e8a50a933820dc33610fe3f77428bfc
Instruction Fuzzy Hash: 749176B1948302EFE7108FA4E89072AB7E8FB89715F245D6CEA8986340D735DC61CF52

Function 02DBF0CD Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9f71a1a13b83017f6f10da384488197e30091f2d9dab209f66f5abd2a422e0
Instruction ID: ab672d9e27a8fc2e3d916c848ed86aae7ff212ea1ee4054ee406299f32a4d7aa
Opcode Fuzzy Hash: 9b9f71a1a13b83017f6f10da384488197e30091f2d9dab209f66f5abd2a422e0
Instruction Fuzzy Hash: 0C2177746482428FD71ADF18C8A0A6AB7E6EF95348F148E1CE1C28B381E735E815CB52

Function 02DBBAB0 Relevance: 1.6, APIs: 1, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 02DBBBC2

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 48c207c7a1e12b625f66bb5f429d6e07d2d5d237e71681357a6c81b2e2cc5d50
Instruction ID: eeca0c5921c269cad0a2775d5c2c8394c8e9c4c7626530fe3998ec881785a5ef
Opcode Fuzzy Hash: 48c207c7a1e12b625f66bb5f429d6e07d2d5d237e71681357a6c81b2e2cc5d50
Instruction Fuzzy Hash: 65318F7560C281CBC709DF18D4A096EF7A2EFD5709F258A2DD6C6473A5CB319C22CB46

Function 02DBE3F0 Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 02DBE490

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 463cf23422cec6e5a74d4e5306245a2cbeef62552eb89aeec40c6c7bb59f5a49
Instruction ID: b0904c4aeb2848b3ac498d91a73c61d51ebb19eed83516113f1d71d6b9c7c577
Opcode Fuzzy Hash: 463cf23422cec6e5a74d4e5306245a2cbeef62552eb89aeec40c6c7bb59f5a49
Instruction Fuzzy Hash: 8F21F371A0D201CBD309AB24D9B196BBBE1EF8A308F55896ED5C753340D631DC21CB93

Function 02DBBA92 Relevance: 1.5, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 02DBBA98

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 65075ef127520776f8ab7944d9ebd55e432129c4a018de4704164eabbd807e97
Instruction ID: f2afdb637fe3754c0028ac4864800909b3cb301408771ea813ef5dd1edaec055
Opcode Fuzzy Hash: 65075ef127520776f8ab7944d9ebd55e432129c4a018de4704164eabbd807e97
Instruction Fuzzy Hash: 31B012704400005BEA002B08BC05B603715EB00205FA00480F404881D2C1524CB39588

Non-executed Functions

Function 02D9B35A Relevance: 39.1, Strings: 30, Instructions: 1552COMMON

Download Yara Rule

Strings

pwvu, xrefs: 02D9C153
(, xrefs: 02D9C556
DKJI, xrefs: 02D9C18A
d9K7, xrefs: 02D9AF59, 02D9AEF8, 02D9AFAE
LMNg, xrefs: 02D9C34E
MNOP, xrefs: 02D9BAC8
O7JI, xrefs: 02D9B8EC
G3F5, xrefs: 02D9B8E1
0765, xrefs: 02D9C0A3
h {, xrefs: 02D9C39B
("C, xrefs: 02D9C390
TX, xrefs: 02D9AE02
4;:9, xrefs: 02D9C0AE
<=>?, xrefs: 02D9C322
Y^YX, xrefs: 02D9ADF7
&GyY, xrefs: 02D9B918
N5S3, xrefs: 02D9AEB6
3K>M, xrefs: 02D9B8F7
LSRQ, xrefs: 02D9C1A0
,321, xrefs: 02D9C098
z, xrefs: 02D9C2E0
(/.-, xrefs: 02D9C08D
pqrs, xrefs: 02D9C3B1
'&%, xrefs: 02D9C077
dkji, xrefs: 02D9C132
tuv?, xrefs: 02D9C3BC
_YPh, xrefs: 02D9ADEC
honm, xrefs: 02D9C13D
8?>=, xrefs: 02D9C0B9
`abc, xrefs: 02D9C385

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: '&%$&GyY$($(/.-$("C$,321$0765$3K>M$4;:9$8?>=$<=>?$DKJI$G3F5$LMNg$LSRQ$MNOP$N5S3$O7JI$TX$Y^YX$_YPh$`abc$d9K7$dkji$h {$honm$pqrs$pwvu$tuv?$z
API String ID: 2994545307-1963214830
Opcode ID: 8d33842faf55ef8f867df75a8954ac2d86efaa94fda5230ec0a1931720f8f4f6
Instruction ID: d702b0a279bb758dc055c6fd05b8ea89a816029bb49b2db111a14f8f9a111af2
Opcode Fuzzy Hash: 8d33842faf55ef8f867df75a8954ac2d86efaa94fda5230ec0a1931720f8f4f6
Instruction Fuzzy Hash: 81D288B55083828BDB34DF18D880BABBBE2EFC5348F15492DE5998B351DB369841CB52

Function 02DAC500 Relevance: 27.7, APIs: 2, Strings: 12, Instructions: 3237COMMON

Download Yara Rule

Strings

wq, xrefs: 02DAEB2E
;/*, xrefs: 02DAE874
$8r,, xrefs: 02DAE96D
]jbg, xrefs: 02DAEDAC
eeOt, xrefs: 02DAEDC1
Z(:, xrefs: 02DAC51E
MNOP, xrefs: 02DAE592
iJIQ, xrefs: 02DACD78
K^\N, xrefs: 02DADFA1
Qbio, xrefs: 02DAEDBA
(>to, xrefs: 02DAE87E
nLv(, xrefs: 02DAE963

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ;/*$$8r,$(>to$K^\N$MNOP$Qbio$Z(:$]jbg$eeOt$iJIQ$nLv($wq
API String ID: 0-1296844701
Opcode ID: 0c582d0713ee97689aa13eb2b58245670045cdca37cf892d77b75686746070b3
Instruction ID: b0167d1b9ef9adb7ba74bcf05786fff43e0f670b15b4cf2948e538534d1991f5
Opcode Fuzzy Hash: 0c582d0713ee97689aa13eb2b58245670045cdca37cf892d77b75686746070b3
Instruction Fuzzy Hash: 9C437B74505B418BE325CF39C4A0BA7BBE2BF5A305F18896DD4EB87786C735A805CB50

Function 02DB2C80 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 96clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02DB2C90
GetWindowLongW.USER32 ref: 02DB2CB5
GetClipboardData.USER32 ref: 02DB2CC5
GlobalLock.KERNEL32 ref: 02DB2CE4
GlobalUnlock.KERNEL32 ref: 02DB2DC6
CloseClipboard.USER32 ref: 02DB2DCF

Strings

[, xrefs: 02DB2D2F
\, xrefs: 02DB2D48
^, xrefs: 02DB2D3E
I, xrefs: 02DB2D2A
V, xrefs: 02DB2D25
H, xrefs: 02DB2D34
Y, xrefs: 02DB2D43

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: H$I$V$Y$[$\$^
API String ID: 2832541153-913593125
Opcode ID: f44ecaa0e023e3ffcb2b5264af4bcfcf56aafa564afa170f2203137a4c92e136
Instruction ID: f968b2454469f5df2546eb744a098bf44d7ef28e504c11a122723c1368666ed4
Opcode Fuzzy Hash: f44ecaa0e023e3ffcb2b5264af4bcfcf56aafa564afa170f2203137a4c92e136
Instruction Fuzzy Hash: 4341497150C3828ED301EF78945835FBFE0AB91314F444D6DE8E986382D7B99958CBA3

Function 02D91BDF Relevance: 21.7, APIs: 1, Strings: 13, Instructions: 663COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 02D91BEB

Strings

D, xrefs: 02D92526
ITFT, xrefs: 02D91D2E
PqEw, xrefs: 02D92380
X, xrefs: 02D91D70
KPC<, xrefs: 02D91D39
t}rc, xrefs: 02D91D5A
4`[b, xrefs: 02D925F2
LmEs, xrefs: 02D92378
+2-k, xrefs: 02D91D44
_ZJ~, xrefs: 02D91DA8
f, xrefs: 02D91C00
!, xrefs: 02D92064
vQeW, xrefs: 02D92340

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: Uninitialize
String ID: !$+2-k$4`[b$D$ITFT$KPC<$LmEs$PqEw$X$_ZJ~$f$t}rc$vQeW
API String ID: 3861434553-3946415263
Opcode ID: 8178a2422542f34d01a227d19a0c10721ef80cfcdb76a94007ec4193e29813da
Instruction ID: 64b75ab5a0f388c6e0cc66133734c68bd5b0e76b2b521456f8120cf4e0bf53c3
Opcode Fuzzy Hash: 8178a2422542f34d01a227d19a0c10721ef80cfcdb76a94007ec4193e29813da
Instruction Fuzzy Hash: A14279B01093819BD728DF15D4A4B6BBBE2EFCA708F144A5CE4CA1B391C7749905CF96

Function 02DA7FB0 Relevance: 20.8, Strings: 16, Instructions: 755COMMON

Download Yara Rule

Strings

9240, xrefs: 02DA7E88
{-o/, xrefs: 02DA80EC
Y9V;, xrefs: 02DA810A
LM, xrefs: 02DA8130
4`[b, xrefs: 02DA8360
h5`7, xrefs: 02DA8100
J=[?, xrefs: 02DA8114
e!~#, xrefs: 02DA80CE
b1w3, xrefs: 02DA80F6
)I'K, xrefs: 02DA8129
MNOP, xrefs: 02DA8282
w%i', xrefs: 02DA80D8
n)~+, xrefs: 02DA80E2
0E#G, xrefs: 02DA8122
5*#7, xrefs: 02DA7E80
/"7!, xrefs: 02DA7EA0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )I'K$/"7!$0E#G$4`[b$5*#7$9240$J=[?$LM$MNOP$Y9V;$b1w3$e!~#$h5`7$n)~+$w%i'${-o/
API String ID: 0-3209693757
Opcode ID: d74d45964df8e0bb36f13b2c3aabd4f928a1fbb18d8982d0399275ed06c69060
Instruction ID: 55b672d314c2495dc9e22c73550b2d78fdfd35e72e42d80b5d78a9308ba4b798
Opcode Fuzzy Hash: d74d45964df8e0bb36f13b2c3aabd4f928a1fbb18d8982d0399275ed06c69060
Instruction Fuzzy Hash: 9742E0B1904386CFDB14DF68D8A0AAEBBB2FB85304F144869E485A7381D734DD55CFA2

Function 02DA7750 Relevance: 20.7, Strings: 16, Instructions: 719COMMON

Download Yara Rule

Strings

9240, xrefs: 02DA7E88
{-o/, xrefs: 02DA80EC
Y9V;, xrefs: 02DA810A
LM, xrefs: 02DA8130
4`[b, xrefs: 02DA8360
h5`7, xrefs: 02DA8100
J=[?, xrefs: 02DA8114
e!~#, xrefs: 02DA80CE
b1w3, xrefs: 02DA80F6
)I'K, xrefs: 02DA8129
MNOP, xrefs: 02DA8282
w%i', xrefs: 02DA80D8
n)~+, xrefs: 02DA80E2
0E#G, xrefs: 02DA8122
5*#7, xrefs: 02DA7E80
/"7!, xrefs: 02DA7EA0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )I'K$/"7!$0E#G$4`[b$5*#7$9240$J=[?$LM$MNOP$Y9V;$b1w3$e!~#$h5`7$n)~+$w%i'${-o/
API String ID: 0-3209693757
Opcode ID: 419d607dd5ac9c24ae7733db83991db32408bb708419a4ddee4b72171d7ae5f3
Instruction ID: 9d746e91e75e74e206b314683d09fa577f16fa35a60d072ce7c5e9049b914512
Opcode Fuzzy Hash: 419d607dd5ac9c24ae7733db83991db32408bb708419a4ddee4b72171d7ae5f3
Instruction Fuzzy Hash: 4642D0B1904286CFDB14DF68D4A0AAEBBB2FB85304F14486DE485A7381D734DD55CFA2

Function 02DA7A67 Relevance: 20.7, Strings: 16, Instructions: 681COMMON

Download Yara Rule

Strings

9240, xrefs: 02DA7E88
{-o/, xrefs: 02DA80EC
Y9V;, xrefs: 02DA810A
LM, xrefs: 02DA8130
4`[b, xrefs: 02DA8360
h5`7, xrefs: 02DA8100
J=[?, xrefs: 02DA8114
e!~#, xrefs: 02DA80CE
b1w3, xrefs: 02DA80F6
)I'K, xrefs: 02DA8129
MNOP, xrefs: 02DA8282
w%i', xrefs: 02DA80D8
n)~+, xrefs: 02DA80E2
0E#G, xrefs: 02DA8122
5*#7, xrefs: 02DA7E80
/"7!, xrefs: 02DA7EA0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )I'K$/"7!$0E#G$4`[b$5*#7$9240$J=[?$LM$MNOP$Y9V;$b1w3$e!~#$h5`7$n)~+$w%i'${-o/
API String ID: 0-3209693757
Opcode ID: 5ee237629085373bcc1ef8920a000410bae7cbb848f8101ced3dd0e33fde3608
Instruction ID: e3ce7cc103a0c6faee6b087adcaae24fa6f552905bfe056ec3e72a6098d2e9a8
Opcode Fuzzy Hash: 5ee237629085373bcc1ef8920a000410bae7cbb848f8101ced3dd0e33fde3608
Instruction Fuzzy Hash: F532AEB1908296CFEB14CF68D4A0AAEB7B2EF85304F14886DE4859B381D734DD55CF62

Function 02D9FCFB Relevance: 20.4, Strings: 16, Instructions: 374COMMON

Download Yara Rule

Strings

], xrefs: 02D9FE4A
E, xrefs: 02D9FE0A
A, xrefs: 02D9FE42
[, xrefs: 02D9FE32
w, xrefs: 02D9FDEA
E, xrefs: 02D9FE22
Y, xrefs: 02D9FE6A
V, xrefs: 02D9FE1A
u, xrefs: 02D9FDFA
Q, xrefs: 02D9FE5A
D, xrefs: 02D9FE2A
H, xrefs: 02D9FE62
r, xrefs: 02D9FDF2
\, xrefs: 02D9FE52
U, xrefs: 02D9FE12
D, xrefs: 02D9FE02

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: A$D$D$E$E$H$Q$U$V$Y$[$\$]$r$u$w
API String ID: 0-375660955
Opcode ID: 6ed15edbfc312857bec0d078c20d980f751ff1e5d3ad9c638d3fcb6788986167
Instruction ID: c327138925bff408602bac48293a2bf633766414398bd93abb6ac96c8f8e02ba
Opcode Fuzzy Hash: 6ed15edbfc312857bec0d078c20d980f751ff1e5d3ad9c638d3fcb6788986167
Instruction Fuzzy Hash: 8312E761508BC28ED3268F3C8888746FF916B27224F088BD9E4E94F7D7C265D595C7A2

Function 02DA4B80 Relevance: 15.7, Strings: 12, Instructions: 699COMMON

Download Yara Rule

Strings

=?, xrefs: 02DA59B2
Y[, xrefs: 02DA4E4C
@A, xrefs: 02DA553E
=?, xrefs: 02DA58D6
'0, xrefs: 02DA52A3
>3, xrefs: 02DA52AE
X\, xrefs: 02DA4C1E
"0, xrefs: 02DA5298
UW, xrefs: 02DA4E2B
}z, xrefs: 02DA5441
11, xrefs: 02DA59A7
4:, xrefs: 02DA599C

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "0$'0$11$4:$=?$>3$@A$X\$}z$=?$UW$Y[
API String ID: 0-260730608
Opcode ID: e802b75904a56f58657d5b2ca3ec2d0d648873bb97e81d1c19bc840eca83716d
Instruction ID: cc9f4d0f0d7d2952b93bf68d6c3b7c4f387651783dad8f0e9c00501bd1a5b7ae
Opcode Fuzzy Hash: e802b75904a56f58657d5b2ca3ec2d0d648873bb97e81d1c19bc840eca83716d
Instruction Fuzzy Hash: C472FAB464C385CAE374CF15D894B9EBBE1FB85304F608A2DE5E99B241CB748485CF92

Function 02D91353 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 572COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 02D91814

Strings

us, xrefs: 02D915C1
btw~, xrefs: 02D913FB
ojz., xrefs: 02D9147E
`a, xrefs: 02D91710
bpwv, xrefs: 02D91406
yw, xrefs: 02D915B6
ojz., xrefs: 02D916A8

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: DirectorySystem
String ID: `a$bpwv$btw~$ojz.$ojz.$us$yw
API String ID: 2188284642-4243563423
Opcode ID: 3212587a1717708c62cf3422e0616dae908aeca955d3bcaa1f86a074bd59e7ac
Instruction ID: 35f73c5371e9e4ba62e9dc0bec6b35832078c72eb27ad57933ea66188cd9b025
Opcode Fuzzy Hash: 3212587a1717708c62cf3422e0616dae908aeca955d3bcaa1f86a074bd59e7ac
Instruction Fuzzy Hash: BF12A9B550A3819BE730CF25D984B9BBBE2EF8A308F180A6CE4CD57341D7358905CB92

Function 02DA4D50 Relevance: 14.4, Strings: 11, Instructions: 648COMMON

Download Yara Rule

Strings

=?, xrefs: 02DA59B2
Y[, xrefs: 02DA4E4C
@A, xrefs: 02DA553E
=?, xrefs: 02DA58D6
'0, xrefs: 02DA52A3
>3, xrefs: 02DA52AE
"0, xrefs: 02DA5298
UW, xrefs: 02DA4E2B
}z, xrefs: 02DA5441
11, xrefs: 02DA59A7
4:, xrefs: 02DA599C

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "0$'0$11$4:$=?$>3$@A$}z$=?$UW$Y[
API String ID: 0-2885154292
Opcode ID: d032ab893732c58456bdf5ce0d93c1712c8823ce0e49cbb4b1dee75473efb0b5
Instruction ID: e757a4460caacd7bcb465ab1cac7468e4bb0257070c181917b6fa8ec5bcda1cc
Opcode Fuzzy Hash: d032ab893732c58456bdf5ce0d93c1712c8823ce0e49cbb4b1dee75473efb0b5
Instruction Fuzzy Hash: 0572FAB464C381CAE374CF25D894B9EBBE1FB85344F608A2DD5D99B245CB708485CF92

Function 02DB80A7 Relevance: 12.4, APIs: 8, Instructions: 446memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 02DB8101
SysAllocString.OLEAUT32(?), ref: 02DB81B9
VariantInit.OLEAUT32(?), ref: 02DB8222
SysStringLen.OLEAUT32(6BFE6909), ref: 02DB82E6

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: String$Alloc$InitVariant
String ID:
API String ID: 3520221836-0
Opcode ID: 90d807b8518cc721a9ac57011f0acecadb95a60c45b9a76e116d4529ba101bf6
Instruction ID: 5cbc58292693f08481e0bea26e090016add3a3e9acabf4e2bba6250d015973b9
Opcode Fuzzy Hash: 90d807b8518cc721a9ac57011f0acecadb95a60c45b9a76e116d4529ba101bf6
Instruction Fuzzy Hash: 7CF1AA75604A02CFD725CF28D891B66BBF6FF89301F28896CD5868B791D735E851CB80

Function 02D9A623 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 381comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(02DC4AF0,00000000,00000004,02DC4AE0,00000000), ref: 02D9A8AA
CoSetProxyBlanket.OLE32(?,000000FF,000000FF,000000FF,00000006,00000003,00000000,00000040), ref: 02D9A8D5
SysFreeString.OLEAUT32(?), ref: 02D9AB22

Strings

?]1, xrefs: 02D9AA48
<KJM, xrefs: 02D9AA10
<, xrefs: 02D9A687

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: BlanketCreateFreeInstanceProxyString
String ID: ?]1$<$<KJM
API String ID: 2425965127-1263746203
Opcode ID: 26d4abaa7a485d6cffff63a09b1518d114d548ad9ce699ceabd7ca1965dde6e8
Instruction ID: edb0a9a6f3cb3882baf9c2d15732b3852fd30656fdecf918da2e4cb67ae8a78d
Opcode Fuzzy Hash: 26d4abaa7a485d6cffff63a09b1518d114d548ad9ce699ceabd7ca1965dde6e8
Instruction Fuzzy Hash: D7D1D1B25083428FCB24CF18C491BABB7F1EF85314F15496DE59A8B391D735AC45CB92

Function 02D81000 Relevance: 10.6, Strings: 7, Instructions: 1821COMMON

Download Yara Rule

Strings

gfff, xrefs: 02D82003
gfff, xrefs: 02D81FBC
gfff, xrefs: 02D81F51
0123456789abcdefxp, xrefs: 02D815A3, 02D81616
-, xrefs: 02D81EF9
0123456789ABCDEFXP, xrefs: 02D81595, 02D81609
@, xrefs: 02D82F95

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: aa8b68ac70380eab4856fb6f9e8c59af3684f7b6419931ae1004681250c749d2
Instruction ID: fd4c580ffaf9a99224210d2600328700f66158b8ebb42eba1fb6ae91de3fc8e9
Opcode Fuzzy Hash: aa8b68ac70380eab4856fb6f9e8c59af3684f7b6419931ae1004681250c749d2
Instruction Fuzzy Hash: 90D21571A083918FC714DF28C48476ABBE2AFC9714F188A6DE8D997391D334DD49CB92

Function 02D90A10 Relevance: 8.0, Strings: 6, Instructions: 489COMMON

Download Yara Rule

Strings

Du@w, xrefs: 02D90BF4
\_, xrefs: 02D90E20
Xi\k, xrefs: 02D90BE9
UmXo, xrefs: 02D90BDE
QaSc, xrefs: 02D90BD3
@qRs, xrefs: 02D90BFF

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @qRs$Du@w$QaSc$UmXo$Xi\k$\_
API String ID: 0-2210773361
Opcode ID: b071c1bf7ee0c95ea2b5ed7bd7505b50645d4d8f8c0f35fb4549836b05f5c8c9
Instruction ID: 727477f4c5ef6dc71ca350e0f4a131d1b12211ccff1e71b89b6e2ed3c0904973
Opcode Fuzzy Hash: b071c1bf7ee0c95ea2b5ed7bd7505b50645d4d8f8c0f35fb4549836b05f5c8c9
Instruction Fuzzy Hash: DA0243B42183829BE328DF15D890B6BBBF5FB85700F248A1DE6C98B350C7359815CB56

Function 02D812E7 Relevance: 7.1, Strings: 5, Instructions: 896COMMON

Download Yara Rule

Strings

i, xrefs: 02D82A4D
0, xrefs: 02D824F5
0, xrefs: 02D822B3
@, xrefs: 02D82975
0, xrefs: 02D821F1

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: efa0ccf2e2ce0bc922fde5cac790f3a8762356710bc423ff1bf7e4f52436b61f
Instruction ID: 31e420140c41970e284a9b0f29cc7049664d09df22f895f1e7c47d0a8d325224
Opcode Fuzzy Hash: efa0ccf2e2ce0bc922fde5cac790f3a8762356710bc423ff1bf7e4f52436b61f
Instruction Fuzzy Hash: CF72C071A0C3818FD318EE28C49872ABBE1ABC9704F14896DECD997395D774DD49CB82

Function 02D9ADCF Relevance: 6.6, Strings: 5, Instructions: 349COMMON

Download Yara Rule

Strings

N5S3, xrefs: 02D9AEB6
TX, xrefs: 02D9AE02
d9K7, xrefs: 02D9AF59, 02D9AEF8, 02D9AFAE
_YPh, xrefs: 02D9ADEC
Y^YX, xrefs: 02D9ADF7

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: N5S3$TX$Y^YX$_YPh$d9K7
API String ID: 0-3179847056
Opcode ID: e9c5e9d41bde64b0369641ebe085098ee92518a4489060c504f5f4909b3969f6
Instruction ID: b0053423b370b8b980577789f94f60bcb329bd00a9d9479a3776512f39e25e35
Opcode Fuzzy Hash: e9c5e9d41bde64b0369641ebe085098ee92518a4489060c504f5f4909b3969f6
Instruction Fuzzy Hash: 04C1ADB6A08342CBCB25DF18D480AABB7E6EFC5354F15482DE8998B351EB319C51CB52

Function 02D9D9BE Relevance: 6.3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

UWVZ, xrefs: 02D9D9CE
]sea, xrefs: 02D9D9D5
upuj, xrefs: 02D9DA06
m`mx, xrefs: 02D9DA70
m`mx, xrefs: 02D9D9E3

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: UWVZ$]sea$m`mx$m`mx$upuj
API String ID: 0-834475718
Opcode ID: 689d1403a906b841e6f5dbc1efc5fd2848d8277079f0601a85e6403b5e8e85aa
Instruction ID: f817f507f38d427d4b815657e4d4dff0b2edaa90d7d03e563e517606b1ccd6f4
Opcode Fuzzy Hash: 689d1403a906b841e6f5dbc1efc5fd2848d8277079f0601a85e6403b5e8e85aa
Instruction Fuzzy Hash: A8317AB09082A5CBDF09CF51D1D176ABFB1AF16210F68598DCC951F38BC3358855CBA8

Function 02D9DAD1 Relevance: 5.6, Strings: 4, Instructions: 637COMMON

Download Yara Rule

Strings

C"M, xrefs: 02D9E0B9
O9H;, xrefs: 02D9DE93
=EFG, xrefs: 02D9DE9A
{z}, xrefs: 02D9E1DC

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: =EFG$O9H;$C"M${z}
API String ID: 0-2409340280
Opcode ID: ba091ad04a8e8a7a6a2ea8f05441250dedd174b4d1fa5a9da5fe5168a6796dac
Instruction ID: e43255b06ba690a5bb98d6c0f8d2df00bed6f003629b683128a75fce242807c9
Opcode Fuzzy Hash: ba091ad04a8e8a7a6a2ea8f05441250dedd174b4d1fa5a9da5fe5168a6796dac
Instruction Fuzzy Hash: AA32E2B5900716CFCF14CFA4C880AAEBBB2FF45314F148A5CE466AB795D734A915CB90

Function 02D9332C Relevance: 5.6, Strings: 4, Instructions: 632COMMON

Download Yara Rule

Strings

j, xrefs: 02D93744
L|EL, xrefs: 02D93940
fc{i, xrefs: 02D93928
hXi`, xrefs: 02D93908

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: L|EL$fc{i$hXi`$j
API String ID: 0-1710704399
Opcode ID: 42e8da41f94567cdedb857f38f66fab6f9500f6d02349010b805585e2704c613
Instruction ID: 2dbe2eed2200b69069968a6d376d13b985b666cd28d9540ec65b239ad51dcf30
Opcode Fuzzy Hash: 42e8da41f94567cdedb857f38f66fab6f9500f6d02349010b805585e2704c613
Instruction Fuzzy Hash: FA22ACB15083818FDB15DF24D89076ABBE6EF86304F1849ACE4CA87392D736DD15CB62

Function 02DA28F0 Relevance: 5.5, Strings: 4, Instructions: 491COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02DA2DE0
01, xrefs: 02DA2912
LMBC, xrefs: 02DA2B99
l9e7, xrefs: 02DA2936

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 01$4`[b$LMBC$l9e7
API String ID: 0-216049701
Opcode ID: bcf46afd355db0f81d32af0fc00ae0f1f52d8a7aadf96fce23dd7c40fc950ff7
Instruction ID: 1cc26a63775a87266a935be9bfbbcbc95340e83987bada22148293b6077f427a
Opcode Fuzzy Hash: bcf46afd355db0f81d32af0fc00ae0f1f52d8a7aadf96fce23dd7c40fc950ff7
Instruction Fuzzy Hash: 4BD1D2756082019BD714EF29C8A1A2BB7E2EF95754F09891CE8C587392E335ED11CBA3

Function 02DA6A50 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

MNOP, xrefs: 02DA7016
4`[b, xrefs: 02DA6F80
4`[b, xrefs: 02DA7070
MNOP, xrefs: 02DA6F28

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b$MNOP$MNOP
API String ID: 0-2339417041
Opcode ID: 667201e4be3ba214f5b3acf5bb2295033909d91d70aff4feaf284efb28743793
Instruction ID: 446f5151f35373a617062764ad535dce713ca8178787f6b43fcd25b3a7535434
Opcode Fuzzy Hash: 667201e4be3ba214f5b3acf5bb2295033909d91d70aff4feaf284efb28743793
Instruction Fuzzy Hash: 33F188B1618342DFEB24DF54D8A0B6AB7E6FB88304F54892DE5C687390DB34D815CB92

Function 02DA3E59 Relevance: 5.5, Strings: 4, Instructions: 453COMMON

Download Yara Rule

Strings

3ABC, xrefs: 02DA42C0
]=]?, xrefs: 02DA42AB
+E+G, xrefs: 02DA42B9
S9[;, xrefs: 02DA42B2

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +E+G$3ABC$S9[;$]=]?
API String ID: 0-640140210
Opcode ID: a12d157366e3b28726efa972fe8efbd3e357b8d282de21c18b3ea5fcbe492d71
Instruction ID: ed19e9a98f399578227108913f27ab1a531040fb6ad00381b2793c89cb6ddfaf
Opcode Fuzzy Hash: a12d157366e3b28726efa972fe8efbd3e357b8d282de21c18b3ea5fcbe492d71
Instruction Fuzzy Hash: 4DF1BDB4900216DFDB18CF94C8A1ABFBBB2FF59300F14859CE8626B395D3749911CBA5

Function 02DB2DF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 02DB2E39
GetSystemMetrics.USER32 ref: 02DB2E49

Strings

, xrefs: 02DB2F36

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 9d358e566e0ca28da909595b319718ee3ca6180303152789567797d25c8105f4
Instruction ID: 9164725a77a02e36c6631535e05e605e1b4a997ee0ffb470b8689c0ac0c3f1ef
Opcode Fuzzy Hash: 9d358e566e0ca28da909595b319718ee3ca6180303152789567797d25c8105f4
Instruction Fuzzy Hash: A2A169B0609386CBD360DF54D69879FFBE1BB85308F60995DE4D89B341C7B59848CB82

Function 02D8DDB0 Relevance: 5.4, Strings: 4, Instructions: 391COMMON

Download Yara Rule

Strings

$, xrefs: 02D8DF71
jlRn, xrefs: 02D8E086
h, xrefs: 02D8DE12
PQ, xrefs: 02D8E27E

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $$PQ$h$jlRn
API String ID: 0-745477099
Opcode ID: ee6826041a9ed1248cb238d3a9ffd6c421b4594d1dbc10615d0d8f6d030ea4b2
Instruction ID: 56a44697afd59af4fc4b43e7617f67207ca5de18c345157e2d84b3b2007b8d00
Opcode Fuzzy Hash: ee6826041a9ed1248cb238d3a9ffd6c421b4594d1dbc10615d0d8f6d030ea4b2
Instruction Fuzzy Hash: A2E134B06083819BE314EF29C490A2FBBE6EF95708F14891DE5C98B391D735D906CF96

Function 02D9D1A6 Relevance: 4.1, Strings: 3, Instructions: 372COMMON

Download Yara Rule

Strings

<0z<, xrefs: 02D9D3E1
SaWW, xrefs: 02D9D47C
cejR, xrefs: 02D9D475

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: <0z<$SaWW$cejR
API String ID: 0-344197986
Opcode ID: 3f30713b9f4a3bd2b176436d0ea1bfe1170d22e397063bc15a6c9a9cc79c8939
Instruction ID: 6db8af03e6b4ee769eb47fb4561b793878b609a1d2e8b1cd6c0b4ade7c1f81f4
Opcode Fuzzy Hash: 3f30713b9f4a3bd2b176436d0ea1bfe1170d22e397063bc15a6c9a9cc79c8939
Instruction Fuzzy Hash: CEC1CE71D0825ACFCF15DFA8C4906AEBBB2FF1A304F14455DE496AB381D335A946CBA0

Function 02DAB5A2 Relevance: 4.0, Strings: 3, Instructions: 261COMMON

Download Yara Rule

Strings

J, xrefs: 02DAB1BA
MNOP, xrefs: 02DAB356
4`[b, xrefs: 02DAB3B0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b$J$MNOP
API String ID: 0-4003097146
Opcode ID: 0d37564f9906c33dbc38a38a822ca5d51cea2de8a6f9673baac163ed43786ba2
Instruction ID: 9a9caa3b970a104a35f277f2d35dfdea2e6f02418c117697091c5b81c943df47
Opcode Fuzzy Hash: 0d37564f9906c33dbc38a38a822ca5d51cea2de8a6f9673baac163ed43786ba2
Instruction Fuzzy Hash: 5781EA7150C385CFD319DF28D460A6EBBE2AFAA308F148A5EE5E1073A1C7319D15CB92

Function 02D8F2E0 Relevance: 3.0, Strings: 2, Instructions: 484COMMON

Download Yara Rule

Strings

nK, xrefs: 02D8F7CE
.'&!, xrefs: 02D8F461

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .'&!$nK
API String ID: 0-1803324099
Opcode ID: b04c5cb9b5979336bac83c97282a78b7ea0516ec91c104dbff4d993fcc20a65b
Instruction ID: 015eeb7490b2be244f2a4949dd9563e7403e208cb9d641c3389c97a6c5a79e3e
Opcode Fuzzy Hash: b04c5cb9b5979336bac83c97282a78b7ea0516ec91c104dbff4d993fcc20a65b
Instruction Fuzzy Hash: E1F1A9B560C3808FD318DF19C090A2EBBE2EBD5718FA88A1DE4D98B751D735D806CB56

Function 02D9E920 Relevance: 2.9, Strings: 2, Instructions: 433COMMON

Download Yara Rule

Strings

eeI, xrefs: 02D9EBEC
^P]H, xrefs: 02D9EBE4

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ^P]H$eeI
API String ID: 0-554186952
Opcode ID: e3425b81d6848f1086bf5490e7469c5063927659c50bb273ebbc4ebeefd34fce
Instruction ID: 203ecf593522048f1c66177d07555fe6ee65522c7678579e8a49bfe5f895a788
Opcode Fuzzy Hash: e3425b81d6848f1086bf5490e7469c5063927659c50bb273ebbc4ebeefd34fce
Instruction Fuzzy Hash: C4E197756083809BD705EF28C890A6EBBE6EFD9304F08892DF4C987352D736D915CB92

Function 02D83660 Relevance: 2.9, Strings: 2, Instructions: 424COMMON

Download Yara Rule

Strings

NaN, xrefs: 02D836CF
Inf, xrefs: 02D836C8

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: cebaf76a1c0388fb9f26f752f3c0b9a445151565d333192a9bee998e5d5eb307
Instruction ID: e84b25a7a9321180d3237a05532565fd62ba3aa17fa31d1b93d0f473d272ac43
Opcode Fuzzy Hash: cebaf76a1c0388fb9f26f752f3c0b9a445151565d333192a9bee998e5d5eb307
Instruction Fuzzy Hash: 88E1D6B2A083019BC748DF29C88161AF7E6EBC8B50F25896DF89D97390D735DD45CB82

Function 02DA7300 Relevance: 2.9, Strings: 2, Instructions: 367COMMON

Download Yara Rule

Strings

e, xrefs: 02DA76A0
MNOP, xrefs: 02DA7406

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: MNOP$e
API String ID: 2994545307-1407322595
Opcode ID: 846d55b562e6a3478170e3aeef9bb89a8d78916c38fd0ed4f3c42d8767b53001
Instruction ID: b48db04b5f669ab85ed0909ec2e593b15e0a1b36b1f5696863b7f2ed9717f677
Opcode Fuzzy Hash: 846d55b562e6a3478170e3aeef9bb89a8d78916c38fd0ed4f3c42d8767b53001
Instruction Fuzzy Hash: 6CB18971A083428BE724DF68C8A0A6FF7E2EB95354F14892DE9C587351E335DC45CBA2

Function 02DC2280 Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

=>?0, xrefs: 02DC22B6
=>?0, xrefs: 02DC23BA

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: =>?0$=>?0
API String ID: 2994545307-2509495232
Opcode ID: dd3f35787f0e6f20daa9866134d2dcb3d2936bc650a8e8be8ca23c856d601f57
Instruction ID: db9cf4d66407fb12167f5765c025795eac56e8b9e63e524491f577b4ab413509
Opcode Fuzzy Hash: dd3f35787f0e6f20daa9866134d2dcb3d2936bc650a8e8be8ca23c856d601f57
Instruction Fuzzy Hash: D191BF356082429BC711DF28C890A2BB7E2EFD5754F68896CE8C587365DB31EC52CB92

Function 02DC1790 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

=>?0, xrefs: 02DC1896
@, xrefs: 02DC1850

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: =>?0$@
API String ID: 0-471866982
Opcode ID: db4ab1499a56b272fa63e35407bae24cccb4978b7a68b416794de20d737b8de6
Instruction ID: 52afd972650ff809fae2fd36c50cd38d9a80ddd717ee5d487fe7e40f1c44d75c
Opcode Fuzzy Hash: db4ab1499a56b272fa63e35407bae24cccb4978b7a68b416794de20d737b8de6
Instruction Fuzzy Hash: D7411D719083229BD718DF14C850B2BB7E2EF85318F288A2CE9DA57391D731EC05CB92

Function 02DC2150 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

=>?0, xrefs: 02DC21E6
@, xrefs: 02DC21A0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: =>?0$@
API String ID: 2994545307-471866982
Opcode ID: 35159f18668651999335d0af06d8b9c27648d69c302a49f0c8700fdfb90815ef
Instruction ID: eb96cdd32f7fbb9407be008ccc473514a8fd78dce3a03bc8f303a71718f86b1d
Opcode Fuzzy Hash: 35159f18668651999335d0af06d8b9c27648d69c302a49f0c8700fdfb90815ef
Instruction Fuzzy Hash: B13178756083029BD300CF58D88466AF7F5EFDA758F648A2CE9D897350D371E904CBA2

Function 02DC0C10 Relevance: 2.0, Strings: 1, Instructions: 763COMMON

Download Yara Rule

Strings

,{zy, xrefs: 02DC0C46

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,{zy
API String ID: 0-1863127247
Opcode ID: 399eb3db256e0858e0bf4b3665b08f45ed4046393a7791550cdc25f19d241aae
Instruction ID: dfb1ec90c634bbb3a6d36b19a2ac74511e2d07924ab9883c6d84d414a871b0b7
Opcode Fuzzy Hash: 399eb3db256e0858e0bf4b3665b08f45ed4046393a7791550cdc25f19d241aae
Instruction Fuzzy Hash: 0642AA75A08262CFCB04CF68D49066EB7F2FB89319F2A896DD58997381D331ED15CB81

Function 02DBCAF0 Relevance: 1.8, Strings: 1, Instructions: 593COMMON

Download Yara Rule

Strings

f, xrefs: 02DBCCC8

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 97ca72a771e99b2b2e67c29bcefb16024587afcfd606eecad649821d86a01215
Instruction ID: c91aa4110b789509cae8780e240b0a785994c8b009afcf0c5741615830f95d59
Opcode Fuzzy Hash: 97ca72a771e99b2b2e67c29bcefb16024587afcfd606eecad649821d86a01215
Instruction Fuzzy Hash: B0227A71618341DFC716CE18C8A0B6ABBE2BF89718F188A6DE49687391D735EC05CB52

Function 02DA2690 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(02DC4BA0,00000000,00000001,02DC4B90), ref: 02DA26B9

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ef017421ae852457f80e380575d23696de7006cb7a114378d3825736f7b2135c
Instruction ID: 9441729bf9e67dd3cde2ad5ce5c4411f620cc0f933de6e9eb56fca7542e2e307
Opcode Fuzzy Hash: ef017421ae852457f80e380575d23696de7006cb7a114378d3825736f7b2135c
Instruction Fuzzy Hash: 7351BDB56002009BDB209B25CCAAF7773B5EF85758F148558FD868B390E375ED05C762

Function 02DC0390 Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

P, xrefs: 02DC0533

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b765afd3d110e2cd25cf160218ece526fbb3b48a369255320b5604029b4036a1
Instruction ID: 52f6f0b71f45f021edbeb8aa1b0970e5c34a619baaeb4a63964874c521f2b114
Opcode Fuzzy Hash: b765afd3d110e2cd25cf160218ece526fbb3b48a369255320b5604029b4036a1
Instruction Fuzzy Hash: C8D1A6325083758FD726CE18949065FB7E1EBC5718F658A2CE9B66B380CB71AC46C7C1

Function 02DABE20 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 02DAC108

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 59aee0ddc6f4e7f363dd31ede2c232e500e2a18481fa2a25ac1f8ba4175d59bf
Instruction ID: 76edf24747607e163b1f454de6ae0d58a5baa1cc3717fa3d7a24f271665d08fb
Opcode Fuzzy Hash: 59aee0ddc6f4e7f363dd31ede2c232e500e2a18481fa2a25ac1f8ba4175d59bf
Instruction Fuzzy Hash: DCC12772A183049BD724CF24C4A0F6BB7E6AF95328F18892FE89587381E734DD45CB91

Function 02DC28B0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

=>?0, xrefs: 02DC28E6

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: =>?0
API String ID: 0-1945578858
Opcode ID: 71c858e1dc923fd35c1cbfbaf85c2511c6e045c7cc4d2bfd18db927ed20e24e0
Instruction ID: 9bab325c7fb0ae3468e679c80155d879edd24d3f147113aba9a512908a1e7c9d
Opcode Fuzzy Hash: 71c858e1dc923fd35c1cbfbaf85c2511c6e045c7cc4d2bfd18db927ed20e24e0
Instruction Fuzzy Hash: 73A1CF356083478BC724DE28C890A2BB3E2EF85754F28896CE8D5D7355EB31EC51CB92

Function 02DB8630 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02DB88E0

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 3a48ae5d1500440ce35ebf5e90796fcfdb028c4e4ae2aa4f4966e39b8c0340d1
Instruction ID: 9c0d9701385d7555e8053459cf5e446d374ad1221efb91a676c4fd634a30d364
Opcode Fuzzy Hash: 3a48ae5d1500440ce35ebf5e90796fcfdb028c4e4ae2aa4f4966e39b8c0340d1
Instruction Fuzzy Hash: D9A19E71608202DFD715CF14C8A4B6AB7EAEF89308F548D2DE5CA87381D735E816CB52

Function 02DC25B0 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

=>?0, xrefs: 02DC25E6

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: =>?0
API String ID: 0-1945578858
Opcode ID: 1a4ea6894f9afd24ede7244ff79c56f16ee6e097112eb43a8903430b2d8d6355
Instruction ID: 0ee1a3658e353b29c63583a422d88f12c44cdbcd9bb9828d039ef088fea7d090
Opcode Fuzzy Hash: 1a4ea6894f9afd24ede7244ff79c56f16ee6e097112eb43a8903430b2d8d6355
Instruction Fuzzy Hash: F391D135A083128BC724DF18C8C4A2BB7A2EF98714F24896CE9C657355E771EC11CB92

Function 02DB27C0 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

0, xrefs: 02DB281E

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a6002b891db1e8308f7a2705f7f5030729064f7f465bc38a2858a7a21836704c
Instruction ID: 3882b882b9466d343a242c62be501d2397731e712e0fda98aed216429dbdf0e8
Opcode Fuzzy Hash: a6002b891db1e8308f7a2705f7f5030729064f7f465bc38a2858a7a21836704c
Instruction Fuzzy Hash: A2715A33B5969187C72A487C5C652EA7A934F96330F2D8379ADF6973E1D5288D058380

Function 02DAC2C0 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

", xrefs: 02DAC49D

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: c434106e7a1f3407efc0bac139c1a4e0f7b4fb88fbb903a10c8fbef3496dcb51
Instruction ID: 587eeb8f158b5b493f06613af731180b61bb6e282a5ac972fe54100060248ae3
Opcode Fuzzy Hash: c434106e7a1f3407efc0bac139c1a4e0f7b4fb88fbb903a10c8fbef3496dcb51
Instruction Fuzzy Hash: 5551E1726283448BD724CF69C4A0B6EB7E1ABC5634F19882FE4D58B350C3B4EC44C786

Function 02DA6390 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

4`[b, xrefs: 02DA6440

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 5715b8c625a1dd69aebb97e99eee2c02d672633d5469d34b284d788375638220
Instruction ID: 694ee780d39e1443faef73338f2be0e72bb0a8e038dfa0a9c113e60622b4d7dd
Opcode Fuzzy Hash: 5715b8c625a1dd69aebb97e99eee2c02d672633d5469d34b284d788375638220
Instruction Fuzzy Hash: 41217A7564C341CBE768CF20C4A4A6BB7E6EBC9708F68591CD5DA03358CB70E841CB82

Function 02DC08B0 Relevance: 1.0, Instructions: 990COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3bcabb829f5641abdfed914ce7af71ecea200de09f5abdd3b213df3e879977
Instruction ID: 4ffcfee330630f842cc68350691aeb3ad0474caa8890b26efd4f39837a2224f4
Opcode Fuzzy Hash: 3b3bcabb829f5641abdfed914ce7af71ecea200de09f5abdd3b213df3e879977
Instruction Fuzzy Hash: A462AC72A08252CFCB04CF28D49166EB7E2FF89319F2A896DD58997391D331ED15CB81

Function 02DC0A20 Relevance: .9, Instructions: 870COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7129cbec5c337232d483ba664e20c1904f1f0d9c72507541ec1ac7016e697bc1
Instruction ID: 390272a750c2244f908fc94a3ac4db902f80e06b6cedf4cd58bac1c1453dac4d
Opcode Fuzzy Hash: 7129cbec5c337232d483ba664e20c1904f1f0d9c72507541ec1ac7016e697bc1
Instruction Fuzzy Hash: 7352AB75A08252CFCB04CF28D49066EB7E2FF89319F2A896DD58997391D331EC16CB81

Function 02D8BEA0 Relevance: .9, Instructions: 853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4d917c53b10096f02dff525269476166882a60f44ec98de07de0bc148a56b8
Instruction ID: 34b937a225febd78590674f1c498b189cdfd017d4c25d2a4f112d3c82ebda135
Opcode Fuzzy Hash: 5e4d917c53b10096f02dff525269476166882a60f44ec98de07de0bc148a56b8
Instruction Fuzzy Hash: 6D52B231628711CBC729EF28D48027AB3E2FFC4718F15892ED9D697385E735A851CB62

Function 02DC0AAF Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2620721d707c1bff373406348569655eaa6e77f1dfc3329342f33588283f7cb
Instruction ID: ba9d918e66b8e21c82b80b60147ee94bdd530f1248c80b05b2bc6166ea3de4c6
Opcode Fuzzy Hash: e2620721d707c1bff373406348569655eaa6e77f1dfc3329342f33588283f7cb
Instruction Fuzzy Hash: 0342AC75A08252CFCB04CF68D49066EB7E2FF89319F2A896DD58997391D331EC15CB81

Function 02DC0D20 Relevance: .7, Instructions: 722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a897deb29d12fd8020c3582db04b8fab052fc1c460e7179ac12eac7e8cd86290
Instruction ID: a0c86b6a17f610cf09059d072bc6e00fb859d1f1ed45e8fea80aba1221bc946d
Opcode Fuzzy Hash: a897deb29d12fd8020c3582db04b8fab052fc1c460e7179ac12eac7e8cd86290
Instruction Fuzzy Hash: EA329A75A08252CFCB04CF28D4A066EB7E2FB89319F29896DD589A7391C331ED15CB91

Function 02D87380 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f7fcec4b015fbae02c351aa2e69a85126eb4825be8d3e7995c1479dddee427
Instruction ID: 4a162584741eac7c108b283c548ba181873b26633663d74db27a1cc4cbbeeb90
Opcode Fuzzy Hash: a7f7fcec4b015fbae02c351aa2e69a85126eb4825be8d3e7995c1479dddee427
Instruction Fuzzy Hash: B352CF395083458FEB14DF28C0806AAFBE1BF88318F298A6DE8D957351D774ED49CB81

Function 02DC0E30 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91149b7ba3e42d6af4aa756388c526fb5c82cf437b545331aae7a643ebed8ec3
Instruction ID: 3b7e0779d512a25d8838849d23a6426250512fb0aba06c67bf5057da8e9f57c0
Opcode Fuzzy Hash: 91149b7ba3e42d6af4aa756388c526fb5c82cf437b545331aae7a643ebed8ec3
Instruction Fuzzy Hash: 2D22AC75A08256CFCB08CF28D49066EB7E2FF89315F29896DD48A97381D731ED11CB91

Function 02D8B390 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b778457fa0af6043a20a3280c81598f977ad8d0efa43ab132f0def2c5ab37307
Instruction ID: 56f3e108207829fb418bbbf0a5a54e9105b0ba434cbaa0fc741c2c0538aac326
Opcode Fuzzy Hash: b778457fa0af6043a20a3280c81598f977ad8d0efa43ab132f0def2c5ab37307
Instruction Fuzzy Hash: CB52D670908B849FE735EB34C4847A7BBE1EB85318F14586FC5E786B82C379A885CB51

Function 02D87DC0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b4201bf7fe0c653268b068d8074d53fffd2df815bda38ed702c9ac7d332a70
Instruction ID: 201863472b9dfae70d2d9e51bf93d7ec228e24128ea85b91dbf4ed658b64e95b
Opcode Fuzzy Hash: 35b4201bf7fe0c653268b068d8074d53fffd2df815bda38ed702c9ac7d332a70
Instruction Fuzzy Hash: C73211B1514B158FC368DF29C59062ABBF2BF45710BA04A2ED6A78BF90D736F844DB10

Function 02DC727B Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fae7a71bb05b04899b85d58e9815f4e1409acd6cc9a4c57953480a4d43c196
Instruction ID: 5bc1fcb8f84a67ce498b8739d677b8a00addd35bbce6c15167e25d85390914f2
Opcode Fuzzy Hash: f2fae7a71bb05b04899b85d58e9815f4e1409acd6cc9a4c57953480a4d43c196
Instruction Fuzzy Hash: E8F1567124618BAFE7021F2588AD5E5FFB5FF4B32432A45D9E5C04E006C739589ADF60

Function 02DA8763 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1e898667e8d15075b3adc0822730801c096142de892942329ac4f461c467fd
Instruction ID: ab519808f7fa283e323055696aff0dec6cff2a424caf1e9714463a69acada944
Opcode Fuzzy Hash: 0e1e898667e8d15075b3adc0822730801c096142de892942329ac4f461c467fd
Instruction Fuzzy Hash: 06D1E131E14256CFDB148F78D8A06ADBBB3BF8A320F298669D861A73D5D7349C41CB50

Function 02D8CBF0 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f37897a8c76c19be5e3612f4462b8389b8d50331e3decacd2db82c83d1ba840
Instruction ID: a9da7ec918ff92759a0f3a5dd92c3ba33157bc60175096b036bd9b8b1f317955
Opcode Fuzzy Hash: 6f37897a8c76c19be5e3612f4462b8389b8d50331e3decacd2db82c83d1ba840
Instruction Fuzzy Hash: A8F18F7291C3519BC719DF28C4A062EBBE2AFC5620F19895EF8DA573A1D234DC05CB92

Function 02DBF5FC Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10303192d8b19ee5ef314a7123e8e7e580b1efa83be9110e63b08274a6fd1a02
Instruction ID: 20974e5397df5872744a862863604a2741e72594cc6a3d132202352a5bcf726a
Opcode Fuzzy Hash: 10303192d8b19ee5ef314a7123e8e7e580b1efa83be9110e63b08274a6fd1a02
Instruction Fuzzy Hash: F4E1DF32A58242CFC715CF38E89126AB7E2AB89318F1A8A7DE8D5C3381D774DD50CB41

Function 02D8A380 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88dcd1183fcd25dad8e9ca0f537ba6946182672bb3c970a42b981528887e676
Instruction ID: 179489da418efd63c26584b7862fb53b9e2f6f6efea9337df1c297399d2cf7b5
Opcode Fuzzy Hash: a88dcd1183fcd25dad8e9ca0f537ba6946182672bb3c970a42b981528887e676
Instruction Fuzzy Hash: 2DE17971208341DFC725DF69C880B2BBBE6EF98204F44882EE4D587751E775E949CBA2

Function 02D94921 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268cee7ce1860a376ce99066269480f243f56d9a6f646f2b3cbfc1f68f979230
Instruction ID: ec0969278417c20df9d621073a29b2d7a989b0b0b8f044dcc7e6dc6a4c911cfa
Opcode Fuzzy Hash: 268cee7ce1860a376ce99066269480f243f56d9a6f646f2b3cbfc1f68f979230
Instruction Fuzzy Hash: 45D1C3769182528FDB14DF28D84066AB3E6FF84314F19096DF48A97392E734DD11CBA2

Function 02D93E28 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32acdf2448c634459ea166067f52b4c9290119e8734ff2fe05de8f6e98920bf5
Instruction ID: e2eb5d007974099591092b5b2cc471be77c0fc52fb7934586e51cee90297e708
Opcode Fuzzy Hash: 32acdf2448c634459ea166067f52b4c9290119e8734ff2fe05de8f6e98920bf5
Instruction Fuzzy Hash: 9FD136B06183808BD724DF28D881BAEB7F6EF9A704F04096DE5C997352E7359C11CB66

Function 02DAA067 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2821afe693fa87018c3cbb4c235c9817b72f8a99484978aa343327f4feaa9b
Instruction ID: c1e0c0ef553ce8d6fe123af15e9c47a84130787163df6956576ea2f581e41ad1
Opcode Fuzzy Hash: fa2821afe693fa87018c3cbb4c235c9817b72f8a99484978aa343327f4feaa9b
Instruction Fuzzy Hash: 83C1EFB55083428FD718DF68C4A1B6AB7F2EFC5304F148A2CE5D987382E7799915CB42

Function 02D89E3D Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae6c8cd72f089d4d3a04a22aa26ca550a4b96655587b8a4415a83973557e209
Instruction ID: 381655f8874f3c8ca443c6351783ed2f18121888e3aa36de9557c3fa6ebab25b
Opcode Fuzzy Hash: 7ae6c8cd72f089d4d3a04a22aa26ca550a4b96655587b8a4415a83973557e209
Instruction Fuzzy Hash: F7E15A35604682EFC725CF29D840A56FBB2FF99300B14CAACE59A47B52C331F864CB91

Function 02D89C5D Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19a571ce6307ac783bbbdb7279a6fb1bff9151439e9cc1cd1d3e3051b2ea456
Instruction ID: 79b96e874f2c3f66088ba4aaf1bf3920b2b9da492c5d26b6c24acf8cbc198dc8
Opcode Fuzzy Hash: d19a571ce6307ac783bbbdb7279a6fb1bff9151439e9cc1cd1d3e3051b2ea456
Instruction Fuzzy Hash: 41D13975609A82EFC725CF29D440A56FBB2BF99300B18CA9CD49A47B52C331F865CB91

Function 02D942FE Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49b0e83c2d1d2223de0a146229d9087bad0e6aa214e8be4bb368ef5d03f5380
Instruction ID: 1a9cab95268a8865b3c7d4a6cf9315dc7a7e47ddf7e7233c08d103e99fffd57a
Opcode Fuzzy Hash: a49b0e83c2d1d2223de0a146229d9087bad0e6aa214e8be4bb368ef5d03f5380
Instruction Fuzzy Hash: 9EB132705083808FD325EF28D490BAEB7F5EF9A708F04092DE5C987352E77A9815CB66

Function 02D8AF00 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0456584b5a6826dc4bd6c7afc4826674478406e48d44e4aeaf6668cd7845ff02
Instruction ID: 846244fe75e46e6c89d51f52c88048e06dd2a1caf8fbddfeb509a28921a99e01
Opcode Fuzzy Hash: 0456584b5a6826dc4bd6c7afc4826674478406e48d44e4aeaf6668cd7845ff02
Instruction Fuzzy Hash: B8C157B2A187418FC360DF68DC86BABB7E1BB85318F08492DD1D9C6342E778A555CB06

Function 02D92F92 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e20c80993b582e29dca984f954eddfec03fb527a29c8e68c1859f1365598ece
Instruction ID: e159138769cdba3d4f16ae3c99789d46073f7235083b525e1aba72460ef1ac49
Opcode Fuzzy Hash: 8e20c80993b582e29dca984f954eddfec03fb527a29c8e68c1859f1365598ece
Instruction Fuzzy Hash: 6781A1B29183418FDB25DF28D84076AB7E6EF86314F150A6CF49997391E735DC04CB92

Function 02DBFE30 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf6dcc6d63af047d6e915d58ffc24b058b8f54ce0c728dd9443f07e997b2625
Instruction ID: fcad4276a6e8c0ba69633d5477ee4284c3d29d9b650fefbe563912a4bb9dd39c
Opcode Fuzzy Hash: acf6dcc6d63af047d6e915d58ffc24b058b8f54ce0c728dd9443f07e997b2625
Instruction Fuzzy Hash: 1181F5B5A043419FE724DB28DC50BABB7D6EF84358F28492DF996C3351EA34DC048B62

Function 02D89C0F Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4144b70b43c21513db9e7dbe3fd72af7e374e947d5a2b07b37d6be29452f0c42
Instruction ID: 0b1efc7a7426e126a589b71abf86f2989a460e7b251806b2619335124be996db
Opcode Fuzzy Hash: 4144b70b43c21513db9e7dbe3fd72af7e374e947d5a2b07b37d6be29452f0c42
Instruction Fuzzy Hash: E1B15A35609A82EFC325CF69C440956FBB2BFA9310B18CA9CD49947B52C331F865CBE1

Function 02D99850 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da882c4391e513d1c2d5a3d5a657d48e18b097080ca664fa16d1956a02be5d5
Instruction ID: 4f3a4f3042bdf2f6c7373b6774db7cb25f98f72f4c34ec094fdaf197a447aaa3
Opcode Fuzzy Hash: 0da882c4391e513d1c2d5a3d5a657d48e18b097080ca664fa16d1956a02be5d5
Instruction Fuzzy Hash: 4761E633B1DA924BDB29893C5C722EA6A839BD723472D876DF6F28B3D4D6158C018351

Function 02DA395E Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e13543eaefde56e7a56310a2e7230e30f1b23f0ef428c9f3d00402566edd0f48
Instruction ID: 29efd2b40267cf7f12643c895f6614045ae5d09da4bb42e1573779b37996b73d
Opcode Fuzzy Hash: e13543eaefde56e7a56310a2e7230e30f1b23f0ef428c9f3d00402566edd0f48
Instruction Fuzzy Hash: 6161D872E046668BCB15CE58CCA4AAEB7F3FB88315F1546ACD856A7380D770AD41CB90

Function 02D92998 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b9174ff62e9edea389a884ad2a22df7ecaf75724ceb392eb8618898155ac18
Instruction ID: ece87c67b979b7620c79fdc49c77a17400309cf960bd1a2ce0545b0ac06d511a
Opcode Fuzzy Hash: 88b9174ff62e9edea389a884ad2a22df7ecaf75724ceb392eb8618898155ac18
Instruction Fuzzy Hash: 98718A7661D2818BE328DF28D891BAFB7F5EB96705F04082DE5C9C3342D7369811CB16

Function 02DA8533 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f649e8a43a0f82b8c06a553ad8e59b7cfd8c2dfb9df3cc98c4cbcb05845835c0
Instruction ID: 890689ac2c52ad59341c079d39ff1b39810e29674efee6ddea159148be30e093
Opcode Fuzzy Hash: f649e8a43a0f82b8c06a553ad8e59b7cfd8c2dfb9df3cc98c4cbcb05845835c0
Instruction Fuzzy Hash: 175197B5E112168FCB18CF68C8A0A6DB7F2AB89315F1D826DD856E7381D7349C41CB90

Function 02DB0D40 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61baf21109736e57084c8f2279cdb97f668cc0c891d4967156940313cd9a9e9
Instruction ID: f86c98bfba800419e3d7c30c928d5fe8d6e08ed5f219c0a00f66ab513b3a20f2
Opcode Fuzzy Hash: c61baf21109736e57084c8f2279cdb97f668cc0c891d4967156940313cd9a9e9
Instruction Fuzzy Hash: EB51F12A759AD2CAC31A893C58343FA6A534F96231F1D875AE6F34B3D1CA158C15C351

Function 02DB7340 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d59f628840b5e8251de5f5083575ce74deffd400414cdff5ce3adc9b892e72
Instruction ID: d1594c412d4b90b4f7ee9192caabffc74b6350173cedaa8a72d0c840faac9588
Opcode Fuzzy Hash: 26d59f628840b5e8251de5f5083575ce74deffd400414cdff5ce3adc9b892e72
Instruction Fuzzy Hash: 26513CB15087548FE314DF29D49475BBBE1BBC4318F144A2DE4EA87350E379DA088B92

Function 02DB89E0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53dfa822156f829c79dc8e52c38bb7ebe3ffeb2019b90e23a883e3c8e097e048
Instruction ID: 43b99e2589fe2b0d76a38414428c20ebe9f6faf67e796930438ed73ba33468c7
Opcode Fuzzy Hash: 53dfa822156f829c79dc8e52c38bb7ebe3ffeb2019b90e23a883e3c8e097e048
Instruction Fuzzy Hash: 8A5129B160C7848BC725CA28C4A13FBBBD69FC6208F08896CE5D78B386D639DD45D751

Function 02DA35E0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af184ce91b3114c6f5d4dcf555b9295a4f28e8ad2644e1c890202546821ecd5
Instruction ID: 74c6e86d530606dd8eb15b991d25b808237c34e8366cecd870705be37ccd18cd
Opcode Fuzzy Hash: 9af184ce91b3114c6f5d4dcf555b9295a4f28e8ad2644e1c890202546821ecd5
Instruction Fuzzy Hash: 5C515CB1E0025ACBDB54CF68D850AAEB7B6EF49314F2944ADD812E7390DB34ED11CB64

Function 02DA3108 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8db9a4bb5ad888f1e39d79194c90dcaa9b91777b87f36af9c1a5fb3d69ffedd
Instruction ID: 835a80a69d4078fe732e40cacb8bd0cd8dca9c83ac3c1b6a86bb138b695b9feb
Opcode Fuzzy Hash: f8db9a4bb5ad888f1e39d79194c90dcaa9b91777b87f36af9c1a5fb3d69ffedd
Instruction Fuzzy Hash: 83619DB0D042AA8BDB64CF58CC94BAEB7B1FB85305F2005D8D459AB390D7749E81CF54

Function 02D85BA0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8790c2ee07a173b30cd857a857db0d1738e7f96495a76906ffbebd4352f33518
Instruction ID: 0cd59fb49e2abdbd671637e60e3cbdb4cb0ca466399e3f73bfbb907e21c8319c
Opcode Fuzzy Hash: 8790c2ee07a173b30cd857a857db0d1738e7f96495a76906ffbebd4352f33518
Instruction Fuzzy Hash: B251A5B59042019FC714EF18E880916B7E5FF85324F5A466CEC959B351E731EC41CF92

Function 02DA3B8F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897e6647db87b1b2830348f5a11797d5b1fface30be8aeabf72c4b3f826762a4
Instruction ID: 39f2d726e6043998f6ec1b313c990364e0375d51c378eb22fe4133d2eb9f33ed
Opcode Fuzzy Hash: 897e6647db87b1b2830348f5a11797d5b1fface30be8aeabf72c4b3f826762a4
Instruction Fuzzy Hash: 1351BF72E54226CFCB05CF68E8916AE77B2FF48315F1A8478C942AB380D7349D61DB90

Function 02D9279A Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 21d11593b06b6b5eb79f6e63fd47a5f9387efcfb7463e6a500f1e5ab04f28a14
Instruction ID: b4adda4f8f85d4498e50b8f1cb6e73ad137cdb58eaae517e4e9747738bb4c9ef
Opcode Fuzzy Hash: 21d11593b06b6b5eb79f6e63fd47a5f9387efcfb7463e6a500f1e5ab04f28a14
Instruction Fuzzy Hash: 455135B56153409BE724FB349C91FAE72E6EB95318F04193CE84A93382EA35DD048E77

Function 02D92C84 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeaa634d9780d4e4967dcb6eee967f388bd03920789b3f6a7913e2a11f5edccd
Instruction ID: 3e6b8bc7b8c3465f030f90297815dc74d4d04fa5447f9cfa84461b15186819bf
Opcode Fuzzy Hash: eeaa634d9780d4e4967dcb6eee967f388bd03920789b3f6a7913e2a11f5edccd
Instruction Fuzzy Hash: CF51557890C2808FD324DB28C994B6EF7F6EB96704F05182DE5C987362D736AC10CB56

Function 02DA3445 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526c426eb78af458e2a0876eb06cf15b52f1dba985da1f470b53babc6d777165
Instruction ID: fe2c40e1e088740564d6ce8e1894880ba29480b25f77ddfa78e0b8675a5ef6db
Opcode Fuzzy Hash: 526c426eb78af458e2a0876eb06cf15b52f1dba985da1f470b53babc6d777165
Instruction Fuzzy Hash: D441A1B1E04557CBDB58CE58C8A0AAEB3B3FF88305F6946A8D946A7380D731AD51CB50

Function 02D91190 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38eb12a2918de4fb37719fe2127d4d0814c86fd95f910b68cb4792d02e54a10
Instruction ID: 10814b06cc7ab7799ade5df06457c044b4d56fd19947ddad5b0e14360cea3b9f
Opcode Fuzzy Hash: a38eb12a2918de4fb37719fe2127d4d0814c86fd95f910b68cb4792d02e54a10
Instruction Fuzzy Hash: 4041C472B182524FD7088A3DC89032EBAD2AB85314F19876DF4EAC73D1D678C945DB54

Function 02D84AB0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e46b66fb2f3ea2defab5feaf4e273a5737e9d6db71d8fd8aa7e1db4f2c4611
Instruction ID: f0f5a31d1ef4c7dba2b2b539e3e0de910ea6f0da6e88cefc7371a4fb6f4e6afa
Opcode Fuzzy Hash: e4e46b66fb2f3ea2defab5feaf4e273a5737e9d6db71d8fd8aa7e1db4f2c4611
Instruction Fuzzy Hash: 9B31C8357082029BD714AF59D890B27B7E5EF84358F18892DE899CB341E331FC42CB52

Function 02DA3D0F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379750375709bae250959cf3201b8fa9e5468756e3a6c6211b21538d7a2adcfa
Instruction ID: d579b93731fcbc9ad980ff609463eb9a64ff932c92cd4bc260f8f9e1716e0101
Opcode Fuzzy Hash: 379750375709bae250959cf3201b8fa9e5468756e3a6c6211b21538d7a2adcfa
Instruction Fuzzy Hash: CF4118B494065AAFDB14CF55C990AAEFBB2FF1A700F105A48D015AB751C334E961CF94

Function 02DAB4BE Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f6c89f97f492425217299d2cfa10a39f11b247be6506eb16b2792e76c5deb1
Instruction ID: 96dd7c3797b268c7a2fe243e65a96dcb8a8d28851ad4a2ad2ccf405d20404ffe
Opcode Fuzzy Hash: e3f6c89f97f492425217299d2cfa10a39f11b247be6506eb16b2792e76c5deb1
Instruction Fuzzy Hash: A421C170A083019FC715DF14D460B2AB3E5EF95708F18896EF49587391E770DD09CB92

Function 02D8E965 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a9a8c63e6a0160622ad48acdc894ce8fdf50b72818db13100af2dea4488000
Instruction ID: 9943762ccb67c114b20859098f528951c1bcbe285142e88213eed28787b59484
Opcode Fuzzy Hash: e4a9a8c63e6a0160622ad48acdc894ce8fdf50b72818db13100af2dea4488000
Instruction Fuzzy Hash: 8D11DD72C0022A9BDB50EF14D8807E8B3BDEF45300F1905A4E808E7341E774AE89CFA5

Function 02DB4E60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 0dbb4da7da6ba59318b4103fc9edc20159690c02ceed830ac40e2a09558cf921
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9A11A337A491D48AC316CD3C84605A6BFE30E93134B598399E4B59B3D3D6229D8AC354

Function 02DABB20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8285ae00c2ed8d539d631acf39494bad83f47e0fe6b085ca0f33fa9170492b
Instruction ID: b460a47e3616966dda37ba0438298e5dfb937bb50ec8b625bc3aea6f969728a8
Opcode Fuzzy Hash: dd8285ae00c2ed8d539d631acf39494bad83f47e0fe6b085ca0f33fa9170492b
Instruction Fuzzy Hash: F7019EF160270187E720AF60E4E0F3BB2A9AFA460CF09042EC80957304EB75EC06CAB1

Function 02DBD7E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f010015948f8b396a02ef6186726fcc48c6da814095557424024eb0029bf90b7
Instruction ID: 3cf5e92e0a583d837a315c616f2078902e05d98597b62c5179f49951ee309527
Opcode Fuzzy Hash: f010015948f8b396a02ef6186726fcc48c6da814095557424024eb0029bf90b7
Instruction Fuzzy Hash: 992163B1A18340ABD300CF28EA9492BBBF5EB86608F54982DF08ACB341D734CD15CB52

Function 02D8F134 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54892e6a1925d8c58756411d0805684fe28e8f6da7d7524faa53d0e25c83ff85
Instruction ID: 87b5d9d02b91ab727ee0a1aa7430b499c570d7e0f0b62d535237332128c53508
Opcode Fuzzy Hash: 54892e6a1925d8c58756411d0805684fe28e8f6da7d7524faa53d0e25c83ff85
Instruction Fuzzy Hash: CC111372D042268FDB55CF54C8807FEB3B6AF99B14F594099C405A7340E778AD45CBA4

Function 02D87040 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d31566452d4aee153513c7175947971b8852734d3413a025811500e18175e22
Instruction ID: bb44e05bba4cf6391f8bd7ab997090607c19e1330875bf24f12ecd2bc99deaa3
Opcode Fuzzy Hash: 0d31566452d4aee153513c7175947971b8852734d3413a025811500e18175e22
Instruction Fuzzy Hash: 46F0902ABA831707A310DCBADC80A6BF3A6E7C5654B394438E941D3301D565EC128294

Function 02D8F1FC Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553b81a6f5577b4c1bb2ac9bb228674d13deb8345b7bda187acbcbd06e1a08ce
Instruction ID: 9b892c69b915b30944b35fd92dd71a9f3c2dffc46dffa2d35c3ee462823126c0
Opcode Fuzzy Hash: 553b81a6f5577b4c1bb2ac9bb228674d13deb8345b7bda187acbcbd06e1a08ce
Instruction Fuzzy Hash: 54F04F680A42128AC624EF08C47133373B0EF46658760984AD6D2CBB50F378DC41D79B

Function 02D996B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ba9e05988ac3a33073382158fc898507509c4f1e046660530b93e5cab66104
Instruction ID: 3584c9ed9e24508f0e541734786f888ae514f633e0d8f68a7b400fa94b566e6d
Opcode Fuzzy Hash: c8ba9e05988ac3a33073382158fc898507509c4f1e046660530b93e5cab66104
Instruction Fuzzy Hash: BAF0ECB17041E067DF228D549CE0F77BBDCCB87254F191419F84597301D1619C44CBE6

Function 02DBA180 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 2205c55167872a20da9adc9a3335129e5b50a25b2aac4865fecdada980fa6ed1
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: B4D0A73160832186ABB58E19E8109B7F7F4EEC7A51F49955EF583E3248D330DC41C2A9

Function 02DB13B5 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02DB1465

Strings

z, xrefs: 02DB15BE
M, xrefs: 02DB13EB
t, xrefs: 02DB157E
B, xrefs: 02DB13F3
C, xrefs: 02DB13FB
p, xrefs: 02DB161E
I, xrefs: 02DB13CB
{, xrefs: 02DB163E
O, xrefs: 02DB13DB
}, xrefs: 02DB160E
0, xrefs: 02DB1727

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: 0$B$C$I$M$O$p$t$z${$}
API String ID: 2525500382-4079466104
Opcode ID: 3461b96948ce0d4e28269d3e076732d74ef3924be3081246e132d507cf52ca21
Instruction ID: 0c03253d5a5ad82b471f471ef453ee46b928b894208b921e64d40f625ed03298
Opcode Fuzzy Hash: 3461b96948ce0d4e28269d3e076732d74ef3924be3081246e132d507cf52ca21
Instruction Fuzzy Hash: 95A1A16040CBC2CAC332CA3C845879EBED16BA6224F188F9DE1F95B2E2D7754546D763

Function 02DB194D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 75COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02DB1964

Strings

T, xrefs: 02DB19E2
(, xrefs: 02DB1A02
S, xrefs: 02DB19C2
Q, xrefs: 02DB19A2
w, xrefs: 02DB19F2
c, xrefs: 02DB19D2
,, xrefs: 02DB1A22
T, xrefs: 02DB1992
T, xrefs: 02DB1982
n, xrefs: 02DB19B2

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: ($,$Q$S$T$T$T$c$n$w
API String ID: 1927566239-2354970113
Opcode ID: 0237a473f9fa19944eb45aef88e681ac78409f0ca7aa9d316cb2179490b94c91
Instruction ID: 1f1e8248a4160ab19e75b2d6fa8baaeb92057eba2367a9131681f95a967655a3
Opcode Fuzzy Hash: 0237a473f9fa19944eb45aef88e681ac78409f0ca7aa9d316cb2179490b94c91
Instruction Fuzzy Hash: F141E23000C7C2CAD336CB2884587CBBFE06B96314F488A5DD5E88B392C7755219CBA7

Function 02DB221F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02DB2229
VariantInit.OLEAUT32 ref: 02DB223C

Strings

$, xrefs: 02DB227F
", xrefs: 02DB2275
%, xrefs: 02DB2293
+, xrefs: 02DB226B
3, xrefs: 02DB22B1

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: "$$$%$+$3
API String ID: 2610073882-3433838884
Opcode ID: d279923a7b09325437838f7e6f77594770f0bc988f44300a0727ab0ccf452b15
Instruction ID: 8f108376723f05494fb9fabc0f7c108ab3a07cd716c53bab9ef7a4df75bd6a51
Opcode Fuzzy Hash: d279923a7b09325437838f7e6f77594770f0bc988f44300a0727ab0ccf452b15
Instruction Fuzzy Hash: CF41D47100C7C28AD322DB78944878EFFE1AB96324F444A5DE4E9873E2DB749549CB53

Function 02DB25EE Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02DB25FC
VariantInit.OLEAUT32 ref: 02DB260F

Strings

3, xrefs: 02DB2684
", xrefs: 02DB2648
$, xrefs: 02DB2652
%, xrefs: 02DB2666
+, xrefs: 02DB263E

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: "$$$%$+$3
API String ID: 2610073882-3433838884
Opcode ID: c9c40a5fa3936a50a759371d9f276b14615348b57830154840bb5704be9d2fa3
Instruction ID: 7bd6f3e1823280fef00d7060d3b227d76b30f66be2e465228f3eb976e0ea2b7e
Opcode Fuzzy Hash: c9c40a5fa3936a50a759371d9f276b14615348b57830154840bb5704be9d2fa3
Instruction Fuzzy Hash: E341B27100C7C2CAD322DB78945868EFFE16BA6324F444A4DE4E58B3E2D7749509CB63

Function 02DB0BBD Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02DB0BC3

Strings

A, xrefs: 02DB0BFB
C, xrefs: 02DB0BE3
E, xrefs: 02DB0C03
r, xrefs: 02DB0BF3
B, xrefs: 02DB0C0B
t, xrefs: 02DB0BEB

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: A$B$C$E$r$t
API String ID: 1927566239-281525357
Opcode ID: db7b5b606f34d33adb6dcdecfdedb91ffcfa166097c67987141dea6ba8b769c1
Instruction ID: c8c6c2b9a69d37b55e63af7c01118c12c662a475f31eaee2bcf15ff2f807a403
Opcode Fuzzy Hash: db7b5b606f34d33adb6dcdecfdedb91ffcfa166097c67987141dea6ba8b769c1
Instruction Fuzzy Hash: F431FA70508B81CED721DF28C49475ABFA0AF56314F188A8CD8EA4F397D775E845CBA2

Function 02DAFD40 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 02DAFD46

Strings

B, xrefs: 02DAFD8E
E, xrefs: 02DAFD86
t, xrefs: 02DAFD6E
C, xrefs: 02DAFD66
r, xrefs: 02DAFD76
A, xrefs: 02DAFD7E

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: InitVariant
String ID: A$B$C$E$r$t
API String ID: 1927566239-281525357
Opcode ID: 463d9f51efe6a1a3722279d1f4b838b6d858695f0780bd23d3f67c5f71392b1f
Instruction ID: f625369d9dd01c2fe9dee1bafa2e77f09c0f450b5bc20909075d2288cdc49ae0
Opcode Fuzzy Hash: 463d9f51efe6a1a3722279d1f4b838b6d858695f0780bd23d3f67c5f71392b1f
Instruction Fuzzy Hash: B631C8705087818ED721DF2CC49471ABFE1AB56214F088A8DE8EA8F796C775E805CB62

Function 02DA43A8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 02DA4526

Strings

{}, xrefs: 02DA43FF
CE, xrefs: 02DA4445
wy, xrefs: 02DA43F8
G&I, xrefs: 02DA444C

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID: CE$G&I$wy${}
API String ID: 999431828-4005062095
Opcode ID: d18fb53936210a4883e16ac9c9ec193815027cf579447907c41c615b38c47f86
Instruction ID: 6e113455c966472c2a890d32b0232485ed126c9453e6363065e467943092a04f
Opcode Fuzzy Hash: d18fb53936210a4883e16ac9c9ec193815027cf579447907c41c615b38c47f86
Instruction Fuzzy Hash: 4E8173B4A0121ADFCB10CF58D890AAABBB1FF05304B195A48E455AF701D374E9A1CFD4

Function 02DA9175 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(02DA9642,?,00000000), ref: 02DA9253

Strings

MNOP, xrefs: 02DA9306
4`[b, xrefs: 02DA9360

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: CopyFile
String ID: 4`[b$MNOP
API String ID: 1304948518-442539271
Opcode ID: 655e6d1d886841e9ca5fd01a2444f16c3ba0b0b24e81e7d1b520b90446f63239
Instruction ID: bfe9e19dfecf39af18d054a09555ec93872ee9838fb273ae579189ad74ab4e10
Opcode Fuzzy Hash: 655e6d1d886841e9ca5fd01a2444f16c3ba0b0b24e81e7d1b520b90446f63239
Instruction Fuzzy Hash: 9B517BB5D0021ADBEB14CF54D860ABEB772FF49304F244A58E84667780C770AD21CFA1

Function 02DA9196 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(02DA9642,?,00000000), ref: 02DA9253

Strings

MNOP, xrefs: 02DA9306
4`[b, xrefs: 02DA9360

Memory Dump Source

Source File: 00000004.00000002.2134957379.0000000002D80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d80000_BitLockerToGo.jbxd

Similarity

API ID: CopyFile
String ID: 4`[b$MNOP
API String ID: 1304948518-442539271
Opcode ID: 1e8edddf0b9c5d9042dbd1805c444a6ded3d3a0847250bb212f3cf0c4a19918b
Instruction ID: ad63e6d87568c71417614b5e6215f67188649b5c4572e0ac0ded960e7dd204d6
Opcode Fuzzy Hash: 1e8edddf0b9c5d9042dbd1805c444a6ded3d3a0847250bb212f3cf0c4a19918b
Instruction Fuzzy Hash: FB5188B9D0022ADBEB14CF54D860AAEB772FF49300F244A58E84667780C774AD21CFA1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report N65c8rwdal.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
N65c8rwdal.exe

Function 02D900A0 Relevance: 12.9, Strings: 10, Instructions: 355
COMMON

Function 02D8D1F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 193
threadCOMMON

Function 02D8F960 Relevance: 7.0, Strings: 5, Instructions: 732
COMMON

Function 02DBE4E0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 02D907BA Relevance: .3, Instructions: 279
COMMON

Function 02DBF0CD Relevance: .1, Instructions: 81
COMMON

Function 02DBBAB0 Relevance: 1.6, APIs: 1, Instructions: 100
memoryCOMMON

Function 02DBE3F0 Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Function 02DBBA92 Relevance: 1.5, APIs: 1, Instructions: 7
memoryCOMMON