Edit tour

Windows Analysis Report
EKAHephXb2.exe

Overview

General Information

Sample name:	EKAHephXb2.exe renamed because original name is a hash value
Original sample name:	c0faa9469b975c6abf8305f713c91740a455f7e17f49cb4c21c801f432bd5baf.exe
Analysis ID:	1524040
MD5:	6cf54ce259904e8ee54d521a8c85aff1
SHA1:	7ebab8469454f1954b8fec645b921f316eda9ddc
SHA256:	c0faa9469b975c6abf8305f713c91740a455f7e17f49cb4c21c801f432bd5baf
Tags:	exeGuizhouSixuandaTechnologyCoLtdsigneduser-JAMESWT_MHT
Infos:

Detection

LummaC, Go Injector, LummaC Stealer

Score:	99
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Go Injector

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

EKAHephXb2.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\EKAHephXb2.exe" MD5: 6CF54CE259904E8EE54D521A8C85AFF1)

BitLockerToGo.exe (PID: 7616 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["reggwardssdqw.shop", "eemmbryequo.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "tendencctywop.shop", "licenseodqwmqn.shop", "relaxatinownio.shop", "tesecuuweqo.shop"], "Build id": "c2CoW0--4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
EKAHephXb2.exe	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1798475742.00000145E3200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1822185696.00000145E31A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1826819388.000000C0009F8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1825888626.000000C000644000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1831653920.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000000.00000000.1357843651.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Process Memory Space: EKAHephXb2.exe PID: 7256	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.BitLockerToGo.exe.410000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.c000830000.4.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.EKAHephXb2.exe.145e31a0000.4.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.BitLockerToGo.exe.410000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.c0007da000.2.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.c000830000.4.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.c0009f8000.5.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.EKAHephXb2.exe.145e3200000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.c0009f8000.5.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.EKAHephXb2.exe.145e31a0000.4.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.3.EKAHephXb2.exe.145e3200000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.EKAHephXb2.exe.7ff6cc510000.6.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
0.0.EKAHephXb2.exe.7ff6cc510000.0.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Click to see the 8 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:02.469562+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49714	104.21.16.12	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:02.469562+0200	2049836	1	A Network Trojan was detected	192.168.2.9	49714	104.21.16.12	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.248127+0200	2055879	1	Domain Observed Used for C2 Detected	192.168.2.9	50213	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.174781+0200	2055881	1	Domain Observed Used for C2 Detected	192.168.2.9	63593	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.186584+0200	2055883	1	Domain Observed Used for C2 Detected	192.168.2.9	60987	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.232835+0200	2055885	1	Domain Observed Used for C2 Detected	192.168.2.9	51149	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.219342+0200	2055887	1	Domain Observed Used for C2 Detected	192.168.2.9	51217	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:04:59.984970+0200	2055891	1	Domain Observed Used for C2 Detected	192.168.2.9	59173	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.202113+0200	2055893	1	Domain Observed Used for C2 Detected	192.168.2.9	60539	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:05:00.259045+0200	2055895	1	Domain Observed Used for C2 Detected	192.168.2.9	49284	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.EKAHephXb2.exe.c000830000.4.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["reggwardssdqw.shop", "eemmbryequo.shop", "tryyudjasudqo.shop", "keennylrwmqlw.shop", "tendencctywop.shop", "licenseodqwmqn.shop", "relaxatinownio.shop", "tesecuuweqo.shop"], "Build id": "c2CoW0--4"}

Multi AV Scanner detection for submitted file

Source: EKAHephXb2.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.9% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tryyudjasudqo.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: eemmbryequo.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: reggwardssdqw.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: relaxatinownio.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tesecuuweqo.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: licenseodqwmqn.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: keennylrwmqlw.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp	String decryptor: c2CoW0--4

Source: EKAHephXb2.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.9:49714 version: TLS 1.2

Source: EKAHephXb2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: EKAHephXb2.exe, 00000000.00000002.1824849229.000000C0004C8000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000002.1822420580.000000C0001F7000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000003.1814431335.00000145E3200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: EKAHephXb2.exe, 00000000.00000002.1824849229.000000C0004C8000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000002.1822420580.000000C0001F7000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000003.1814431335.00000145E3200000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 68677325h	3_2_0045259A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 2EE0190Fh	3_2_00452844
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_0041FA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0043D040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, ecx	3_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_004330D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_0044D0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0043C0DE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push 00000040h	3_2_0042C143
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_00431170
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-10h]	3_2_0043B1C3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00448180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044F260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00433330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	3_2_00456330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [esp]	3_2_004203C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004203C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004203C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_004233D8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, eax	3_2_0041E395
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042B450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	3_2_0042D425
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0043D4F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 2EE8D390h	3_2_0044F530
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then dec eax	3_2_004135E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_004155F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000130h]	3_2_004216C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	3_2_0043A6A1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+30h], edi	3_2_004547C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+7Ch]	3_2_0043D7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0043D7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0043D7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_0042A7F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00437860
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000178h]	3_2_0042B832
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_0041FA1F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00416A30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	3_2_0044FAC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044FAC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0043CAA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx]	3_2_00439ABB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, dword ptr [esp]	3_2_0041BB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_00452BCC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esp]	3_2_00455B90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 0633C81Dh	3_2_00433C4D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00453C20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	3_2_0042BCC5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_00422CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp dword ptr [0045D7ECh]	3_2_0043ACB6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_00422D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, eax	3_2_00439D5A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-10h]	3_2_0043AD66
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_0041ED30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	3_2_00424E0F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00435EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00435EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00435EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00435EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	3_2_00438EA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_00438EA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_00423F0E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	3_2_00420F18
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	3_2_00434FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055893 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop) : 192.168.2.9:60539 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055885 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop) : 192.168.2.9:51149 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055891 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop) : 192.168.2.9:59173 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055881 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop) : 192.168.2.9:63593 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055879 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop) : 192.168.2.9:50213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055895 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop) : 192.168.2.9:49284 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055887 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop) : 192.168.2.9:51217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055883 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop) : 192.168.2.9:60987 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49714 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49714 -> 104.21.16.12:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: reggwardssdqw.shop
Source: Malware configuration extractor	URLs: eemmbryequo.shop
Source: Malware configuration extractor	URLs: tryyudjasudqo.shop
Source: Malware configuration extractor	URLs: keennylrwmqlw.shop
Source: Malware configuration extractor	URLs: tendencctywop.shop
Source: Malware configuration extractor	URLs: licenseodqwmqn.shop
Source: Malware configuration extractor	URLs: relaxatinownio.shop
Source: Malware configuration extractor	URLs: tesecuuweqo.shop

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 104.21.16.12 104.21.16.12

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: tendencctywop.shop
Source: global traffic	DNS traffic detected: DNS query: keennylrwmqlw.shop
Source: global traffic	DNS traffic detected: DNS query: licenseodqwmqn.shop
Source: global traffic	DNS traffic detected: DNS query: tesecuuweqo.shop
Source: global traffic	DNS traffic detected: DNS query: relaxatinownio.shop
Source: global traffic	DNS traffic detected: DNS query: reggwardssdqw.shop
Source: global traffic	DNS traffic detected: DNS query: eemmbryequo.shop
Source: global traffic	DNS traffic detected: DNS query: tryyudjasudqo.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gravvitywio.store

Source: EKAHephXb2.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: EKAHephXb2.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: EKAHephXb2.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: EKAHephXb2.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: EKAHephXb2.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://earth.google.com/kml/2.0
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://earth.google.com/kml/2.1
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://earth.google.com/kml/2.2
Source: EKAHephXb2.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: EKAHephXb2.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: EKAHephXb2.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: EKAHephXb2.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: EKAHephXb2.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: EKAHephXb2.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: EKAHephXb2.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: EKAHephXb2.exe	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C00015A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/gml
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/gml/3.2
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/gml/3.3/exr
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/kml/2.2
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.topografix.com/GPX/1/1
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: EKAHephXb2.exe	String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: BitLockerToGo.exe, 00000003.00000003.1847574186.00000000005B4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: BitLockerToGo.exe, 00000003.00000003.1847574186.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/apib
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: EKAHephXb2.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictCount
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900p
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: EKAHephXb2.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: EKAHephXb2.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.9:49714 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004443D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004443D0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004443D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004443D0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1825888626.000000C000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041F3E0	3_2_0041F3E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041FA80	3_2_0041FA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041CD30	3_2_0041CD30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041FF36	3_2_0041FF36
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00411000	3_2_00411000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042E010	3_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00456010	3_2_00456010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00418140	3_2_00418140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044A160	3_2_0044A160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044B122	3_2_0044B122
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043B1C3	3_2_0043B1C3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00453180	3_2_00453180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00454212	3_2_00454212
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004112DD	3_2_004112DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004382B0	3_2_004382B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00450340	3_2_00450340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433330	3_2_00433330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00456330	3_2_00456330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004203C0	3_2_004203C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004233D8	3_2_004233D8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041A3F0	3_2_0041A3F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004533B0	3_2_004533B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424444	3_2_00424444
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043946D	3_2_0043946D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043948B	3_2_0043948B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042F490	3_2_0042F490
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004135E0	3_2_004135E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044B650	3_2_0044B650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004546D0	3_2_004546D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004536F0	3_2_004536F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00456690	3_2_00456690
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004547C0	3_2_004547C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043D7E0	3_2_0043D7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004557E0	3_2_004557E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00434780	3_2_00434780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004177A0	3_2_004177A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004357AE	3_2_004357AE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00437860	3_2_00437860
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042B832	3_2_0042B832
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043A8AD	3_2_0043A8AD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D8B0	3_2_0041D8B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043B970	3_2_0043B970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043890E	3_2_0043890E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00419A5B	3_2_00419A5B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041FA1F	3_2_0041FA1F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044FAC0	3_2_0044FAC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00454AF0	3_2_00454AF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041AA90	3_2_0041AA90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00439ABB	3_2_00439ABB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041BB00	3_2_0041BB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00418B20	3_2_00418B20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00452BCC	3_2_00452BCC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424B8D	3_2_00424B8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433C4D	3_2_00433C4D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042DC23	3_2_0042DC23
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00453C20	3_2_00453C20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042BCC5	3_2_0042BCC5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00455CD0	3_2_00455CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00420CE0	3_2_00420CE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00422CA0	3_2_00422CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00422D50	3_2_00422D50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00439D5A	3_2_00439D5A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414D00	3_2_00414D00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041ED30	3_2_0041ED30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00418DFD	3_2_00418DFD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00416D80	3_2_00416D80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424E0F	3_2_00424E0F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00419E80	3_2_00419E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00435EA0	3_2_00435EA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00438EA9	3_2_00438EA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00423F0E	3_2_00423F0E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041AFF0	3_2_0041AFF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044EFB0	3_2_0044EFB0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0041E010 appears 182 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0041C640 appears 64 times

Source: EKAHephXb2.exe

Static PE information: Number of sections : 12 > 10

Source: EKAHephXb2.exe, 00000000.00000002.1824849229.000000C0004C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs EKAHephXb2.exe
Source: EKAHephXb2.exe, 00000000.00000000.1358938721.00007FF6CD3C8000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameProjectOverviewP. vs EKAHephXb2.exe
Source: EKAHephXb2.exe, 00000000.00000002.1822420580.000000C0001F7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs EKAHephXb2.exe
Source: EKAHephXb2.exe, 00000000.00000003.1814431335.00000145E3200000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs EKAHephXb2.exe
Source: EKAHephXb2.exe	Binary or memory string: OriginalFilenameProjectOverviewP. vs EKAHephXb2.exe

Source: 00000000.00000002.1825888626.000000C000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal99.troj.evad.winEXE@3/0@10/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_004330D0 CoCreateInstance,

3_2_004330D0

Source: C:\Users\user\Desktop\EKAHephXb2.exe

File created: C:\Users\Public\Libraries\egabm.scif

Jump to behavior

Source: C:\Users\user\Desktop\EKAHephXb2.exe

File opened: C:\Windows\system32\65a273b3cd66a6a4bd7cab6abfe637daac675d2498d30b024507bdf6a671ab50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: EKAHephXb2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\EKAHephXb2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EKAHephXb2.exe, 00000000.00000000.1357843651.00007FF6CC9F5000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: SelectExprDprotobuf:"bytes,5,opt,name=select_expr,json=selectExpr,proto3,oneof"P*func(context.Context, string, *net.TCPAddr, *net.TCPAddr) (*net.TCPConn, error)P*struct { *promhttp.responseWriterDelegator; http.Hijacker; http.CloseNotifier }P*struct { *promhttp.responseWriterDelegator; io.ReaderFrom; http.CloseNotifier }P*func([]uint8, protoreflect.Value, uint64, impl.marshalOptions) ([]uint8, error)P*struct { F uintptr; X0 impl.Converter; X1 impl.offset; X2 reflect.StructField }P*struct { F uintptr; X0 impl.offset; X1 reflect.StructField; X2 impl.Converter }P*struct { F uintptr; X0 reflect.Type; X1 map[reflect.Type]*impl.coderFieldInfo }P*struct { F uintptr; X0 reflect.Type; X1 reflect.Type; X2 *impl.coderFieldInfo }

Source: EKAHephXb2.exe

ReversingLabs: Detection: 47%

Source: EKAHephXb2.exe	String found in binary or memory: EyzcLWJeHl/load.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/brianvoe/gofakeit@v3.18.0+incompatible/data/address.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/xo/terminfo@v0.0.0-20210125001918-ca9a967f8778/load.go
Source: EKAHephXb2.exe	String found in binary or memory: net/addrselect.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: EKAHephXb2.exe	String found in binary or memory: 0-9a-zA-Z]^data:((?:\w+\/(?:([^;]\|;[^;]).)+)?)accessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzbytes.Reader.ReadAt: negative offsetlfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: EKAHephXb2.exe	String found in binary or memory: 0-9a-zA-Z]^data:((?:\w+\/(?:([^;]\|;[^;]).)+)?)accessing a corrupted shared library444089209850062616169452667236328125ryuFtoaFixed64 called with prec > 180123456789abcdefghijklmnopqrstuvwxyzbytes.Reader.ReadAt: negative offsetlfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: EKAHephXb2.exe	String found in binary or memory: net/addrselect.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/brianvoe/gofakeit@v3.18.0+incompatible/data/address.go
Source: EKAHephXb2.exe	String found in binary or memory: github.com/xo/terminfo@v0.0.0-20210125001918-ca9a967f8778/load.go
Source: EKAHephXb2.exe	String found in binary or memory: EyzcLWJeHl/load.go

Source: C:\Users\user\Desktop\EKAHephXb2.exe

File read: C:\Users\user\Desktop\EKAHephXb2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\EKAHephXb2.exe "C:\Users\user\Desktop\EKAHephXb2.exe"
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\EKAHephXb2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior

Source: EKAHephXb2.exe

Static PE information: certificate valid

Source: EKAHephXb2.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: EKAHephXb2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: EKAHephXb2.exe

Static file information: File size 14931192 > 1048576

Source: EKAHephXb2.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x47da00
Source: EKAHephXb2.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x8f1600

Source: EKAHephXb2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: EKAHephXb2.exe, 00000000.00000002.1824849229.000000C0004C8000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000002.1822420580.000000C0001F7000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000003.1814431335.00000145E3200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: EKAHephXb2.exe, 00000000.00000002.1824849229.000000C0004C8000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000002.1822420580.000000C0001F7000.00000004.00001000.00020000.00000000.sdmp, EKAHephXb2.exe, 00000000.00000003.1814431335.00000145E3200000.00000004.00001000.00020000.00000000.sdmp

Source: EKAHephXb2.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\EKAHephXb2.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7636

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: EKAHephXb2.exe, 00000000.00000002.1827188067.00000145BDA68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllEEH
Source: BitLockerToGo.exe, 00000003.00000003.1847574186.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EKAHephXb2.exe	Binary or memory string: depgithub.com/vmware/govmomiv0.43.0h1:7Kg3Bkdly+TrE67BYXzRq7ZrDnn7xqpKX95uEh2f9Go=
Source: BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXl^%SystemRoot%\system32\mswsock.dllll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00451C60 LdrInitializeThunk,

3_2_00451C60

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\EKAHephXb2.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 410000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\EKAHephXb2.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 410000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tryyudjasudqo.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eemmbryequo.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reggwardssdqw.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: relaxatinownio.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tesecuuweqo.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tendencctywop.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licenseodqwmqn.shop
Source: EKAHephXb2.exe, 00000000.00000002.1826819388.000000C000800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keennylrwmqlw.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\EKAHephXb2.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 410000			Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 36C008			Jump to behavior

Source: C:\Users\user\Desktop\EKAHephXb2.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Users\user\Desktop\EKAHephXb2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EKAHephXb2.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Go Injector

Source: Yara match	File source: EKAHephXb2.exe, type: SAMPLE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.7ff6cc510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.EKAHephXb2.exe.7ff6cc510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1831653920.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1357843651.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EKAHephXb2.exe PID: 7256, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.BitLockerToGo.exe.410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c000830000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e31a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0007da000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c000830000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0009f8000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e3200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0009f8000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e31a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e3200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1798475742.00000145E3200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1822185696.00000145E31A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1826819388.000000C0009F8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Go Injector

Source: Yara match	File source: EKAHephXb2.exe, type: SAMPLE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.7ff6cc510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.EKAHephXb2.exe.7ff6cc510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1831653920.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1357843651.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EKAHephXb2.exe PID: 7256, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.BitLockerToGo.exe.410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c000830000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e31a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.BitLockerToGo.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0007da000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c000830000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0009f8000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e3200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EKAHephXb2.exe.c0009f8000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e31a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.EKAHephXb2.exe.145e3200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1798475742.00000145E3200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1822185696.00000145E31A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1826819388.000000C0009F8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
EKAHephXb2.exe	47%	ReversingLabs	Win64.Trojan.Lumma

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://www.certum.pl/CPS0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	unknown
gravvitywio.store	104.21.16.12	true	true	unknown
tryyudjasudqo.shop	unknown	unknown	true	unknown
keennylrwmqlw.shop	unknown	unknown	true	unknown
reggwardssdqw.shop	unknown	unknown	true	unknown
tesecuuweqo.shop	unknown	unknown	true	unknown
tendencctywop.shop	unknown	unknown	true	unknown
eemmbryequo.shop	unknown	unknown	true	unknown
licenseodqwmqn.shop	unknown	unknown	true	unknown
relaxatinownio.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
reggwardssdqw.shop	true		unknown
licenseodqwmqn.shop	true		unknown
relaxatinownio.shop	true		unknown
keennylrwmqlw.shop	true		unknown
tendencctywop.shop	true		unknown
https://gravvitywio.store/api	true		unknown
tryyudjasudqo.shop	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
tesecuuweqo.shop	true		unknown
eemmbryequo.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection=broadcasts	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/golang/protobuf/issues/1609):	EKAHephXb2.exe	false		unknown
https://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/cevcsca2021.cer0	EKAHephXb2.exe	false		unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/	BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.opengis.net/gml	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema	EKAHephXb2.exe	false		unknown
http://www.topografix.com/GPX/1/1	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com02	EKAHephXb2.exe	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.opengis.net/gml/3.2	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.certum.pl/ctnca2.crl0l	EKAHephXb2.exe	false		unknown
http://repository.certum.pl/ctnca2.cer09	EKAHephXb2.exe	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gravvitywio.store/apib	BitLockerToGo.exe, 00000003.00000003.1847574186.00000000005E0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900p	BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://store.steampowered.com/legal/	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certum.pl/CPS0	EKAHephXb2.exe	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cevcsca2021.ocsp-certum.com07	EKAHephXb2.exe	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	EKAHephXb2.exe	false		unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.certum.pl/CPS0	EKAHephXb2.exe	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://earth.google.com/kml/2.2	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://earth.google.com/kml/2.0	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://earth.google.com/kml/2.1	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C00015A000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	BitLockerToGo.exe, 00000003.00000002.1848029410.0000000000592000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848237703.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.opengis.net/kml/2.2	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/mobile	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.opengis.net/gml/3.3/exr	EKAHephXb2.exe, 00000000.00000002.1822420580.000000C000106000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.1848156519.00000000005CF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847749596.00000000005CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://protobuf.dev/reference/go/faq#namespace-conflictCount	EKAHephXb2.exe	false		unknown
https://store.steampowered.com/about/	BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	BitLockerToGo.exe, 00000003.00000003.1847540143.0000000000635000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.000000000062B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1838124879.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1847574186.0000000000597000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false
104.21.16.12	gravvitywio.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524040
Start date and time:	2024-10-02 15:03:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EKAHephXb2.exe renamed because original name is a hash value
Original Sample Name:	c0faa9469b975c6abf8305f713c91740a455f7e17f49cb4c21c801f432bd5baf.exe
Detection:	MAL
Classification:	mal99.troj.evad.winEXE@3/0@10/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target EKAHephXb2.exe, PID 7256 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: EKAHephXb2.exe

Simulations

Behavior and APIs

Time	Type	Description
09:04:59	API Interceptor	3x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
104.21.16.12	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	b222.txt.ps1	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gravvitywio.store	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.16.12
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.16.12
steamcommunity.com	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	b222.txt.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.16.12
	35Mcl9DxHR.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.188.210
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.209.193
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	l5pPoBu9i3.exe	Get hash	malicious	Unknown	Browse	172.67.178.253
AKAMAI-ASUS	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	62-3590.pdf	Get hash	malicious	Unknown	Browse	96.17.64.189

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	IGAnbXyZVx.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	N65c8rwdal.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	BW4pTs1x3V.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	7wN7BF7WfX.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.254 104.21.16.12
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 104.21.16.12
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254 104.21.16.12
	FA_41_09_2024_.PDF	Get hash	malicious	Unknown	Browse	104.102.49.254 104.21.16.12

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	4.830729905091574
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	EKAHephXb2.exe
File size:	14'931'192 bytes
MD5:	6cf54ce259904e8ee54d521a8c85aff1
SHA1:	7ebab8469454f1954b8fec645b921f316eda9ddc
SHA256:	c0faa9469b975c6abf8305f713c91740a455f7e17f49cb4c21c801f432bd5baf
SHA512:	b55625ef2a266706ff2fae5cd0188ef96eb387ca7ccb94bc4e443d12cfe3b96a1e74d0324905ea0614be70d41b9afb0141ba04c9b0a44c5ac3410e03c71054fa
SSDEEP:	98304:UK2GjzKGnxmpstkpzqEDfeIoUZJx1Jn0F:RjzKGnxmpsi3D/oUZbQ
TLSH:	82E62743F9A184E8D1EAE234842682527B71BC488B3477D73E60F7682F76BD49E78750
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..G......*.............@.............................@............`... ............................

File Icon


Icon Hash:	72d280daeaea9282

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x40473380, 0x1, 0x40473350, 0x1, 0x40476df0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	09/09/2024 05:06:13 09/09/2025 05:06:12
Subject Chain	CN="Guizhou Sixuanda Technology Co., Ltd.", O="Guizhou Sixuanda Technology Co., Ltd.", L=Guiyang, S=Guizhou, C=CN, SERIALNUMBER=91520100MA6DNNXK11, OID.1.3.6.1.4.1.311.60.2.1.1=Guiyang, OID.1.3.6.1.4.1.311.60.2.1.2=Guizhou, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	62A1343435FC5131E11FA8C871BB3A1B
Thumbprint SHA-1:	A3AFF46C5F8E2A1F750C570698B864E75553E61F
Thumbprint SHA-256:	87D45B86DFCC84C5EF8338026C26F34935DBAA383A7DD583F48675AF77C957A4
Serial:	332576FE101609502C23F70055B4A3BE

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00DD48B5h]
mov dword ptr [eax], 00000001h
call 00007F75E1086C8Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00DD4895h]
mov dword ptr [eax], 00000000h
call 00007F75E1086C6Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F75E1503C2Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F75E1086FA9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and ch, byte ptr [edx+56h]
bound esi, dword ptr [esi]
push ebx
imul eax, dword ptr [ecx+58h], 58504878h
xor eax, 6F37335Fh
jbe 00007F75E1087014h
pop edi
das
inc esi
xor bl, byte ptr [eax+4Ah]
jno 00007F75E1087048h
dec ebx
push edi
xor byte ptr [edx+75h], bl
popad
inc ecx
inc ebp
dec ecx
xor al, 59h
jno 00007F75E1087014h
dec eax
das
inc ebx
outsd
imul esi, dword ptr [ecx], 4D717044h
dec ecx
xor eax, 76324656h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xe82000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe83000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe87000	0x33f37	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xdd7000	0x16f08	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe3ac00	0x28f8	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xebb000	0x18444	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xdd56e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe83494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x47d920	0x47da00	27639484d6b4fd263d96f43eb0443cc9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x47f000	0x65630	0x65800	7a3d1f08862f32438a0ca4bf87947330	False	0.3186768780788177	dBase III DBT, version number 0, next free block index 10, 1st item "v1.55.5\011h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU="	4.749889327624667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4e5000	0x8f1530	0x8f1600	88e86c504a8b4fdbb7152476181d4217	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xdd7000	0x16f08	0x17000	90b818f56df6142d7b94831b08d83bf2	False	0.4005073879076087	data	5.614854376371168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xdee000	0xc60	0xe00	f2508531996480262c64bae3c9847688	False	0.2592075892857143	data	3.9907836852218073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xdef000	0x92940	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xe82000	0x4e	0x200	65d8bd324a4202b0eb24be92fc3f05e7	False	0.1328125	data	0.8387805141107897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0xe83000	0x1458	0x1600	8143fc91ba82984bf7904c00dc334661	False	0.2979403409090909	data	4.330348852151198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xe85000	0x70	0x200	a39c638c7af9362556ef51f04516fbf3	False	0.08203125	data	0.47139462148086453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe86000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe87000	0x33f37	0x34000	d774dfb232a96941c11db519b165f705	False	0.11916879507211539	data	4.062299694259735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xebb000	0x18444	0x18600	6522fe013e61a1c70af63cd04b5c16df	False	0.23966346153846155	data	5.437380138681292	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe87168	0x3334c	Device independent bitmap graphic, 225 x 450 x 32, image size 202500			0.11429388767044912
RT_GROUP_ICON	0xeba4b4	0x14	data			1.2
RT_VERSION	0xeba4c8	0x348	data	English	United States	0.42738095238095236
RT_MANIFEST	0xeba810	0x727	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4265428727471327

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x140e80b70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T15:04:59.984970+0200	2055891	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tendencctywop .shop)	1	192.168.2.9	59173	1.1.1.1	53	UDP
2024-10-02T15:05:00.174781+0200	2055881	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (keennylrwmqlw .shop)	1	192.168.2.9	63593	1.1.1.1	53	UDP
2024-10-02T15:05:00.186584+0200	2055883	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licenseodqwmqn .shop)	1	192.168.2.9	60987	1.1.1.1	53	UDP
2024-10-02T15:05:00.202113+0200	2055893	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tesecuuweqo .shop)	1	192.168.2.9	60539	1.1.1.1	53	UDP
2024-10-02T15:05:00.219342+0200	2055887	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatinownio .shop)	1	192.168.2.9	51217	1.1.1.1	53	UDP
2024-10-02T15:05:00.232835+0200	2055885	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reggwardssdqw .shop)	1	192.168.2.9	51149	1.1.1.1	53	UDP
2024-10-02T15:05:00.248127+0200	2055879	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eemmbryequo .shop)	1	192.168.2.9	50213	1.1.1.1	53	UDP
2024-10-02T15:05:00.259045+0200	2055895	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tryyudjasudqo .shop)	1	192.168.2.9	49284	1.1.1.1	53	UDP
2024-10-02T15:05:02.469562+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49714	104.21.16.12	443	TCP
2024-10-02T15:05:02.469562+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49714	104.21.16.12	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 15:05:00.286151886 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.286205053 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:00.286276102 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.289611101 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.289638996 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:00.929264069 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:00.929341078 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.932215929 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.932240009 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:00.932472944 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:00.986675978 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:00.988133907 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.035406113 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420403957 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420423985 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420430899 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420453072 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420465946 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420469999 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.420501947 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.420520067 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.420520067 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.420545101 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.519568920 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.519599915 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.519682884 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.519718885 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.519938946 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.525491953 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.525597095 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.525621891 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.525639057 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.525684118 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.526659966 CEST	49713	443	192.168.2.9	104.102.49.254
Oct 2, 2024 15:05:01.526678085 CEST	443	49713	104.102.49.254	192.168.2.9
Oct 2, 2024 15:05:01.545108080 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:01.545156002 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:01.545229912 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:01.545547962 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:01.545567036 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.006975889 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.007057905 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.008430004 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.008440018 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.008651018 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.009782076 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.009802103 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.009841919 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.469424963 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.469495058 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.469561100 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.469729900 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.469744921 CEST	443	49714	104.21.16.12	192.168.2.9
Oct 2, 2024 15:05:02.469764948 CEST	49714	443	192.168.2.9	104.21.16.12
Oct 2, 2024 15:05:02.469769955 CEST	443	49714	104.21.16.12	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 15:04:59.984970093 CEST	59173	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.171308041 CEST	53	59173	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.174781084 CEST	63593	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.184256077 CEST	53	63593	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.186583996 CEST	60987	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.198352098 CEST	53	60987	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.202112913 CEST	60539	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.216495991 CEST	53	60539	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.219341993 CEST	51217	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.231165886 CEST	53	51217	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.232835054 CEST	51149	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.242408037 CEST	53	51149	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.248126984 CEST	50213	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.257658005 CEST	53	50213	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.259044886 CEST	49284	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.268677950 CEST	53	49284	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:00.270220995 CEST	57683	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:00.280997992 CEST	53	57683	1.1.1.1	192.168.2.9
Oct 2, 2024 15:05:01.537107944 CEST	61210	53	192.168.2.9	1.1.1.1
Oct 2, 2024 15:05:01.544358969 CEST	53	61210	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 15:04:59.984970093 CEST	192.168.2.9	1.1.1.1	0xd0fc	Standard query (0)	tendencctywop.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.174781084 CEST	192.168.2.9	1.1.1.1	0x5e01	Standard query (0)	keennylrwmqlw.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.186583996 CEST	192.168.2.9	1.1.1.1	0x401e	Standard query (0)	licenseodqwmqn.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.202112913 CEST	192.168.2.9	1.1.1.1	0x63ff	Standard query (0)	tesecuuweqo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.219341993 CEST	192.168.2.9	1.1.1.1	0x6fe4	Standard query (0)	relaxatinownio.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.232835054 CEST	192.168.2.9	1.1.1.1	0x6f9d	Standard query (0)	reggwardssdqw.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.248126984 CEST	192.168.2.9	1.1.1.1	0xfceb	Standard query (0)	eemmbryequo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.259044886 CEST	192.168.2.9	1.1.1.1	0x6eb3	Standard query (0)	tryyudjasudqo.shop	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.270220995 CEST	192.168.2.9	1.1.1.1	0x48d7	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:01.537107944 CEST	192.168.2.9	1.1.1.1	0x6bd9	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 15:05:00.171308041 CEST	1.1.1.1	192.168.2.9	0xd0fc	Name error (3)	tendencctywop.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.184256077 CEST	1.1.1.1	192.168.2.9	0x5e01	Name error (3)	keennylrwmqlw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.198352098 CEST	1.1.1.1	192.168.2.9	0x401e	Name error (3)	licenseodqwmqn.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.216495991 CEST	1.1.1.1	192.168.2.9	0x63ff	Name error (3)	tesecuuweqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.231165886 CEST	1.1.1.1	192.168.2.9	0x6fe4	Name error (3)	relaxatinownio.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.242408037 CEST	1.1.1.1	192.168.2.9	0x6f9d	Name error (3)	reggwardssdqw.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.257658005 CEST	1.1.1.1	192.168.2.9	0xfceb	Name error (3)	eemmbryequo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.268677950 CEST	1.1.1.1	192.168.2.9	0x6eb3	Name error (3)	tryyudjasudqo.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:00.280997992 CEST	1.1.1.1	192.168.2.9	0x48d7	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:01.544358969 CEST	1.1.1.1	192.168.2.9	0x6bd9	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:05:01.544358969 CEST	1.1.1.1	192.168.2.9	0x6bd9	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

gravvitywio.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49713	104.102.49.254	443	7616	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 13:05:00 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 13:05:01 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 13:05:01 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=19494ceecad7d9d584ec9c17; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 13:05:01 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 13:05:01 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 13:05:01 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 13:05:01 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49714	104.21.16.12	443	7616	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 13:05:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 13:05:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 13:05:02 UTC	780	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 13:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rl3vni8n12u932bp03n48aaole; expires=Sun, 26 Jan 2025 06:51:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3L0cAhyFRmRQ9ElLKllPwH0hvZYS7Ql26N8XK%2F%2BsIP%2BHuRqvN4cNAE%2BspDvR2bnh0RjSkWgPjrEBPyIpY%2Bbn9Ty24va8IEyZ8GypGgyymN%2FHL7Veooy2H8NyB5m5GLOSEVL8Yw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc4e6d41ea0de9a-EWR
2024-10-02 13:05:02 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 13:05:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:04:12
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\EKAHephXb2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EKAHephXb2.exe"
Imagebase:	0x7ff6cc510000
File size:	14'931'192 bytes
MD5 hash:	6CF54CE259904E8EE54D521A8C85AFF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1826819388.000000C000830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1798475742.00000145E3200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1822185696.00000145E31A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1826819388.000000C0009F8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1825888626.000000C000644000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1826819388.000000C000930000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000002.1831653920.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000000.00000000.1357843651.00007FF6CD034000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:04:59
Start date:	02/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0x860000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.5%
Total number of Nodes:	40
Total number of Limit Nodes:	3

Executed Functions

Function 0041F3E0 Relevance: 15.4, Strings: 12, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

lCzA, xrefs: 0041F5CA
D{?y, xrefs: 0041F62E
\#^!, xrefs: 0041F57A
/W+U, xrefs: 0041F5FC
}KxI, xrefs: 0041F5B6
++), xrefs: 0041F566
_;\9, xrefs: 0041F58E
/kJi, xrefs: 0041F606
e?A=, xrefs: 0041F598
|S.Q, xrefs: 0041F5F2
['O%, xrefs: 0041F584
o/^-, xrefs: 0041F570

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ++)$/W+U$/kJi$D{?y$['O%$\#^!$_;\9$e?A=$lCzA$o/^-$|S.Q$}KxI
API String ID: 0-931747256
Opcode ID: f5f56df9342fcd1a9cd2fb18e6fac8a62c68859c57b4f18fc8facd74345dfb02
Instruction ID: 49036b443f29988aa3e0e3c927521378c4053922764103fcfd2da94d6bcf0724
Opcode Fuzzy Hash: f5f56df9342fcd1a9cd2fb18e6fac8a62c68859c57b4f18fc8facd74345dfb02
Instruction Fuzzy Hash: F6F135B5101B018FD334CF26C895B97BBF2FB88315F158A2CD5AA8BA90D7B4A445CF85

Function 0041FA80 Relevance: 11.5, Strings: 9, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_], xrefs: 0041FB07
W[, xrefs: 0041FBDD
3K:I, xrefs: 0041FAEF
[ Y, xrefs: 0041FB0F
U7O5, xrefs: 0041FCA3
:W&U, xrefs: 0041FAF7
J?>=, xrefs: 0041FCB9
F3O1, xrefs: 0041FCAE
]+Q), xrefs: 0041FC98

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: _]$3K:I$:W&U$F3O1$J?>=$U7O5$W[$]+Q)$[ Y
API String ID: 0-530895100
Opcode ID: e1d34efcca7db37855918542ef890547264a481a4b70ed4dcdc34c7986943a26
Instruction ID: 271cd6e182c93c7386f7e427a1129d538f99ec81da1b273cd7f58dc36afccb47
Opcode Fuzzy Hash: e1d34efcca7db37855918542ef890547264a481a4b70ed4dcdc34c7986943a26
Instruction Fuzzy Hash: 0DC120B51083809BD324DF15C980B9FBBF6EB95700F158A2CE6C96B251D7B4A846CF87

Function 0041CD30 Relevance: 6.2, APIs: 4, Instructions: 202
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0041CD41
GetCurrentThreadId.KERNEL32 ref: 0041CD56
GetCurrentProcessId.KERNEL32 ref: 0041CD5C
ExitProcess.KERNEL32 ref: 0041CFA5

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: b7b90a192c43b6f0d4c73386c068b3e4a9edc03558faba2bd755775010bd2da6
Instruction ID: 70dc50ac7719a2fa17f309c0c24034b83de819d401ea5ab27c2a43cad3b59415
Opcode Fuzzy Hash: b7b90a192c43b6f0d4c73386c068b3e4a9edc03558faba2bd755775010bd2da6
Instruction Fuzzy Hash: 1F61487560C2409BD305EF28D990A1EBBE2EBA5700F19892EE4C9C7352D739DC91CB56

Function 0041FF36 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

47, xrefs: 004201CD

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 47
API String ID: 0-1112425479
Opcode ID: 48407a84c29cb20b49ef5f601fc0e0c6ce236ef539891f557817b7f10f3863e2
Instruction ID: 1f427d304f0647e18c09f324250426f206e4e3119660b3e267d585edf26f09e1
Opcode Fuzzy Hash: 48407a84c29cb20b49ef5f601fc0e0c6ce236ef539891f557817b7f10f3863e2
Instruction Fuzzy Hash: EEA155B1108301DFD304DF25E890A2BBBF5EF89316F04896DF88987262E778D955CB5A

Function 00451C60 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(004554DC,005C003F,00000006,?,?,00000018,94959A9B,?,?), ref: 00451C8E

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00452844 Relevance: 1.4, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00452895

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: be4c001c0f3a90c001ad7bb9045242525751572264af7759edc85055dcb86075
Instruction ID: 9b7abcd93900c70311db8a24e574e8b9275ec013b4d618913e76b6c2940d5305
Opcode Fuzzy Hash: be4c001c0f3a90c001ad7bb9045242525751572264af7759edc85055dcb86075
Instruction Fuzzy Hash: 4F6191B0A002198FDB14CF54C9917BFB7B2FF59305F18801AD901AB366E379AD15CBA9

Function 0045259A Relevance: 1.3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sgh, xrefs: 00452620

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: %sgh
API String ID: 0-2311733779
Opcode ID: e74d144db168266885ca29bcbe0232159fcf435d5961c7b11c60cbc128c0cb2d
Instruction ID: 8c3a2d6add3ac19f3e0d0d0223700f066ffc019949632e526ce27837e123c50d
Opcode Fuzzy Hash: e74d144db168266885ca29bcbe0232159fcf435d5961c7b11c60cbc128c0cb2d
Instruction Fuzzy Hash: 5221A635E002199FDB10CF98C941BAEB7B2FB46701F654116E911B7391D3B1BE05CB98

Function 0041FA1F Relevance: .2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1186b1032d364957fd9c8153d6ef55906090ff67cf76ac78f51f8f02748703c9
Instruction ID: c53fbffbf4a5cfca03b088f70957c755bb7b9893064fecdcb79c6f487741acad
Opcode Fuzzy Hash: 1186b1032d364957fd9c8153d6ef55906090ff67cf76ac78f51f8f02748703c9
Instruction Fuzzy Hash: 13717B72508300DFD324DF64D88066BBBF6EB89311F09892DE98A93262D774EC55CB86

Function 00451B92 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9>?, xrefs: 00451C17, 00451BD6

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 9>?
API String ID: 0-4148619561
Opcode ID: 786046ce91eb2b1a929eec8c8952b5af7f3cf2414413d6c40b684358ec24ba57
Instruction ID: 054137d52b5c52f6caa0c88096c7831e16e3aa3b88e323dd401c7a1bc6bee4c2
Opcode Fuzzy Hash: 786046ce91eb2b1a929eec8c8952b5af7f3cf2414413d6c40b684358ec24ba57
Instruction Fuzzy Hash: 17113A75909310CBE314AF19D94171AB793AFC5306F08CE2DD8C453319D27AEC45C683

Function 0044E998 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0044EA2F

Strings

FD, xrefs: 0044EA40

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: FD
API String ID: 3298025750-1901455307
Opcode ID: 0fdc43503a8ad3f57f4836a152fb9e475052957f75c191d69b8c05aa931641c7
Instruction ID: e551385f9902787493755ee05f5b30d339c679c890efe7d52f876232ab7502b5
Opcode Fuzzy Hash: 0fdc43503a8ad3f57f4836a152fb9e475052957f75c191d69b8c05aa931641c7
Instruction Fuzzy Hash: B911A0B560C2008BD70DDF15D96072AB7E2ABD5305F29CA6CD4C6473A5CA349812CB46

Function 0044E8E0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,004560FC,?), ref: 0044E95A

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 858bc18d236ac92f74f19951d9486866c67f704c721e953bc6ed1c937e85e1ac
Instruction ID: cbba98d53bba190b3da556fd89b2f2fb9957f4c85a9dd9453aa459d6a9e8f5a5
Opcode Fuzzy Hash: 858bc18d236ac92f74f19951d9486866c67f704c721e953bc6ed1c937e85e1ac
Instruction Fuzzy Hash: 1B01E4702082419BD305EF18C590A1ABBE1FB99700F548D5DE4C5872A2D23AEC65CB56

Non-executed Functions

Function 0042BCC5 Relevance: 45.3, Strings: 35, Instructions: 1552COMMON

Download Yara Rule

Strings

$%&h, xrefs: 0042CD94
TUVW, xrefs: 0042CF90
XYZ[, xrefs: 0042CD89
h, xrefs: 0042CE4F
0123, xrefs: 0042CFF3
tuvw, xrefs: 0042CD10
<=>?, xrefs: 0042CDD6
PQRS, xrefs: 0042CF64
(fed, xrefs: 0042CDB5
@ABC, xrefs: 0042CD47
HIJK, xrefs: 0042CD5D
hijk, xrefs: 0042CD05
cba/, xrefs: 0042CDAA
xyz{, xrefs: 0042CD31
(, xrefs: 0042D1C1
PQRS, xrefs: 0042CD73
,-., xrefs: 0042D02A
DEFG, xrefs: 0042CD3C
LMNO, xrefs: 0042CD52
SRQP, xrefs: 0042CE2E
{567, xrefs: 0042CDC0
hABC, xrefs: 0042CFC7
{?Z1, xrefs: 0042C1B8
LMNO, xrefs: 0042CF59
wvut, xrefs: 0042CDE1
TUVW, xrefs: 0042CD68
defg, xrefs: 0042CCE4
!"#, xrefs: 0042D01F
0123, xrefs: 0042CDCB
`abc, xrefs: 0042CCEF
#"! , xrefs: 0042CCFA
?>=<, xrefs: 0042CD1B
GFED, xrefs: 0042CE0D
!"l, xrefs: 0042CD9F
Tk, xrefs: 0042D94E

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: !"#$ !"l$#"! $$%&h$($(fed$,-.$0123$0123$<=>?$?>=<$@ABC$DEFG$GFED$HIJK$LMNO$LMNO$PQRS$PQRS$SRQP$TUVW$TUVW$Tk$XYZ[$`abc$cba/$defg$h$hABC$hijk$tuvw$wvut$xyz{${567${?Z1
API String ID: 0-3305218618
Opcode ID: 4b89d460b78324f3e1457da59078bdc0ddbdb3bd99ad8dc0b04799cbeecfcb48
Instruction ID: d1aa8b643424e4835b237762a0c49a2c7cd7c1714d665a2fcf7d62f5bce7f345
Opcode Fuzzy Hash: 4b89d460b78324f3e1457da59078bdc0ddbdb3bd99ad8dc0b04799cbeecfcb48
Instruction Fuzzy Hash: 61D266B06083918BE720DF18D884BAFBBF1FFC5344F54892EE4998B251D7399845CB96

Function 00435EA0 Relevance: 30.9, Strings: 24, Instructions: 937COMMON

Download Yara Rule

Strings

s3l=, xrefs: 00436820
Mx, xrefs: 00436E78
9;, xrefs: 00436B97
S{, xrefs: 00436CEE
Fs8q, xrefs: 00436F27
c#t%, xrefs: 0043713A
<k2i, xrefs: 00436F51
{y, xrefs: 00436CFC
h;n=, xrefs: 00437126
|v, xrefs: 00436CF5
-/, xrefs: 00436BB5
sx, xrefs: 00436A40
CN, xrefs: 00436D03
a=}?, xrefs: 00436D50
#{/y, xrefs: 00436F35
d7e9, xrefs: 0043711C
=?, xrefs: 00436B8D
5g e, xrefs: 00436F4A
b?g9, xrefs: 0043696E
s3b5, xrefs: 00437112
~+V-, xrefs: 0043714E
w"u, xrefs: 00436F2E
~?l!, xrefs: 00437130
c1m3, xrefs: 00436D49

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: w"u$#{/y$5g e$<k2i$CN$Fs8q$Mx$S{$a=}?$b?g9$c#t%$c1m3$d7e9$h;n=$s3b5$s3l=$sx${y$|v$~+V-$~?l!$-/$9;$=?
API String ID: 0-3545685031
Opcode ID: 2fad3a659d5c5541de2af27c2862927c52f4b037bd43c41292888056447c6db8
Instruction ID: 8ab496a0b3dc24378b6ac767c22d01fbe5061bbc2d94e427230fde42d99ff7c0
Opcode Fuzzy Hash: 2fad3a659d5c5541de2af27c2862927c52f4b037bd43c41292888056447c6db8
Instruction Fuzzy Hash: 32B21DB4901B55CFE724CF2AD98079ABBF1FB05304F508A5CD0AAABB51C774A486CF85

Function 0043D7E0 Relevance: 21.2, APIs: 2, Strings: 8, Instructions: 3667COMMON

Download Yara Rule

Strings

JJCD, xrefs: 0043E000
HWCF, xrefs: 0043FF26
6690, xrefs: 0043D99C
:\Bw, xrefs: 0043E32E
MP"T, xrefs: 0043F677
MaV%, xrefs: 0043D80B
AJPP, xrefs: 0043F2CA
v]kk, xrefs: 0043E34C

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 6690$:\Bw$AJPP$HWCF$JJCD$MP"T$MaV%$v]kk
API String ID: 0-3602916885
Opcode ID: 6e36241391bd83a35c955c98b5a62ae743f01ba0c66c562c9680970324c8d117
Instruction ID: 75ca100b7ecb0b1478b4a1791c99cc012f187feba46da5e6b46e9eba1f147ff5
Opcode Fuzzy Hash: 6e36241391bd83a35c955c98b5a62ae743f01ba0c66c562c9680970324c8d117
Instruction Fuzzy Hash: 3B53D170505B818BE329CF35C5A07A3BBE1AF5A305F14896ED4EB87782D739B409CB54

Function 0042E010 Relevance: 16.2, Strings: 12, Instructions: 1209COMMON

Download Yara Rule

Strings

Kx|E, xrefs: 0042E688
i}:i, xrefs: 0042E59B
qw, xrefs: 0042E1E2
ym, xrefs: 0042E1EA
vn, xrefs: 0042E1F2
GEF~, xrefs: 0042E639
T, xrefs: 0042EA01
(, xrefs: 0042E9E1
dt|`, xrefs: 0042E58B
,+, xrefs: 0042E29D
tu, xrefs: 0042E117
./ii, xrefs: 0042E5F6

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ,+$./ii$GEF~$Kx|E$T$dt|`$i}:i$qw$tu$vn$ym$(
API String ID: 0-2308901425
Opcode ID: 62eca4acedf3baed05b67ac0e1a35ebabfac4c71cc1f3bf1d41ea3f158f4896f
Instruction ID: 88df5ee8f48b56bab514c6c3cc7d0d6d9ce33a45908c7b5031becad76fdfce86
Opcode Fuzzy Hash: 62eca4acedf3baed05b67ac0e1a35ebabfac4c71cc1f3bf1d41ea3f158f4896f
Instruction Fuzzy Hash: C782CC7160C3508FD314DF29D49066BFBE2AF96304F588E2DE0C58B392E7399945CB9A

Function 0043946D Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(3<<3,31F43FF9,00000000), ref: 0043956A

Strings

wdML, xrefs: 004396E8
4`[b, xrefs: 00439850
3<<3, xrefs: 004396EF
&PiD, xrefs: 004396DA
cK_+, xrefs: 004396D3
$TG2, xrefs: 004396E1
/T,^, xrefs: 004396CC
3<<3, xrefs: 00439566, 00439569, 0043957F

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $TG2$&PiD$/T,^$3<<3$3<<3$4`[b$cK_+$wdML
API String ID: 1304948518-2727919925
Opcode ID: 45e03523c6845f75b7a035d327ae1c2bff0937aa63dc7966eb29de3e4136fd57
Instruction ID: ca69138a189668305d93e0764e258fd252f9cb4813e38b1136fb9675cc4405da
Opcode Fuzzy Hash: 45e03523c6845f75b7a035d327ae1c2bff0937aa63dc7966eb29de3e4136fd57
Instruction Fuzzy Hash: 62A1A8B5D00219DFDB24CF58D850BAEBBB1FF49301F1440A9E449BB292D774AA41CFA9

Function 0043948B Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 255fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(3<<3,31F43FF9,00000000), ref: 0043956A

Strings

wdML, xrefs: 004396E8
4`[b, xrefs: 00439850
3<<3, xrefs: 004396EF
&PiD, xrefs: 004396DA
cK_+, xrefs: 004396D3
$TG2, xrefs: 004396E1
/T,^, xrefs: 004396CC
3<<3, xrefs: 00439566, 00439569, 0043957F

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $TG2$&PiD$/T,^$3<<3$3<<3$4`[b$cK_+$wdML
API String ID: 1304948518-2727919925
Opcode ID: b6aa96df1678b904b60ec6cec20db8f00c8adbb78f7ed179be14482c37c3d572
Instruction ID: 0a6386fa325f45efdf26a84cd1c30383c900ab09ad23e53a4e5a66b957af989f
Opcode Fuzzy Hash: b6aa96df1678b904b60ec6cec20db8f00c8adbb78f7ed179be14482c37c3d572
Instruction Fuzzy Hash: 1CA1A7B9D00219DFDB24CF58D850BAEBBB1FF89301F1440A9D449AB391D774AA41CFA9

Function 00433C4D Relevance: 15.0, Strings: 11, Instructions: 1265COMMON

Download Yara Rule

Strings

tJC, xrefs: 00434A56
"GC, xrefs: 0043470D
UA, xrefs: 00434F0F
"CC, xrefs: 0043431A
BEC, xrefs: 00434526
dGC, xrefs: 00433D40
PE, xrefs: 00433C52
TZ, xrefs: 00434F16
{, xrefs: 004347B6
~, xrefs: 004347BD
%v, xrefs: 004347C4

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ~$"CC$"GC$%v$BEC$PE$TZ$UA$dGC$tJC${
API String ID: 0-2334507809
Opcode ID: ed6d2cd2bbf4d426a93cc2220dba6bf90e8379e306ce58c11ddc66ec53e0d9dd
Instruction ID: 2f8eda47341fe525b301d3960993603abca4b3409275b64f9071e8c0d8877165
Opcode Fuzzy Hash: ed6d2cd2bbf4d426a93cc2220dba6bf90e8379e306ce58c11ddc66ec53e0d9dd
Instruction Fuzzy Hash: F6A2DFB5E0021ACFDB14CFA8D890AAEB7B2FF49301F14416DE855AB391D738A951CF94

Function 00411000 Relevance: 13.0, Strings: 9, Instructions: 1791COMMON

Download Yara Rule

Strings

-, xrefs: 00411EC2
gfff, xrefs: 00411FC4
gfff, xrefs: 00411F17
@, xrefs: 00412E65
gfff, xrefs: 00411F7E
0, xrefs: 00411BCA
A, xrefs: 0041157B
0123456789abcdefxp, xrefs: 00411582, 00411630
0123456789ABCDEFXP, xrefs: 00411573, 00411620

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: -$0$0123456789ABCDEFXP$0123456789abcdefxp$@$A$gfff$gfff$gfff
API String ID: 0-706159343
Opcode ID: 3da7df43c72dc5c184542d929a179778043b15896403ae765bf15dce41323a54
Instruction ID: 82077965fc0e05a0530c78ccb3034e36cb465e863eba303fd04a9366f27da827
Opcode Fuzzy Hash: 3da7df43c72dc5c184542d929a179778043b15896403ae765bf15dce41323a54
Instruction Fuzzy Hash: E6D2E5716083518FD714CF28C4903ABBBE2ABC9314F188A2EE995D7391D379DD85CB86

Function 0044B122 Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 502memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0044B1C2
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0044B20E
SysAllocString.OLEAUT32(09650B65), ref: 0044B28E
SysAllocString.OLEAUT32(09650B65), ref: 0044B34F
SysFreeString.OLEAUT32(00000000), ref: 0044B3C3

Strings

\_, xrefs: 0044B2F8
4`[b, xrefs: 0044B810

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: String$Alloc$BlanketFreeProxy
String ID: 4`[b$\_
API String ID: 2892228535-3318095926
Opcode ID: aa4269017f66bc3064278c975296c18fa1264b08f66de6994d41e78f7beb13b0
Instruction ID: 409d13bb1f4c96984df76a676b2f78b3566141fcec03c16d9bc60f363ce3b941
Opcode Fuzzy Hash: aa4269017f66bc3064278c975296c18fa1264b08f66de6994d41e78f7beb13b0
Instruction Fuzzy Hash: 6F028774608340DFE314DF28D891B2EB7E2FB89705F54882DE5C5872A2DB79D815CB4A

Function 004443D0 Relevance: 9.1, APIs: 6, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004443F2
GetWindowLongW.USER32 ref: 0044441D
GetClipboardData.USER32 ref: 00444432
CloseClipboard.USER32 ref: 00444533

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: e59914b03057e0921427343f977ec86f85c0864ac4034d4ebae71ee9385df05a
Instruction ID: 89b15b1008024b0e7219c22e43c06132caad40ba6a79140fda528b8e302ec443
Opcode Fuzzy Hash: e59914b03057e0921427343f977ec86f85c0864ac4034d4ebae71ee9385df05a
Instruction Fuzzy Hash: 2341B4B09087828FDB10AB7C984536FBFE0AB56320F048A6DE4E6873C2D3349905C767

Function 004203C0 Relevance: 8.1, Strings: 6, Instructions: 602COMMON

Download Yara Rule

Strings

QyFg, xrefs: 00420475
6, xrefs: 004205F6
21, xrefs: 004205EB
HI, xrefs: 00420B6C
dki, xrefs: 00420748
;9, xrefs: 004205E0

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 21$6$;9$HI$QyFg$dki
API String ID: 0-388788806
Opcode ID: 8e4c28ba032a3c0dadea57c0268dad9969cf0b99492ef8a1c0e3e19820dcbb48
Instruction ID: c54e067ef221666ab88c7328419614e8ee53da1797c606bbe63257cf88e5bc95
Opcode Fuzzy Hash: 8e4c28ba032a3c0dadea57c0268dad9969cf0b99492ef8a1c0e3e19820dcbb48
Instruction Fuzzy Hash: 933266B420C381DFD328DF15D8A1B6BBBE1EB85344F54892DE1CA8B261D7389845CB5A

Function 00434780 Relevance: 7.9, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

tJC, xrefs: 00434A56
UA, xrefs: 00434F0F
TZ, xrefs: 00434F16
{, xrefs: 004347B6
~, xrefs: 004347BD
%v, xrefs: 004347C4

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ~$%v$TZ$UA$tJC${
API String ID: 0-442212474
Opcode ID: 20b07d47708e833bea6c1aa4eb83c9b3cba26fe7b853dc6429e612a30507a8ad
Instruction ID: b7746535db5a27c06371e0f81fa7f0317bad2a9747cbbc1ad7f483b1d57810ad
Opcode Fuzzy Hash: 20b07d47708e833bea6c1aa4eb83c9b3cba26fe7b853dc6429e612a30507a8ad
Instruction Fuzzy Hash: 2BE1BEF8A0020ADFDB04CFA5D985AAEBBB1FF49304F24451DE415AB741D738A911CFA6

Function 004216C7 Relevance: 7.8, Strings: 6, Instructions: 278COMMON

Download Yara Rule

Strings

T;%, xrefs: 004219DB
ft~, xrefs: 00421793
P?Q9, xrefs: 004219D0
.'&!, xrefs: 004219E6
~pv, xrefs: 00421788
tr, xrefs: 00421936

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: .'&!$P?Q9$T;%$ft~$tr$~pv
API String ID: 0-330529406
Opcode ID: c088e675831dc25292d2c6096b997bb0531387f0ff7682f41f52504c1287accd
Instruction ID: da4d60ad9a65d82bee81af65e1ca07b15af6f369e0e273f2bb66a687692fa3ae
Opcode Fuzzy Hash: c088e675831dc25292d2c6096b997bb0531387f0ff7682f41f52504c1287accd
Instruction Fuzzy Hash: D9B1897551E3908AD331CF25C49878BBBE1ABDA354F588A4CD8CC5B311C7389A4ACB97

Function 004112DD Relevance: 7.2, Strings: 5, Instructions: 907COMMON

Download Yara Rule

Strings

0, xrefs: 0041221E
0, xrefs: 00412460
0, xrefs: 00412121
i, xrefs: 00412884
u, xrefs: 00411738

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$i$u
API String ID: 0-2578075383
Opcode ID: 4b942c983ae29275cb0e890cd9593218aab462d75cafc3d2a6a331db285c9f3c
Instruction ID: 9e781c265de8ea662b02f0d00ea87a01145e81901440f75493ddbfb8e4589570
Opcode Fuzzy Hash: 4b942c983ae29275cb0e890cd9593218aab462d75cafc3d2a6a331db285c9f3c
Instruction Fuzzy Hash: A8620771A083519FC314CE28C69039BBBE1ABD5704F148A6EE8D9D7391D3B8DD85CB86

Function 00454212 Relevance: 6.1, Strings: 4, Instructions: 1089COMMON

Download Yara Rule

Strings

, xrefs: 00454D95, 00454D4F, 00454D8A, 00454D64, 00454D60
\P, xrefs: 00454866
"DE, xrefs: 00454411
rPE, xrefs: 00455067

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $"DE$\P$rPE
API String ID: 0-409153937
Opcode ID: bd76749ca034abf0ebbd836625413f9842bfe9443f789b04cd89c8a3538d466c
Instruction ID: 999c1b8a06f098c1245c646eaaa82c5bc6c952ac6a9a76bc348a7a486977e6e2
Opcode Fuzzy Hash: bd76749ca034abf0ebbd836625413f9842bfe9443f789b04cd89c8a3538d466c
Instruction Fuzzy Hash: 3372EE76A08216CFCB04CF68D89066EB3F1FB89305F1A887DD885A7351D374AD55CB86

Function 004233D8 Relevance: 5.6, Strings: 4, Instructions: 650COMMON

Download Yara Rule

Strings

N, xrefs: 00423A1D
R_B, xrefs: 00423E4A
tW, xrefs: 00423D16
EK6, xrefs: 004239BE

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: EK6$N$R_B$tW
API String ID: 0-3496575853
Opcode ID: f33bce1ee630e1e1dab4eee58ce6f760c8dd9629da2d112734f204306aa7dfca
Instruction ID: 24489c57b10ec65bc0cca19b8665c549a8655aeb89f98428aeb21524e28f673f
Opcode Fuzzy Hash: f33bce1ee630e1e1dab4eee58ce6f760c8dd9629da2d112734f204306aa7dfca
Instruction Fuzzy Hash: 3522D0B16083908BD714CF24D89076BBBF2EFD6304F48496DE48A87352DB79D909CB96

Function 00437860 Relevance: 5.6, Strings: 4, Instructions: 561COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00437C40
4`[b, xrefs: 00438000
4`[b, xrefs: 00437EF0
L!&', xrefs: 00437A29

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$4`[b$4`[b$L!&'
API String ID: 0-1623617353
Opcode ID: 96a53b1bb5f47f84edcff84cfe020d0e1968aa91a9328d27dc80ec230776a55d
Instruction ID: b18e35ab88695871041c8063d43c72aee32ae6604652b73bdfddafd505d6efb9
Opcode Fuzzy Hash: 96a53b1bb5f47f84edcff84cfe020d0e1968aa91a9328d27dc80ec230776a55d
Instruction Fuzzy Hash: FE12BBB4508340DFD728DF14D8A1A2BB7E1FF89345F54882DE5C6873A2E739A805CB4A

Function 0041ED30 Relevance: 5.5, Strings: 4, Instructions: 508COMMON

Download Yara Rule

Strings

KQ, xrefs: 0041EEB5
J0:N, xrefs: 0041F18D
US, xrefs: 0041EE15
LC, xrefs: 0041EEBD

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: J0:N$KQ$LC$US
API String ID: 0-3443655503
Opcode ID: 0db40935ebf73c697427c7f11b1f54043ef6fb1b1813f773978fa4dcbb3e4f8b
Instruction ID: 09c3dfed99070943aef6a34b9976ff34888579d1e83908058d8a4ab4ca9f8f3b
Opcode Fuzzy Hash: 0db40935ebf73c697427c7f11b1f54043ef6fb1b1813f773978fa4dcbb3e4f8b
Instruction Fuzzy Hash: 9B02DFB560C3408BD314CF18C4906AFBBE2AFC9714F18896EE4D99B351D739D94ACB4A

Function 004547C0 Relevance: 4.5, Strings: 3, Instructions: 737COMMON

Download Yara Rule

Strings

, xrefs: 00454D95, 00454D4F, 00454D8A, 00454D64, 00454D60
\P, xrefs: 00454866
rPE, xrefs: 00455067

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $\P$rPE
API String ID: 0-2271232275
Opcode ID: 19960aee2916e1a526f3414ef50ddf9413ce76da417b31ec0b4212f85976536d
Instruction ID: b419569ffdbf8a02ea7da6850a187c5ff5e46cd8b7bfb323c10936261184f29d
Opcode Fuzzy Hash: 19960aee2916e1a526f3414ef50ddf9413ce76da417b31ec0b4212f85976536d
Instruction Fuzzy Hash: 2B32DD35A08215CFCB08CF28D8A066FB7F2FB89305F09896ED88697351D774AD55CB86

Function 004546D0 Relevance: 4.5, Strings: 3, Instructions: 711COMMON

Download Yara Rule

Strings

, xrefs: 00454D95, 00454D4F, 00454D8A, 00454D64, 00454D60
\P, xrefs: 00454866
rPE, xrefs: 00455067

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $\P$rPE
API String ID: 0-2271232275
Opcode ID: 2248642cbeeafbd83c9140d896c66875e15d8a26ac1c9a9e203e5ba33ffb9848
Instruction ID: 5ff264943c8cc54e2b1b87fa2534bc9f52be89dc63c73582ee4479819cd4ebb8
Opcode Fuzzy Hash: 2248642cbeeafbd83c9140d896c66875e15d8a26ac1c9a9e203e5ba33ffb9848
Instruction Fuzzy Hash: 9E32D935A08211CFCB08CF28D89066FB7F2FB89305F09896ED88697352D774E855CB86

Function 00454AF0 Relevance: 4.3, Strings: 3, Instructions: 521COMMON

Download Yara Rule

Strings

, xrefs: 00454D95, 00454D4F, 00454D8A, 00454D64, 00454D60
, xrefs: 00454BD1
rPE, xrefs: 00455067

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $$rPE
API String ID: 0-1537306017
Opcode ID: b49012dface025da97e73c3b1034bb34807c0a4b6756b31d981573d2b76692a1
Instruction ID: 6e7d9c8e0f74b3352e6e996f763d7618d8db4a03e2de4f81d930075a39c8b48c
Opcode Fuzzy Hash: b49012dface025da97e73c3b1034bb34807c0a4b6756b31d981573d2b76692a1
Instruction Fuzzy Hash: 01F1FE35A08215CFCB08CF68D8A066FB7F2FB89305F19886DD88697352D734AD55CB86

Function 00418140 Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

), xrefs: 004181BC
IEND, xrefs: 0041858C
), xrefs: 004181C6

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: aae953ee41d85b09ea637577d14186aedfa39c53bb94a95bac89a1f1ea6d6f87
Instruction ID: 73ba0b6f2c9193cb5338d824c2e13da21037cb2bbdd904228fb6a164cdd187aa
Opcode Fuzzy Hash: aae953ee41d85b09ea637577d14186aedfa39c53bb94a95bac89a1f1ea6d6f87
Instruction Fuzzy Hash: C4E1F2B1A087019FD314CF29C88079BBBE0BB94304F14452EF99597391DB79E995CBCA

Function 00434FD0 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

W{5y, xrefs: 00435196
(ca, xrefs: 0043510D
|~, xrefs: 00434FE4

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: (ca$W{5y$|~
API String ID: 0-1952870986
Opcode ID: 828f974aa349eca70c3f68cec0807ff9774cbc318484b1999d72694f0429b2db
Instruction ID: d668a6e97ce41d5df961cf65496046fac0408875cc1c1cc09bceaed83f919f45
Opcode Fuzzy Hash: 828f974aa349eca70c3f68cec0807ff9774cbc318484b1999d72694f0429b2db
Instruction Fuzzy Hash: 837163B41083409FD314EF19C490A2EBBF1EB9A744F549A1CE1D51B3A1C7799905CF9A

Function 0043B1C3 Relevance: 3.1, Strings: 2, Instructions: 628COMMON

Download Yara Rule

Strings

_;:9, xrefs: 0043B602
}K, xrefs: 0043B75B

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: _;:9$}K
API String ID: 0-1012618580
Opcode ID: 9fe089f97c973e06a29486ea9dad7bd4586b3f83105c5e511f51a7041990c938
Instruction ID: f51f9cc7c935e5a51a6baff7ca707b8d64064a9f0646d1cc2b3aa2f62cf70e50
Opcode Fuzzy Hash: 9fe089f97c973e06a29486ea9dad7bd4586b3f83105c5e511f51a7041990c938
Instruction Fuzzy Hash: 6B32A2B5E006298FDB08DF98C891AAEFB72FF89304F54855DD8266B395C7349802CBD5

Function 00418DFD Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

0, xrefs: 0041988D
8, xrefs: 00419885

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: b75e4450074bb070e547e4a318034edc2cf343d1ead9d7f8d904dc219592ef7a
Instruction ID: 790fd01d0ac8c273d4c1e7f238581cb59e02e91825a91ddc96986147d5dcf325
Opcode Fuzzy Hash: b75e4450074bb070e547e4a318034edc2cf343d1ead9d7f8d904dc219592ef7a
Instruction Fuzzy Hash: 4A426530608340DFD714CF28D85479ABBE1BF89305F08896DE4898B3A2C7B9D995CF96

Function 0042C143 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.OLE32(?,000000FF,000000FF,000000FF,00000006,00000003,00000000,00000040), ref: 0042C116
CoSetProxyBlanket.OLE32(?,000000FF,000000FF,000000FF,00000006,00000003,00000000,Function_0001C120), ref: 0042C135

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2ed0b0bf36697ddc924432dcd7777ecbcc4825d4ed5456e5589f7de8cbbdd387
Instruction ID: 2a60112fb3140011b2d6a2d2b43a584c3af917fc9c217c69f6ee94b8e6bc2985
Opcode Fuzzy Hash: 2ed0b0bf36697ddc924432dcd7777ecbcc4825d4ed5456e5589f7de8cbbdd387
Instruction Fuzzy Hash: C5F0E57068C712FEFB340B24AC16F0576A2A747B32F345324B235781F68AB195108A0D

Function 00433330 Relevance: 3.0, Strings: 2, Instructions: 496COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00433850
#"=, xrefs: 004335D2

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: #"=$4`[b
API String ID: 0-183199367
Opcode ID: 2f8166cc1495a082907515f28dc03fe8076a52c56d09c1438d2384ceff336242
Instruction ID: 0b8286b667a2a7c356e7ec9a661f0ad008b845d3d56a29dfbfcfbe7b2ce6955b
Opcode Fuzzy Hash: 2f8166cc1495a082907515f28dc03fe8076a52c56d09c1438d2384ceff336242
Instruction Fuzzy Hash: F7E111B56082009BD714DF28C891A2BB7E1EF99315F08A92DF4C6C7351E739DE41CB9A

Function 004135E0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

NaN, xrefs: 00413648
Inf, xrefs: 00413641

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 769331b506ba8bd61d3ab35cfcdc80fefc4ecb686d89c305c722d403aebd5747
Instruction ID: 9d85162939b3d73ddb9fa6e0b5de8a159686af335518cba9efecd4ef89363d49
Opcode Fuzzy Hash: 769331b506ba8bd61d3ab35cfcdc80fefc4ecb686d89c305c722d403aebd5747
Instruction Fuzzy Hash: DFD129B2A183019BC704CF28C88065BB7E5EFC8750F258A3EF89997391E775DD458B86

Function 0041D8B0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

, xrefs: 0041DA72
xy, xrefs: 0041DD74

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $xy
API String ID: 0-1879942264
Opcode ID: 3e7caed486b8b898e9d27077d52ed70f096631fe81e8302264c852b3302ca259
Instruction ID: 681c1ef3a77d42104c554bce78c70d1e19611dbeff15a69beda281e4362eb7eb
Opcode Fuzzy Hash: 3e7caed486b8b898e9d27077d52ed70f096631fe81e8302264c852b3302ca259
Instruction Fuzzy Hash: 28E153B060C3809BD314EF19D490A6FBBE2EF95744F14891EE1C98B352D739D846CB9A

Function 00423F0E Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

", xrefs: 00424202
J1, xrefs: 00424032

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "$J1
API String ID: 0-1332998432
Opcode ID: 717b84f1d1b4d0aa476fa47916ab833481111acf08f14d9df5af7f091af42965
Instruction ID: 77dee06d7033e6bd90089a0e0d1f23d1588be2a2cfd544188485330bff91e4aa
Opcode Fuzzy Hash: 717b84f1d1b4d0aa476fa47916ab833481111acf08f14d9df5af7f091af42965
Instruction Fuzzy Hash: 58D147B46083809BD364CF24D981BAFF7E6EFC5704F44882DE48987252E778E849CB56

Function 0043C0DE Relevance: 2.8, Strings: 2, Instructions: 336COMMON

Download Yara Rule

Strings

XXZ, xrefs: 0043C2F3
>ZVB, xrefs: 0043C2EB

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: >ZVB$XXZ
API String ID: 0-1040703691
Opcode ID: be67e9a37fec9c162cc65b6a149b729149a76e56b3aba1b220eed938636dead5
Instruction ID: 5e451e605560981ffbf685aca71a6fc59a02beaa6c7da3c0ed5694dc81432a2f
Opcode Fuzzy Hash: be67e9a37fec9c162cc65b6a149b729149a76e56b3aba1b220eed938636dead5
Instruction Fuzzy Hash: B9B1BD721083858FC311CF39C89066ABFE2AF96314F585A9DF0E49B3A2C735D949CB46

Function 00424444 Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

@1, xrefs: 004244C1
z, xrefs: 0042472D

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: @1$z
API String ID: 0-3737219330
Opcode ID: 26dcfd3224af9f3c3cbb885badf90b4e0fe6a27c1660b9ccc5fb19c921f9ffef
Instruction ID: 99e8406b5a06fd71cf1475f1978d0ed1d704625d72431c32eabdb926689560ef
Opcode Fuzzy Hash: 26dcfd3224af9f3c3cbb885badf90b4e0fe6a27c1660b9ccc5fb19c921f9ffef
Instruction Fuzzy Hash: 80C167B56083809BD364CF24D991B5FB7E2EFC5704F14892EE88987351EB78D849CB4A

Function 0042DC23 Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

?4, xrefs: 0042DF68
4`[b, xrefs: 0042DE80

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ?4$4`[b
API String ID: 0-3194672840
Opcode ID: 7976b533a6c11a01d0444dcc914dc7dc1beaea6541ece79d09f303d9c7dd384c
Instruction ID: fe2a72a1c16f5346a5f28d2a09956cf805c07021eb6e0ca21332dc109734af64
Opcode Fuzzy Hash: 7976b533a6c11a01d0444dcc914dc7dc1beaea6541ece79d09f303d9c7dd384c
Instruction Fuzzy Hash: A291CE706083508BE324DF18E8987AFB7F1FF86345F44492EE58587262D73A9941CB8B

Function 0043AD66 Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

\], xrefs: 0043ADE1
AJ, xrefs: 0043ADD3

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: AJ$\]
API String ID: 0-3722789656
Opcode ID: fb710ed8db8b0af347a07cbcfa26b5cc7142dfa57a2215b73a6e2a8a13f04b9d
Instruction ID: 7ea8f2709e6df63223d2cfbc507ab7c3cf94182bf222ef244d787fdfb551d8e2
Opcode Fuzzy Hash: fb710ed8db8b0af347a07cbcfa26b5cc7142dfa57a2215b73a6e2a8a13f04b9d
Instruction Fuzzy Hash: C191BEB4940216CFDB14CF94C8A17BFB7B1FF4A314F145549E892AB395E3389811CB99

Function 00419A5B Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

0, xrefs: 0041988D
8, xrefs: 00419885

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: c31b6a292e239e74d7b5868cf998a00541d2232f05964cad994897bcd8b879a4
Instruction ID: 41ea6b9bdcb93e438d15cc10f61c83f2d03e6e60f2e4b95bcb0746a554e4b28d
Opcode Fuzzy Hash: c31b6a292e239e74d7b5868cf998a00541d2232f05964cad994897bcd8b879a4
Instruction Fuzzy Hash: 20814235219384DFC700CF28D494A8EBBE1AF99314F49896DF8C487362C679D999CF52

Function 00424E0F Relevance: 2.0, Strings: 1, Instructions: 778COMMON

Download Yara Rule

Strings

]G, xrefs: 004255E1

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ]G
API String ID: 0-2792678869
Opcode ID: ae63cf84e5c0976c4d31def68a76c71e8155187a37208182465765fe79fd4972
Instruction ID: dd606a446c5dc3c127dfe09f15042436af04ecd1030e67f38bc12fcd61bb4f44
Opcode Fuzzy Hash: ae63cf84e5c0976c4d31def68a76c71e8155187a37208182465765fe79fd4972
Instruction Fuzzy Hash: 0A32ADB16083909BD314DF28D890A2FB7E2FFC5304F55492EE49987351E778D849CB5A

Function 0042B832 Relevance: 2.0, APIs: 1, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307949a4f390b3df15bc669a2483ce121abbfc0f41d874a3c1bfd551dd2184d4
Instruction ID: 7b4d5a0d98a4300bc0526d534dbf44dc3267ae1dc3a8c063433f3c396e97021a
Opcode Fuzzy Hash: 307949a4f390b3df15bc669a2483ce121abbfc0f41d874a3c1bfd551dd2184d4
Instruction Fuzzy Hash: B1F1EEB16083518FD724CF28D8917AFBBE1EF86304F58492EE49987352D739D845CB8A

Function 0044FAC0 Relevance: 1.9, Strings: 1, Instructions: 694COMMON

Download Yara Rule

Strings

f, xrefs: 0044FCB8

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 83b2027d994bed17e0cdfddc2c15a80d471f6b96e4011267eceef1a5d966481a
Instruction ID: 0c0cec1d83c5a4f6ff7f9a91d047b93fb79d3cfdc08a15c2b10ce0cac194fe7b
Opcode Fuzzy Hash: 83b2027d994bed17e0cdfddc2c15a80d471f6b96e4011267eceef1a5d966481a
Instruction Fuzzy Hash: 1F3291756083419FD714CF28C890B2BB7E2EB89314F18892EF895C7392D739E849CB56

Function 00414D00 Relevance: 1.8, Strings: 1, Instructions: 569COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00415057

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 91d1f1247741a57da21da6f5f1991baaeafdcfe7032c5c4858af2149b9178f6c
Instruction ID: 31c86f767a84538317bcbf5b513b5d99bf89d4c53de575bc4455c27e0d59c244
Opcode Fuzzy Hash: 91d1f1247741a57da21da6f5f1991baaeafdcfe7032c5c4858af2149b9178f6c
Instruction Fuzzy Hash: F712B372A08B41CBD7158E58D4803E7BBA2AFE1304F1D856FD8954B341E7B9DC86C74A

Function 004330D0 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00458BA0,00000000,00000001,00458B90), ref: 004330F9

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4b6d6b060679144e4abf391f1a28c904377b44d145cc16027412afcdba315d3e
Instruction ID: 8ee346db7a4811bca061dc6bee4dd13d9bcdc9b9fcdb1fefa12f14e9b1944984
Opcode Fuzzy Hash: 4b6d6b060679144e4abf391f1a28c904377b44d145cc16027412afcdba315d3e
Instruction Fuzzy Hash: BC5101B06003049BDB209F24CC86B7773B4EF8975AF089559F9858B391E378EA05C72A

Function 0042F490 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

^TYR, xrefs: 0042F536

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ^TYR
API String ID: 0-2403333924
Opcode ID: b4002723fa5084c260bb06041de4e4132e415b49118c0469249397cddf7f50c4
Instruction ID: 7f6c10b6d583d7125387856d3398120a5788ea5b11e187c3d78635ccba62326d
Opcode Fuzzy Hash: b4002723fa5084c260bb06041de4e4132e415b49118c0469249397cddf7f50c4
Instruction Fuzzy Hash: DFE1BDB56083409BD304EF29D880A5EBBF6EFD4314F98892EE4C887351D738E949CB56

Function 00453C20 Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

P, xrefs: 00453DC4

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: beebeee87d8c133ebcc634bcb241483f916a2ec66c327f41acaf8c098a7b62d2
Instruction ID: d2fab7b08c4142bcf70a4740c8f252c56c624e6f7d02606cf03acd35bb5c4799
Opcode Fuzzy Hash: beebeee87d8c133ebcc634bcb241483f916a2ec66c327f41acaf8c098a7b62d2
Instruction Fuzzy Hash: 49E12832A083604FC715CE18849061FB3E2EBC5359F06863DEDB6AB392C7759D4987C6

Function 0043D040 Relevance: 1.7, Strings: 1, Instructions: 407COMMON

Download Yara Rule

Strings

", xrefs: 0043D368

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: f31a23bacc01a5407d2b86fcea6cd2a57511eadae3e6d24662fecdb0f71f6251
Instruction ID: f64805e045dd63c7355b65540f519c5c73d961cd5d6ec7c081cd081d09439ea3
Opcode Fuzzy Hash: f31a23bacc01a5407d2b86fcea6cd2a57511eadae3e6d24662fecdb0f71f6251
Instruction Fuzzy Hash: 3EC127B2E083045BD7258E24E88076BB7E5AF99314F18952FE89587381E73CEC45C796

Function 004382B0 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

\, xrefs: 00438660

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: \
API String ID: 2994545307-3568076253
Opcode ID: 9b13bbffba7daf6e6ac4cd4da21494b591ef88fa22d2689aa535c009e1e0fed9
Instruction ID: a582b9abc5affa5015abc6b1274d95182525408af83d50f529113b6fccc40ed3
Opcode Fuzzy Hash: 9b13bbffba7daf6e6ac4cd4da21494b591ef88fa22d2689aa535c009e1e0fed9
Instruction Fuzzy Hash: 5FB10F716083019BD714DF18C88062BF7E1EF99304F18592EF9C58B351EB39E945CB9A

Function 0043B970 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0043BCB0

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 3c1a697c463c4b841042622e43e39a9192d2f0cc23b9f8f1beee178966b553c7
Instruction ID: 5b6ba1cb91616380c4b3fd45ee2fb7184f03440a2a317341cc9963ad7e9db575
Opcode Fuzzy Hash: 3c1a697c463c4b841042622e43e39a9192d2f0cc23b9f8f1beee178966b553c7
Instruction Fuzzy Hash: 01D188B410C3809FD324DF19D490B6BBBE1EF8A704F545A1DE6C98B392C7769805CB9A

Function 00438EA9 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00439240

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 7a28e30bb17dda159eb49f1ab6e16c03c9241f2d082b12b47eb1b672965ac7cf
Instruction ID: eb3618badcbfe63de2aab32dc1244193e94b233bec937aa8897428c4c9db0e21
Opcode Fuzzy Hash: 7a28e30bb17dda159eb49f1ab6e16c03c9241f2d082b12b47eb1b672965ac7cf
Instruction Fuzzy Hash: E3B1DCB0D00219DFEB24CFA8E9917AEB771FF46305F1040A9E549AB242E7309E51CF5A

Function 0041A3F0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0041A526

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 040639413158bfdbd14daa81084adcf7a10f414b7e134be0bbf74d28b1857f66
Instruction ID: fb9f94706ef129cf7964bee32a384e9f309f39bb2217ae1836526d538faec1db
Opcode Fuzzy Hash: 040639413158bfdbd14daa81084adcf7a10f414b7e134be0bbf74d28b1857f66
Instruction Fuzzy Hash: 0EB16A711093809FD321CF18C88465BFBE0AFA9704F484E2DE5D997382D675E958CBA7

Function 004533B0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00453550

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 23d6f96a34799fd7db89ef0efd09f1502d9c4f4d3083677d305cfe6280c5d5d8
Instruction ID: a794c3c4144f05bc6dbfe5c355a572a435f41fc9b69ed15ffb9f990f7bed6422
Opcode Fuzzy Hash: 23d6f96a34799fd7db89ef0efd09f1502d9c4f4d3083677d305cfe6280c5d5d8
Instruction Fuzzy Hash: 01810471608301ABD724CF15C850A6BB7E2EFC5396F14892EFD8593392E734E904CB9A

Function 0043D4F0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0043D6EE

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 6f331eaee311c823878c86a3076073f55de4b339334dbe7d9c7b24ae35b63837
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 3771F732E083155BD714CE2CE58031FBBE2ABC9714F29952FE4988B395D338DC49878A

Function 0044F530 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

0, xrefs: 0044F6BD

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4a173d25c7d084d9a497d896eae14b09eb50efb1e122eccc1240a6c66bc1c4bc
Instruction ID: c4fb04e9f7aacc4ed11cf2c4453826f1f4c811a5a6cec1ec68f5183a0fabb12e
Opcode Fuzzy Hash: 4a173d25c7d084d9a497d896eae14b09eb50efb1e122eccc1240a6c66bc1c4bc
Instruction Fuzzy Hash: BC9177B56083029BE714CF08C480B1BBBE2FBC9344F14892EF89487351D738E849CB96

Function 0044B650 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0044B810

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 908e7949b3c1e1c41bc3bd3e2f973716d31be5618c2fdd6570ac847b82259152
Instruction ID: ab9547bc95408c9cb0146c2c2b14426ca1746cfe1c48720dd6cb69491b8b0c87
Opcode Fuzzy Hash: 908e7949b3c1e1c41bc3bd3e2f973716d31be5618c2fdd6570ac847b82259152
Instruction Fuzzy Hash: 61619D71108300EFE314DF25D891B2BB7A6FBD4305F14892EE58687291DB79E815CB9A

Function 00453180 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00453370

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: e9364787b633ce34a50f578eacd71e4e1eae0a9aeefc8c913c96c7868294cceb
Instruction ID: 73d55523663ef1811245f83a19c204da199b324759229686b04c9433500fc24f
Opcode Fuzzy Hash: e9364787b633ce34a50f578eacd71e4e1eae0a9aeefc8c913c96c7868294cceb
Instruction Fuzzy Hash: 955135326082009BC314DE19CC80B2FB7E3EBC8756F19C62DEDE5573A6DA34AD058796

Function 00455B90 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

@, xrefs: 00455BE0

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 23e35e0634e291342369d8b9ec6c760d77509f206f22633ad86587618c103e99
Instruction ID: 8d5f1675c75f8198dfbf83efcd11d088c20099a034c37ffa1ce9c2120508a449
Opcode Fuzzy Hash: 23e35e0634e291342369d8b9ec6c760d77509f206f22633ad86587618c103e99
Instruction Fuzzy Hash: BD3198715083008FD301DF48C88466BF7F5FBC5314F19892EE9C8A7321E375A9098BAA

Function 0043ACB6 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0043AD30

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: d8a47d4a2a4a121bf11138b79dec279bdafd5cd47ba8ea1f54c9750c00588187
Instruction ID: 4040eb58233f6d912315851f01c008f051d03a5ccfe815e95bef4aa3650e2a73
Opcode Fuzzy Hash: d8a47d4a2a4a121bf11138b79dec279bdafd5cd47ba8ea1f54c9750c00588187
Instruction Fuzzy Hash: 55116A34A10254CFCB24CF98D894AAEB7B2FF4D302F54506AE546AB762E734DC51CB89

Function 0041BB00 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42670a10cd1b3a4990c600b2dc7ad877ef23f9a6c8734be28c408b80ad5bc90
Instruction ID: a247fcc3c47c785cf4d237058dc55d90b06fe54110165bbcbe342e5d67ab493d
Opcode Fuzzy Hash: d42670a10cd1b3a4990c600b2dc7ad877ef23f9a6c8734be28c408b80ad5bc90
Instruction Fuzzy Hash: 3D52F8315487118BC725DF18D8802BBB3E1FFC4314F198A2ED9D697385E738A991CB8A

Function 00416D80 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f78c160db201771518049e1bb332d724e9dd64e1c31a73c69a23bba5293b0a
Instruction ID: 0879c5a79ebe7e09645d17db4acd8aad9e42966448e6c4961867df0763b28d61
Opcode Fuzzy Hash: 64f78c160db201771518049e1bb332d724e9dd64e1c31a73c69a23bba5293b0a
Instruction Fuzzy Hash: 8052C33150C3458FCB15CF28C0906EABBF2BF89314F198A6EE89957351D778E989CB85

Function 0041AFF0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3c54692c8f3c41da3af0408b89161bc5116461b27180e3c0dfb23943d29dda
Instruction ID: 79f4616b2384fc4fb6bf6a939cd114b6125311cd7f742aa9459506b22bf9a7bf
Opcode Fuzzy Hash: 1d3c54692c8f3c41da3af0408b89161bc5116461b27180e3c0dfb23943d29dda
Instruction Fuzzy Hash: 0452B5B0A08B888FE735DB24C4847E7BBE1EB95314F14485EC5D606B82D37DA8C5C799

Function 004177A0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c66df15ba4204920b5db36997c20d698051f8806ee994e3f906bf385195448d
Instruction ID: e312588ec874e8885a6f817017a441e06b0079e6d68c80b9b72acdc8c4eedeb9
Opcode Fuzzy Hash: 9c66df15ba4204920b5db36997c20d698051f8806ee994e3f906bf385195448d
Instruction Fuzzy Hash: 3D320670518B118FC368CF29C6905AABBF1BF45710B604A2ED69787F90D73AF885CB18

Function 00422CA0 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4413a51fa73b8dc8f4a4a1b14f49842a5bcb4517984c56fcfd3c2a32f2cf7124
Instruction ID: 5eb498ed7f31b1ee19d85acff159a4ac548551a70cbd72454d3deae687323ba9
Opcode Fuzzy Hash: 4413a51fa73b8dc8f4a4a1b14f49842a5bcb4517984c56fcfd3c2a32f2cf7124
Instruction Fuzzy Hash: 5A1298B52083809BD358CF24E991A6FB7F6EFC5705F44882DE48983252DB38D949CB5B

Function 00422D50 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92afe660301f712af291c94b87fa3541d996f8d7d87067d59a7be8b67e3abc8
Instruction ID: 46fce5a5839b1eea7c5b2ec388f774578e708f994fdfa2292952a4db5c82e512
Opcode Fuzzy Hash: d92afe660301f712af291c94b87fa3541d996f8d7d87067d59a7be8b67e3abc8
Instruction Fuzzy Hash: 2F029AB52083809BD358CF24E991A6FB7F6EFC5705F44882DE48983252DB38D949CB5B

Function 00439ABB Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af1f75f249f0fb1c790d711f2b98d76038a05fd8b62e5d25b09ff9cddcfb1e4
Instruction ID: 933eaf75a4f5b48d64c2953326d7d11e13cf1f7c2a04972b0e6ee8ef5988f658
Opcode Fuzzy Hash: 4af1f75f249f0fb1c790d711f2b98d76038a05fd8b62e5d25b09ff9cddcfb1e4
Instruction Fuzzy Hash: 46F1F271D00215CFDB14CF68D85079EFBB2BF49311F1982A9D454AB392D339AD46CB88

Function 00419E80 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ff3d3d18614b795103daca684522adbaef9ce149cd257e05088adc57babbe9
Instruction ID: bfd3566c6f7d10949e1316e49fe92dbec3125470a12ce2c985fc16286ad37aae
Opcode Fuzzy Hash: 87ff3d3d18614b795103daca684522adbaef9ce149cd257e05088adc57babbe9
Instruction Fuzzy Hash: 0CF1A1316093419FC714CF28C98066BFBE1FF99304F088A6DE9988B352D275D995CB9B

Function 00452BCC Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d6145b855d37f626797a7d351e3e9c4c179e16f0c8df8378dd80667879b32e
Instruction ID: 3eb31f433230f780b8588a0c74063b4ac5df4d3cd859c49db53aefcf750ba919
Opcode Fuzzy Hash: 83d6145b855d37f626797a7d351e3e9c4c179e16f0c8df8378dd80667879b32e
Instruction Fuzzy Hash: 64E15936608251CFC715CF38D99052FB7E2AB86311F19877ED891873A2E774E905CB46

Function 0041AA90 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dce409bdf30fa280f51146af40f6aa769c9dc29fc2cddba1bb908207a44e5f7
Instruction ID: 4b3e49f52c87c837abaafc5ac48995bc955972ba5d7a3daa8be476abf0d93674
Opcode Fuzzy Hash: 1dce409bdf30fa280f51146af40f6aa769c9dc29fc2cddba1bb908207a44e5f7
Instruction Fuzzy Hash: 69F18D76B486428FC728CF24C8517EBB3E2BB85318F18853EC59AC7345EB38A556CB45

Function 004357AE Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3f3bd7754c0672647902585bba409f4cfbe422c8a1bcdc734ec64e2a93f80c
Instruction ID: 3ae2f7d2e2306412572f90026279a0c448232ab06a55964f5566598bc9a2f5b5
Opcode Fuzzy Hash: 3d3f3bd7754c0672647902585bba409f4cfbe422c8a1bcdc734ec64e2a93f80c
Instruction Fuzzy Hash: ABD1DE75E0061ACFCB24CF98C8806AEF7B2FF48300F6585A9D455AB361D734AD52CB94

Function 00450340 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9799bbff02cf92c5a25760a90a4510457fcc31c5932a035b4c222ee9aff2b1c4
Instruction ID: 630e1b14a78e95160c4fda79ce64c8f6ab471fec285de3f4ab8a8f5433171e4d
Opcode Fuzzy Hash: 9799bbff02cf92c5a25760a90a4510457fcc31c5932a035b4c222ee9aff2b1c4
Instruction Fuzzy Hash: 29C1E4756083914FC325CE28C49052EBBE1AFC5315F1986AEECE58B383D639DC49CB96

Function 0043890E Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8e228609abf18747bc16d78053dfd630d696a69a077b08a1400495d70b86f3
Instruction ID: 9cbe7abb8535877f6c2604c857fcb6d227990dca9c177f2de635d3f20ca58184
Opcode Fuzzy Hash: db8e228609abf18747bc16d78053dfd630d696a69a077b08a1400495d70b86f3
Instruction Fuzzy Hash: E4B1D4B5908341CFD714CF28985122BF7E1AF9A305F18596EF4C687342D778E90ACB9A

Function 0042D425 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd9f4b9501894421220475f0b9a886d744e34e2ec62c0f2d30da9f17c791ef2
Instruction ID: a89a3df3213ff57c693854394228a79fb1d9151cace009e7d57835b1c6205a7d
Opcode Fuzzy Hash: 5dd9f4b9501894421220475f0b9a886d744e34e2ec62c0f2d30da9f17c791ef2
Instruction Fuzzy Hash: A0C199B5A083518FD724DF18D8806ABB7F1FFC6304F04492EE8999B252E7399845CB96

Function 004536F0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b3e1e9858e9e9fefa5c08db0c73ea8862f098b4fd6b9eea0c0d3a2fcaf5e79
Instruction ID: 02dfc955f3291dbb2b42cdb77ce6be19ef11085bbd1472f3026db3119cf83ede
Opcode Fuzzy Hash: 83b3e1e9858e9e9fefa5c08db0c73ea8862f098b4fd6b9eea0c0d3a2fcaf5e79
Instruction Fuzzy Hash: EFB129B1A083504BD324DF29C88176BF7E5AB85356F04492EFDD897342E778ED08878A

Function 0043A8AD Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3c1ab4fc4e8f4bdb239d83bd413002cd5800b557c28db58d4adda31e8650de
Instruction ID: 66e843173843c5500d3917514df43c40edb3f340989a05efbad62395efc56ab6
Opcode Fuzzy Hash: 5a3c1ab4fc4e8f4bdb239d83bd413002cd5800b557c28db58d4adda31e8650de
Instruction Fuzzy Hash: 2BB106B1D00216CFCB14CF68C8917AEB7B2FF4A304F1841AAD895AB392D3399D55CB95

Function 00456330 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c08a348d0c28e4319bfaf0ffa8e41b6e88608d5783ae251d3043d1781ccabd
Instruction ID: 2d59611e7786af112c37eaaf84331561b2105f453741a7eb5cdcbff28b5e1492
Opcode Fuzzy Hash: 23c08a348d0c28e4319bfaf0ffa8e41b6e88608d5783ae251d3043d1781ccabd
Instruction Fuzzy Hash: 39A1F0356083069FC714DF18D490A2BB3E2EF85740F59892DEC858B362EB34EC15CB9A

Function 00455CD0 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 98b170e862b3a435ca5385c429524fc7cdc06572ebbcf93b629c1d6befce59d1
Instruction ID: 725560efed747a8c92ce3f5a4959d8871ca0f87243b46bcc0caf52ee4fc0dde6
Opcode Fuzzy Hash: 98b170e862b3a435ca5385c429524fc7cdc06572ebbcf93b629c1d6befce59d1
Instruction Fuzzy Hash: 6291E1326087019BD710DF18C890A2BB7E2EF84741F19892EF88597362E735EC15CB9A

Function 00456010 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8badac05c4aae012919bcba74e40be7a5355787b62cc3163b4615431c12454fc
Instruction ID: 112dc9851fc2d4629d75f3745e0613393a555ceea24d643237316afe145a0efc
Opcode Fuzzy Hash: 8badac05c4aae012919bcba74e40be7a5355787b62cc3163b4615431c12454fc
Instruction Fuzzy Hash: D291F531A083118BD724DF58C480A2BB3A2FF88701F5A896DED8657352E775EC05CB8A

Function 00456690 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eca38f61f7be59cbcc949e9e18dba6dc98d0c7a0f404f6f353da44627f394517
Instruction ID: 0a5090091cafab8f4f635419aa9585460c3038616e800110323301e942b29b4a
Opcode Fuzzy Hash: eca38f61f7be59cbcc949e9e18dba6dc98d0c7a0f404f6f353da44627f394517
Instruction Fuzzy Hash: 1381E0716083008FD718DF08C890A2BB7E2EBD5704F59892EE9D587362D735EC09CB96

Function 0044EFB0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d083f74d7ddea4dd4996710d419bc3a143556b9599630a16db3e599f5ece8ef0
Instruction ID: 46ad20627d1a95e18a4c33d60c337d8968ea56041cc733e8e774b050affc870c
Opcode Fuzzy Hash: d083f74d7ddea4dd4996710d419bc3a143556b9599630a16db3e599f5ece8ef0
Instruction Fuzzy Hash: D171D136A083519BE710CE68C88065BB7E1FB88714F19897EE8D4E7351E379EC088786

Function 00418B20 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edc702c8775b6f5ae71e51e61d07a6724a77c10e34c8ece7ea87827b33faedb
Instruction ID: 4904205e105fb703a37e84f3e61dd0217e69b31b189529378dd5b8557cb44271
Opcode Fuzzy Hash: 2edc702c8775b6f5ae71e51e61d07a6724a77c10e34c8ece7ea87827b33faedb
Instruction Fuzzy Hash: 9F71CC76619302CFD304CF24D85136A77E1FF8931AF098A7DE84587292C739C9A4CB86

Function 00424B8D Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c9439a23ad5595306af4d8a67de2105dadbc887d91e1670ad9e26421fa548f
Instruction ID: f3a363304751aa14dd0efd29595cb5a63df3ca8d64f23ce8678123d33b779984
Opcode Fuzzy Hash: a1c9439a23ad5595306af4d8a67de2105dadbc887d91e1670ad9e26421fa548f
Instruction Fuzzy Hash: F0713A727043228FC714CF29D88066A73E6EFC4320F1D466EE4968B3A1EB38D855C749

Function 0044F260 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51966e731d7109f19b19814ab2650e6c95a5613d859559a6ab28088fe22c26dc
Instruction ID: 508a02ee2b6df8fcde1d64daba8f6e82e15114fbe04e387948d2dc3d9a25d9af
Opcode Fuzzy Hash: 51966e731d7109f19b19814ab2650e6c95a5613d859559a6ab28088fe22c26dc
Instruction Fuzzy Hash: 63518D76A182009BE710CF58C980A2BB7E2EB99704F18C93EE9C5C7315E779E805CB56

Function 0044A160 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c9c027bd38257047cb36b7dd5ff2529e391ccbe41d990fe5246e876f01e5eb
Instruction ID: cb6fd48db4ca50e9b4dfa6718203e1d7b2f0cbfc00c16aea4ff02838b3355d98
Opcode Fuzzy Hash: e6c9c027bd38257047cb36b7dd5ff2529e391ccbe41d990fe5246e876f01e5eb
Instruction Fuzzy Hash: 0D515DB16087548FE314DF69D49475BBBE1BBC4318F044A2EE4E987351E379DA088F86

Function 00439D5A Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e43cdec2544bae85e438eb39a127f456bc93d35db9992241e52efb27b8be29
Instruction ID: 131b6eb7233369008fca20882b6ee19a4f342ca4b634466a167651d6b786504b
Opcode Fuzzy Hash: d2e43cdec2544bae85e438eb39a127f456bc93d35db9992241e52efb27b8be29
Instruction Fuzzy Hash: 3951B171E116148FCB18CF28D891AAEB7F2AF89310F19426ED85AE7391D738ED01CB54

Function 0043A6A1 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b287ea95c9e352c381ae5d09f70ba07d5dd9451547242ee320841cc23f6111
Instruction ID: d1fed85651879c88cd292c4316b4fd4c8830266631abba6a3d0f333a8aaba2bc
Opcode Fuzzy Hash: e4b287ea95c9e352c381ae5d09f70ba07d5dd9451547242ee320841cc23f6111
Instruction Fuzzy Hash: 00512478901716CFCB24CF58C8A17AFB3B1FF4A314F445259E8526B391E738A861CB89

Function 004557E0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67207e7419630ac72310dbed93751e59c1e1c42c1789b69ff6d33a1b03651e90
Instruction ID: 7d736797ebe18f2d8cb4d4722eea6950e6c8e24fffb795f362d26f12f1e90150
Opcode Fuzzy Hash: 67207e7419630ac72310dbed93751e59c1e1c42c1789b69ff6d33a1b03651e90
Instruction Fuzzy Hash: 3051C8346083009FD718DE18C8A4B3FB7E1EB84715F68882EF8C687352D638AC15CB5A

Function 00431170 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220d493865b9d59295a6970017993191259a8a2e91865c6a176d590028cdfec5
Instruction ID: 4b9473862b33005e416f9d0c90a3663ff66fa1f331ef2fc11bea8b6ce455af66
Opcode Fuzzy Hash: 220d493865b9d59295a6970017993191259a8a2e91865c6a176d590028cdfec5
Instruction Fuzzy Hash: 3D5141B41183408BD300DF29C490A2BBBF1EFAA744F149A1DF5989B361E379C941CB5A

Function 004155F0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f31d76514d65647a722964044030794a34ebe0e4e7decc98345fa62e0c88cce
Instruction ID: facc55c3b5391d0abd7e8e4532b0bb0c99aadb09a67df01bce2bf469d7ab5674
Opcode Fuzzy Hash: 3f31d76514d65647a722964044030794a34ebe0e4e7decc98345fa62e0c88cce
Instruction Fuzzy Hash: AC51ABB5A04700DFC710DF18C8819A6B7A1FFC6328F55456EE8698B392D734EC81CB9A

Function 0042B450 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c0864c29cc861c05833db58c341d4a1da4b62c414e2688bd88e3ba5ba3d8ee
Instruction ID: e0cd1bb18ccfeb96498a84b04df56d0bbf7c3264e110ef098f4826039d75aa88
Opcode Fuzzy Hash: 90c0864c29cc861c05833db58c341d4a1da4b62c414e2688bd88e3ba5ba3d8ee
Instruction Fuzzy Hash: C84145702043109BE324DF14D895BABB7F1EF86324F044A1DF9958B392E778A941CB9A

Function 00420CE0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b84bf2fd87380bd54dbd3877078b62fbcd23ac0201ac8dfcd3649b8e6b1bf54
Instruction ID: 671a1563b7bc90e3624b8c29c7fd458bbb023b71b5ea43d137deda20b4370a64
Opcode Fuzzy Hash: 7b84bf2fd87380bd54dbd3877078b62fbcd23ac0201ac8dfcd3649b8e6b1bf54
Instruction Fuzzy Hash: FC41633271C3644FD318CE79989023ABBD2ABC5210F088A3EF0E6C7392EA38D945D715

Function 00420F18 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8776ff49d0c2d43503a2e086b4b2a185eb497c37368d64ecf2b9c9d127e73646
Instruction ID: 3915a0fc68db19e612d296171af61b802842cfdb60cb8bc5b0a459ffa85e6e71
Opcode Fuzzy Hash: 8776ff49d0c2d43503a2e086b4b2a185eb497c37368d64ecf2b9c9d127e73646
Instruction Fuzzy Hash: A5418F71618350DBD324EF20D895BAFB3E5EF85319F40492DE089132D2DB389949CB9A

Function 0041E395 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c053ce31ef25c29201dcfee59b2084c25bc17ff7985b330bbec2648a804d8b
Instruction ID: 229b223747587800ab2e72ae267c3dec5b27cd98af0f4f25e424c812efdc0bef
Opcode Fuzzy Hash: 67c053ce31ef25c29201dcfee59b2084c25bc17ff7985b330bbec2648a804d8b
Instruction Fuzzy Hash: 5431AD355583688FE324EF15D8817EAB3E4AF46300F44182DD9D587341E3BDA985CBAA

Function 00448180 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5f38e62d87398cef03ad73536c430d16a8ec5e4cffdcd0a9cc9c3631380e7ca2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E311E933A051D40ED3168D3C840056ABFE31AA3234F5943DFF4B4AB2D2DA268D8B8359

Function 0043CAA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426252486152806b9b2540cb071e4acf5948ef7fd31604c0866f8dd5bc53c06f
Instruction ID: 70a61a1bc3eb7a9730083ea28513338ed98bfaacbf14baf35a2bd24f3892695e
Opcode Fuzzy Hash: 426252486152806b9b2540cb071e4acf5948ef7fd31604c0866f8dd5bc53c06f
Instruction Fuzzy Hash: 860152F570031147D620EE55E8C5B27B2A85F59708F18642ED40667342DB79EC05D799

Function 00416A30 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf53ba92400936c8cda88864bcb5b9148cd77c453d272277b23cf91686bbef9
Instruction ID: 335d5017df81e604150aa530cd067b8692513ca0765d94962038f4d4ff977589
Opcode Fuzzy Hash: 5bf53ba92400936c8cda88864bcb5b9148cd77c453d272277b23cf91686bbef9
Instruction Fuzzy Hash: 87F0507B74831A0F6311CDB9FC80577B396DBCA241F16903DDA41E3301D431E842D294

Function 0042A7F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78897440eded06021b29a0c3b54aa744dd786520b349eb5ad26c49f85982ac5b
Instruction ID: 8a64ef3d332e009d93526f451fcbae1625f305ea1fe814c3b9a9cb109cc465ac
Opcode Fuzzy Hash: 78897440eded06021b29a0c3b54aa744dd786520b349eb5ad26c49f85982ac5b
Instruction Fuzzy Hash: DDF027B1B0426017DB229945ACC0B37FB9CCB97324F191416EC8053202E2655C41C3EB

Function 0044D0D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: d8b96f550cc4fc2ed808545740f6a2bc15fcb5c6afbd5f2dc55da217a3332183
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: DDD05E21A0822146BB688E19A410977F7E0EA87B11F49955FFA82E3248D234DC42C2AD

Function 00440FB3 Relevance: 57.9, APIs: 1, Strings: 32, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00441042

Strings

q, xrefs: 004411A2
q, xrefs: 00440FC6
n, xrefs: 004411BB
/, xrefs: 00441080
3, xrefs: 0044106C
k, xrefs: 00441085
), xrefs: 0044108A
|, xrefs: 004410A3
s, xrefs: 004411AC
m, xrefs: 004411B6
o, xrefs: 004411C0
s, xrefs: 00440FD0
', xrefs: 004410A8
y, xrefs: 0044117A
^, xrefs: 00441111
~, xrefs: 00440FDF
D, xrefs: 00441099
#, xrefs: 004410BC
z, xrefs: 004410DF
}, xrefs: 00440FDA
}, xrefs: 00441166
!, xrefs: 004410B2
0, xrefs: 0044127A
-, xrefs: 00441076
@, xrefs: 004410AD
A, xrefs: 00441107
{, xrefs: 00441184
%, xrefs: 0044109E
1, xrefs: 00441062
+, xrefs: 00441094
u, xrefs: 0044118E
w, xrefs: 00441198

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: !$#$%$'$)$+$-$/$0$1$3$@$A$D$^$k$m$n$o$q$q$s$s$u$w$y$z${$|$}$}$~
API String ID: 2525500382-1499041251
Opcode ID: 6b0ac715ed6f5973afcc633bc88aea752fb86d76bd8f32253dfb1b1dcd9d424f
Instruction ID: 108949eb1d88cfbc3c12a83278d9a983b58887161e04ade427748e73736e66ec
Opcode Fuzzy Hash: 6b0ac715ed6f5973afcc633bc88aea752fb86d76bd8f32253dfb1b1dcd9d424f
Instruction Fuzzy Hash: 5391966040C7C1CDE322DB78844875EBFE15BA6318F184A9DE1E94B3E2C3B99549CB67

Function 004415B2 Relevance: 57.9, APIs: 1, Strings: 32, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00441645

Strings

), xrefs: 00441688
%, xrefs: 0044169C
@, xrefs: 004416AB
/, xrefs: 0044167E
~, xrefs: 004415E2
!, xrefs: 004416B0
', xrefs: 004416A6
3, xrefs: 0044166A
}, xrefs: 004415DD
n, xrefs: 004417B9
^, xrefs: 0044170F
A, xrefs: 00441705
}, xrefs: 00441764
q, xrefs: 004417A0
o, xrefs: 004417BE
-, xrefs: 00441674
1, xrefs: 00441660
q, xrefs: 004415C9
m, xrefs: 004417B4
#, xrefs: 004416BA
0, xrefs: 00441862
|, xrefs: 004416A1
D, xrefs: 00441697
s, xrefs: 004415D3
w, xrefs: 00441796
{, xrefs: 00441782
u, xrefs: 0044178C
+, xrefs: 00441692
z, xrefs: 004416DD
k, xrefs: 00441683
y, xrefs: 00441778
s, xrefs: 004417AA

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: !$#$%$'$)$+$-$/$0$1$3$@$A$D$^$k$m$n$o$q$q$s$s$u$w$y$z${$|$}$}$~
API String ID: 2525500382-1499041251
Opcode ID: 96396f94e3a2899fb35ef1564563576ae6443a919e8fefbf7457e391102356cf
Instruction ID: 07d8931accc1e216bcac131d1863a2078c31fa044368865e1b3e39b93ff44b3e
Opcode Fuzzy Hash: 96396f94e3a2899fb35ef1564563576ae6443a919e8fefbf7457e391102356cf
Instruction Fuzzy Hash: D991956040C7C18DD322DB78844875EBFE15BA7328F180A9DE1E94B3E2C7BA9549C767

Function 004438D7 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0044395B

Strings

m, xrefs: 004439D4
6, xrefs: 00443A5C
0, xrefs: 00443AF5
n, xrefs: 004439C4
v, xrefs: 00443A2C
b, xrefs: 00443A04
+, xrefs: 00443994
i, xrefs: 004439CC
, xrefs: 00443A44
[, xrefs: 00443A54
<, xrefs: 004439AC
U, xrefs: 004439E4
3, xrefs: 00443A4C

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: $+$0$3$6$<$U$[$b$i$m$n$v
API String ID: 2525500382-4254328309
Opcode ID: 70d5578a80aaee624cc13c424fb55e245117de5e8d31ecb09b4da49c2170305f
Instruction ID: 2603d5e3f4f2631e68ae0cd328a1364e379b2a8fd7523953408b61dc65d2b3ca
Opcode Fuzzy Hash: 70d5578a80aaee624cc13c424fb55e245117de5e8d31ecb09b4da49c2170305f
Instruction Fuzzy Hash: 9691C560108BC1CED726CF3C8488606BFA16B26224F5887DDD8EA4F3DBD365D545C7A6

Function 00443D6B Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00443DEF

Strings

v, xrefs: 00443EC0
b, xrefs: 00443E98
6, xrefs: 00443EF0
, xrefs: 00443ED8
<, xrefs: 00443E40
3, xrefs: 00443EE0
i, xrefs: 00443E60
0, xrefs: 00443F80
[, xrefs: 00443EE8
+, xrefs: 00443E28
m, xrefs: 00443E68
U, xrefs: 00443E78
n, xrefs: 00443E58

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: $+$0$3$6$<$U$[$b$i$m$n$v
API String ID: 2525500382-4254328309
Opcode ID: 95149da0a422b14dbea2cc2f881a6883c8603a19f154dd3468e445edae0997dc
Instruction ID: 87ebe45e8e707a4efc6b4daf12bf5aa42a4aacbc08dbfdac794b33a55b617d48
Opcode Fuzzy Hash: 95149da0a422b14dbea2cc2f881a6883c8603a19f154dd3468e445edae0997dc
Instruction Fuzzy Hash: 2F81A560408BC18ED722CF3C8588646BFA16B27224F4887CDD8E94F3DBC365D556D7A6

Function 00440AE9 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00440AF3
VariantInit.OLEAUT32 ref: 00440B06

Strings

J, xrefs: 00440BB4
[, xrefs: 00440BA4
C, xrefs: 00440BE4
2, xrefs: 00440B74
M, xrefs: 00440BD4
[, xrefs: 00440B84
n, xrefs: 00440B94
U, xrefs: 00440B44
K, xrefs: 00440BC4
Q, xrefs: 00440B54
X, xrefs: 00440B64

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2$C$J$K$M$Q$U$X$[$[$n
API String ID: 2610073882-1972926546
Opcode ID: c86c8a7c5d2a210e35a617d56914707fa0ada04b18f6b57b809ba11c0acae104
Instruction ID: 130a690b0b646608de2fea0cc9c969e80f28811188b67cc3c3cffb1e2e87c6fb
Opcode Fuzzy Hash: c86c8a7c5d2a210e35a617d56914707fa0ada04b18f6b57b809ba11c0acae104
Instruction Fuzzy Hash: 5641D26410D7C1CEE3729B288858B8FBFE1ABA6224F084B5DD4E94B2D2C7755549CB23

Function 004431FA Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00443200
VariantInit.OLEAUT32 ref: 0044320F

Strings

S, xrefs: 00443256
}, xrefs: 0044322E
}, xrefs: 0044324E
l, xrefs: 0044325E
A, xrefs: 0044326E
O, xrefs: 00443276
r, xrefs: 0044323E
w, xrefs: 00443266
m, xrefs: 00443236
H, xrefs: 00443246

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: A$H$O$S$l$m$r$w$}$}
API String ID: 2610073882-1206721304
Opcode ID: 75cc9a8a0f8ddc50f916c27c16de6402d2845fd0f562e019fe4923f129a28185
Instruction ID: 1bdc5e519b3a1c10a0f4776a38e31b909fb3bc484007d58397f9e8e6413b6536
Opcode Fuzzy Hash: 75cc9a8a0f8ddc50f916c27c16de6402d2845fd0f562e019fe4923f129a28185
Instruction Fuzzy Hash: 9841F770508B81CFD715DF38C48860ABFA0AF12224F088A8CD8EA4F797D775E515CBA2

Function 00442C0F Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00442C19
VariantInit.OLEAUT32 ref: 00442C28

Strings

w, xrefs: 00442C7F
S, xrefs: 00442C6F
r, xrefs: 00442C57
}, xrefs: 00442C47
l, xrefs: 00442C77
}, xrefs: 00442C67
A, xrefs: 00442C87
O, xrefs: 00442C8F
H, xrefs: 00442C5F
m, xrefs: 00442C4F

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: A$H$O$S$l$m$r$w$}$}
API String ID: 2610073882-1206721304
Opcode ID: a3c255f071028f88cb89dcd47e81a9b8dabd04e6fb9c431a5bcb53b639b5f0c6
Instruction ID: ffff510a9603b7a21459f1ef397e1213e82b85fa1d216bf03efce6e448faae42
Opcode Fuzzy Hash: a3c255f071028f88cb89dcd47e81a9b8dabd04e6fb9c431a5bcb53b639b5f0c6
Instruction Fuzzy Hash: 4341D720409B81CED725DF2C858460ABFE06F16224F488A8CE8EA4F797D375E515CBA2

Function 00443561 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004435A6

Strings

', xrefs: 004435F9
1, xrefs: 004435C1
/, xrefs: 004435D9
#, xrefs: 00443609
%, xrefs: 004435F1
!, xrefs: 00443601
), xrefs: 004435E1
3, xrefs: 004435C9
+, xrefs: 004435E9
-, xrefs: 004435D1

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: !$#$%$'$)$+$-$/$1$3
API String ID: 1927566239-2331977360
Opcode ID: a74af8396c1682266e089c0487ce6037a9c8d3113e0d9eda75be2e06ff6a63f9
Instruction ID: ee2f474e67f111082cefe67d3a0d52cb7bb2bf9376e94c587a8d0c8950ec508c
Opcode Fuzzy Hash: a74af8396c1682266e089c0487ce6037a9c8d3113e0d9eda75be2e06ff6a63f9
Instruction Fuzzy Hash: 294137700087818EE716CF28D498756BFE0AB16324F08869DD8EA4F397C7B5D549CBA6

Function 00442E03 Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00442E2C

Strings

', xrefs: 00442E7F
/, xrefs: 00442E5F
#, xrefs: 00442E8F
!, xrefs: 00442E87
%, xrefs: 00442E77
), xrefs: 00442E67
+, xrefs: 00442E6F
-, xrefs: 00442E57
1, xrefs: 00442E47
3, xrefs: 00442E4F

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: !$#$%$'$)$+$-$/$1$3
API String ID: 1927566239-2331977360
Opcode ID: 7ff96beb149720abc111d5a4a325261476aa5289834bc39e08dae04d264503ea
Instruction ID: b6ef5648cfd053ab5c5235084f9802aba959b3e2c74c52f1b60c56c7b8547c4f
Opcode Fuzzy Hash: 7ff96beb149720abc111d5a4a325261476aa5289834bc39e08dae04d264503ea
Instruction Fuzzy Hash: 4241D4700087818ED722DF28D488716BFE06B2A314F0886DDD8E94F397C7B5D519DBA6

Function 00441886 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 68COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00441890

Strings

1, xrefs: 004418F6
7, xrefs: 004418C6
3, xrefs: 004418E6
9, xrefs: 004418B6
>, xrefs: 0044190E
5, xrefs: 004418D6
=, xrefs: 004418FE

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: 1$3$5$7$9$=$>
API String ID: 1927566239-1319780741
Opcode ID: 6f2094598513e7550a03f6de29a60b2461d009f1d2ba03ca284aaea2ce77932f
Instruction ID: c44d57db78e0c69fe059c13c49a2fdb18f88503187e5edcbd4511c05639c99f3
Opcode Fuzzy Hash: 6f2094598513e7550a03f6de29a60b2461d009f1d2ba03ca284aaea2ce77932f
Instruction Fuzzy Hash: 1D41E57050C7C1CAE332DB2894987DABBE4AB96314F044D5ED4DD873A2C7744645CB53

Function 00434A8B Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 239COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00434BC6

Strings

v~, xrefs: 00434C83
*q, xrefs: 00434AEC
{=, xrefs: 00434C75
uz, xrefs: 00434C6E

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: DrivesLogical
String ID: *q$uz$v~${=
API String ID: 999431828-1084862487
Opcode ID: e9e420dfd96ea913758df60c8637ea870d377622629703d560ee7e654dce59ef
Instruction ID: 30a67f2b7f7586c8fca400b8d5c5678188133c4e8870100d16f5c5fbd868d992
Opcode Fuzzy Hash: e9e420dfd96ea913758df60c8637ea870d377622629703d560ee7e654dce59ef
Instruction Fuzzy Hash: CC912FB4900716DFDB04CF55D8C06AEBB72FF99305F1456A8C8552B355D738A822CF88

Function 00442141 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0044214B
VariantInit.OLEAUT32 ref: 0044215E

Strings

", xrefs: 004421AC
., xrefs: 0044220C

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: "$.
API String ID: 2610073882-3921061877
Opcode ID: 3ce6da7747e4e3dd6ce4cd4fa46f262ded4de983bf5cdf44ddf92e7ba425ef2b
Instruction ID: 48845c4405efb13bb663090461cc0c2e34938c2ce4129b6ba2c3fd8b1ff134bd
Opcode Fuzzy Hash: 3ce6da7747e4e3dd6ce4cd4fa46f262ded4de983bf5cdf44ddf92e7ba425ef2b
Instruction Fuzzy Hash: D741A36010C7C2CED331DB389448B9EBFE0ABA6224F048EAEE4E9576D2D7705545DB63

Function 0044B388 Relevance: 6.0, APIs: 4, Instructions: 11COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 0044B38F
SysFreeString.OLEAUT32 ref: 0044B392
SysFreeString.OLEAUT32 ref: 0044B39B
SysFreeString.OLEAUT32 ref: 0044B39E

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: bfa343473436edd852ff6df2bfe459c5d571fa3cfc1c8186f5e9bdc9b0907b6d
Instruction ID: fb02b0fc5b2f76077eedd25fc6691441f12c6c4511a0ba04d9f55f64451c9c4a
Opcode Fuzzy Hash: bfa343473436edd852ff6df2bfe459c5d571fa3cfc1c8186f5e9bdc9b0907b6d
Instruction Fuzzy Hash: D8C04CB2C11238E79611B7716D8482F3F2DA9496627056476E505630134A78BC019FE6

Function 0044B56D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00459100,00000000,00000001,004590F0,00000000), ref: 0044B5B3
CoCreateInstance.OLE32(00459100,00000000,00000001,004590F0,00000000), ref: 0044B5FF

Strings

\, xrefs: 0044B5B9

Memory Dump Source

Source File: 00000003.00000002.1847888919.0000000000410000.00000040.00000400.00020000.00000000.sdmp, Offset: 00410000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_410000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID: \
API String ID: 542301482-2967466578
Opcode ID: 83255310e8ef5e9bc3da65fadfa657208b4c75eed6e810e1c1971af16d651779
Instruction ID: bd0631b28111de4514daba0a234969274d3a5cacd2c2c29cbf99a720c2c10886
Opcode Fuzzy Hash: 83255310e8ef5e9bc3da65fadfa657208b4c75eed6e810e1c1971af16d651779
Instruction Fuzzy Hash: B70102B0148301EEE310CF00D859B4BBAE4BB80B16F10881DF5945A1D1C7FA954CCF9A

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EKAHephXb2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
EKAHephXb2.exe

Function 0041F3E0 Relevance: 15.4, Strings: 12, Instructions: 389
COMMON

Function 0041FA80 Relevance: 11.5, Strings: 9, Instructions: 254
COMMON

Function 0041CD30 Relevance: 6.2, APIs: 4, Instructions: 202
threadCOMMON

Function 0041FF36 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Function 00451C60 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00452844 Relevance: 1.4, Strings: 1, Instructions: 193
COMMON

Function 0045259A Relevance: 1.3, Strings: 1, Instructions: 83
COMMON

Function 0041FA1F Relevance: .2, Instructions: 220
COMMON

Function 00451B92 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Function 0044E998 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
memoryCOMMON

Function 0044E8E0 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON