Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3E200 SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CopyFileA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,CopyFileA,__Mtx_unlock,__Mtx_unlock, |
2_2_02A3E200 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ADC3BA FindClose,FindFirstFileExW,GetLastError, |
2_2_02ADC3BA |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A0E0B0 CreateDirectoryA,CreateDirectoryA,FindFirstFileA,GetLastError,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,GetFileAttributesA,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,__Mtx_unlock, |
2_2_02A0E0B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A0A6B0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,__Mtx_unlock, |
2_2_02A0A6B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A20CC3 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
2_2_02A20CC3 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ADC440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
2_2_02ADC440 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3FD60 FindFirstFileA, |
2_2_02A3FD60 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0508A17B GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
2_2_0508A17B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050590F0 FindFirstFileA,CreateDirectoryA,GetLastError,CopyFileA,CopyFileA,FindNextFileA,FindClose,GetLastError, |
2_2_050590F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05059990 FindFirstFileA,SetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError, |
2_2_05059990 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 95.216.41.236 |
Source: MXpl6HFisn.exe, 00000000.00000002.1767327389.000000C001E3E000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000003.1763770095.0000023CE7C70000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000003.1701201194.0000023CE7B30000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C00296C000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C002400000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1871116463.000000C002814000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1865976558.000001E67DDB0000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1869403565.000000C001CE6000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1807163070.000001E67DC70000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000002.00000002.4067758538.0000000002A00000.00000040.00000400.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1960476547.000000C001CF8000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000003.1881301271.0000027776EB0000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1962242072.000000C002826000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920173465.00000000026B0000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999600227.0000000002EA0000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: http://www.winimage.com/zLibDll |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: BitLockerToGo.exe, 00000002.00000003.1803412679.0000000002C34000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.000000000326C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.000000000326C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/ |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/- |
Source: BitLockerToGo.exe, 00000008.00000003.1999122763.000000000326C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003235000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003235000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/demo/home.php?s=102.165.48.43 |
Source: BitLockerToGo.exe, 00000002.00000003.1803412679.0000000002C34000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com/s |
Source: BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BD0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BD0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003216000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003217000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://db-ip.com:443/demo/home.php?s=102.165.48.43 |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: MXpl6HFisn.exe, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe.0.dr |
String found in binary or memory: https://golang.org/doc/faq#nil_errortls: |
Source: BitLockerToGo.exe, 00000005.00000002.1920528481.0000000002B48000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.000000000326C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.000000000326C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003235000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003235000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/ |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003235000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003235000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/Mozilla/5.0 |
Source: BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002B90000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/O |
Source: BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/R |
Source: MXpl6HFisn.exe, 00000000.00000002.1767327389.000000C001E3E000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000003.1763770095.0000023CE7C70000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000003.1701201194.0000023CE7B30000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C00296C000.00000004.00001000.00020000.00000000.sdmp, MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C002400000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1871116463.000000C002814000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1865976558.000001E67DDB0000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1869403565.000000C001CE6000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1807163070.000001E67DC70000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4067758538.0000000002A00000.00000040.00000400.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1960476547.000000C001CF8000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000003.1881301271.0000027776EB0000.00000004.00001000.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1962242072.000000C002826000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920173465.00000000026B0000.00000040.00000400.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999600227.0000000002EA0000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll |
Source: BitLockerToGo.exe, 00000005.00000002.1920528481.0000000002B48000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/s |
Source: BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/t |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BA5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003235000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003235000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003216000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003217000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/102.165.48.43 |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io/widget/demo/102.165.48.43o |
Source: BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BC3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/102.165.48.43 |
Source: BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003216000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003217000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/102.165.48.43: |
Source: BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://ipinfo.io:443/widget/demo/102.165.48.43P$ |
Source: BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br |
Source: BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF |
Source: BitLockerToGo.exe, 00000002.00000003.1826342628.0000000004F64000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828530915.0000000004F7C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: BitLockerToGo.exe, 00000002.00000003.1826342628.0000000004F64000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828530915.0000000004F7C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.V |
Source: BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F00000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920528481.0000000002B48000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORT |
Source: BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/RiseProSUPPORTR |
Source: BitLockerToGo.exe, 00000008.00000003.1999122763.000000000326C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.000000000329B000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr |
String found in binary or memory: https://t.me/risepro_bot |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botbackup |
Source: BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.000000000326C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botisepro_botc |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_botrisep |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.me/risepro_bott |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://t.p |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: BitLockerToGo.exe, 00000002.00000003.1825988400.0000000004F67000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827211496.0000000004F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828884319.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, jKXEuRSxIEMXWeb Data.2.dr |
String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: BitLockerToGo.exe |
String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address |
Source: BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2 |
Source: BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F00000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ |
Source: BitLockerToGo.exe, 00000002.00000003.1829264822.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1826241376.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828447229.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827672274.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829573161.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1830796791.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1830547597.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829150612.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829776196.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox |
Source: BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F00000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/ |
Source: BitLockerToGo.exe, 00000002.00000003.1829264822.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1826241376.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828447229.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1827672274.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829573161.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1830796791.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1830547597.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829150612.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1829776196.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1828806562.0000000004F4E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www. |
Source: BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C14000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3E200 |
2_2_02A3E200 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8E240 |
2_2_02A8E240 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2C3B0 |
2_2_02A2C3B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A0E0B0 |
2_2_02A0E0B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A561A0 |
2_2_02A561A0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A287E0 |
2_2_02A287E0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3C720 |
2_2_02A3C720 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ACC4A0 |
2_2_02ACC4A0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A60400 |
2_2_02A60400 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AEA58E |
2_2_02AEA58E |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A24A10 |
2_2_02A24A10 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A6286B |
2_2_02A6286B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2E9A0 |
2_2_02A2E9A0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3C9B0 |
2_2_02A3C9B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A38930 |
2_2_02A38930 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8CEC0 |
2_2_02A8CEC0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A42E70 |
2_2_02A42E70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2AD70 |
2_2_02A2AD70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A23270 |
2_2_02A23270 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3B3B0 |
2_2_02A3B3B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8D340 |
2_2_02A8D340 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A43090 |
2_2_02A43090 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5B160 |
2_2_02A5B160 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A41150 |
2_2_02A41150 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A357D0 |
2_2_02A357D0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A37710 |
2_2_02A37710 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A49480 |
2_2_02A49480 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5D4C0 |
2_2_02A5D4C0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8D5A0 |
2_2_02A8D5A0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A55B20 |
2_2_02A55B20 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ADB830 |
2_2_02ADB830 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3D840 |
2_2_02A3D840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A31E10 |
2_2_02A31E10 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A57E70 |
2_2_02A57E70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A25D70 |
2_2_02A25D70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A882B0 |
2_2_02A882B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ACE220 |
2_2_02ACE220 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AF8244 |
2_2_02AF8244 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A44387 |
2_2_02A44387 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8E030 |
2_2_02A8E030 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A28069 |
2_2_02A28069 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2E048 |
2_2_02A2E048 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1A1F0 |
2_2_02A1A1F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A46160 |
2_2_02A46160 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2E169 |
2_2_02A2E169 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5E697 |
2_2_02A5E697 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ABC690 |
2_2_02ABC690 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A58609 |
2_2_02A58609 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8A780 |
2_2_02A8A780 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A58769 |
2_2_02A58769 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A024F0 |
2_2_02A024F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5C4C9 |
2_2_02A5C4C9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AA4411 |
2_2_02AA4411 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A165E9 |
2_2_02A165E9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A4C550 |
2_2_02A4C550 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A84550 |
2_2_02A84550 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AB6550 |
2_2_02AB6550 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A88A6B |
2_2_02A88A6B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A18BB8 |
2_2_02A18BB8 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A32B99 |
2_2_02A32B99 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A38BC7 |
2_2_02A38BC7 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8CB70 |
2_2_02A8CB70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AEA8D0 |
2_2_02AEA8D0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A4A830 |
2_2_02A4A830 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A90860 |
2_2_02A90860 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A829B0 |
2_2_02A829B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AE4E88 |
2_2_02AE4E88 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AE6EC0 |
2_2_02AE6EC0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A94E00 |
2_2_02A94E00 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A58E18 |
2_2_02A58E18 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A84F80 |
2_2_02A84F80 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A9AF20 |
2_2_02A9AF20 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A952F0 |
2_2_02A952F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A41208 |
2_2_02A41208 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8F261 |
2_2_02A8F261 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AD5390 |
2_2_02AD5390 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AD1370 |
2_2_02AD1370 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A2B029 |
2_2_02A2B029 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A87040 |
2_2_02A87040 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A91040 |
2_2_02A91040 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A4F1B0 |
2_2_02A4F1B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A191B9 |
2_2_02A191B9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A331C6 |
2_2_02A331C6 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A31110 |
2_2_02A31110 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A596F9 |
2_2_02A596F9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5D628 |
2_2_02A5D628 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A85630 |
2_2_02A85630 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A91720 |
2_2_02A91720 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AE1700 |
2_2_02AE1700 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A4B498 |
2_2_02A4B498 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3B5F9 |
2_2_02A3B5F9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A23A68 |
2_2_02A23A68 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A9BBD0 |
2_2_02A9BBD0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AD3B20 |
2_2_02AD3B20 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A87B10 |
2_2_02A87B10 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A4B869 |
2_2_02A4B869 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A59999 |
2_2_02A59999 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A5F928 |
2_2_02A5F928 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A15970 |
2_2_02A15970 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A37977 |
2_2_02A37977 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A83FE0 |
2_2_02A83FE0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A9FCA0 |
2_2_02A9FCA0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A83C70 |
2_2_02A83C70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A8DD90 |
2_2_02A8DD90 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02AF9DD9 |
2_2_02AF9DD9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A17D20 |
2_2_02A17D20 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05061510 |
2_2_05061510 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05058040 |
2_2_05058040 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0507A340 |
2_2_0507A340 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05079C00 |
2_2_05079C00 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0506EE70 |
2_2_0506EE70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05057820 |
2_2_05057820 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0505D460 |
2_2_0505D460 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05076470 |
2_2_05076470 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0505E490 |
2_2_0505E490 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050A34F9 |
2_2_050A34F9 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050717E0 |
2_2_050717E0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050747F0 |
2_2_050747F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0505A640 |
2_2_0505A640 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05095070 |
2_2_05095070 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05054360 |
2_2_05054360 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05099380 |
2_2_05099380 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050953CF |
2_2_050953CF |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0508ED00 |
2_2_0508ED00 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05094D2E |
2_2_05094D2E |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050A2D60 |
2_2_050A2D60 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05072F50 |
2_2_05072F50 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0505FE40 |
2_2_0505FE40 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0505D8E0 |
2_2_0505D8E0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050A8BEB |
2_2_050A8BEB |
Source: MXpl6HFisn.exe, 00000000.00000002.1767327389.000000C001E3E000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1764630027.000000C0001F5000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C002C22000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000003.1701201194.0000023CE7B30000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000003.1757024957.0000023CE79F0000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000003.1763770095.0000023CE7DA6000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1781559884.00007FF6A6BF5000.00000008.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C00296C000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C00296C000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C002D65000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: MXpl6HFisn.exe, 00000000.00000002.1769068121.000000C002400000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000000.1709669640.00007FF7B8D95000.00000008.00000001.01000000.00000005.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1871116463.000000C002814000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1871116463.000000C002814000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1869403565.000000C0016F7000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1865976558.000001E67DEE6000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1862067365.000001E67DB70000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1862099559.000001E67DB30000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1869403565.000000C001CE6000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000003.1807163070.000001E67DC70000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000000.1793682334.00007FF7B8D95000.00000008.00000001.01000000.00000005.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1960476547.000000C001CF8000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1962242072.000000C002B4E000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000003.1936048127.0000027776D70000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1964029089.000000C004035000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameupdate1503.exe8 vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000003.1881301271.0000027776EB0000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1962242072.000000C002826000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameKVM Vision Viewer.exeD vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1962242072.000000C002826000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000003.1936018932.0000027776DB0000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs MXpl6HFisn.exe |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: powrprof.dll |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Section loaded: umpdc.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3E200 SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CopyFileA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,CopyFileA,__Mtx_unlock,__Mtx_unlock, |
2_2_02A3E200 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ADC3BA FindClose,FindFirstFileExW,GetLastError, |
2_2_02ADC3BA |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A0E0B0 CreateDirectoryA,CreateDirectoryA,FindFirstFileA,GetLastError,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,GetFileAttributesA,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,__Mtx_unlock, |
2_2_02A0E0B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A0A6B0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,__Mtx_unlock, |
2_2_02A0A6B0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A20CC3 FindFirstFileA,FindNextFileA,GetLastError,FindClose, |
2_2_02A20CC3 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02ADC440 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
2_2_02ADC440 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3FD60 FindFirstFileA, |
2_2_02A3FD60 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_0508A17B GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, |
2_2_0508A17B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_050590F0 FindFirstFileA,CreateDirectoryA,GetLastError,CopyFileA,CopyFileA,FindNextFileA,FindClose,GetLastError, |
2_2_050590F0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_05059990 FindFirstFileA,SetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError, |
2_2_05059990 |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002B96000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: BitLockerToGo.exe, 00000002.00000003.3882145503.0000000004F7D000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]] |
Source: BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 |
Source: BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003217000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: BitLockerToGo.exe, 00000002.00000003.1791900220.0000000002BF9000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}e |
Source: BitLockerToGo.exe, 00000002.00000003.1831701071.0000000004F6C000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&% |
Source: BitLockerToGo.exe, 00000008.00000002.1999851047.00000000031B7000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000 |
Source: BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097\ |
Source: BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C14000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}y |
Source: BitLockerToGo.exe, 00000002.00000003.1803412679.0000000002C34000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4068012610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002B90000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003242000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003242000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000002.1999895233.0000000003208000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000008.00000003.1999122763.0000000003208000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}et |
Source: BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb |
Source: BitLockerToGo.exe, 00000008.00000003.1969479982.0000000003219000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: MXpl6HFisn.exe, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Binary or memory string: LAZ8i9NlUZ0lSPkzdHAg7kjRjkCnkH5aScnzZ0FLRc1HCl8Q+efVI91gv9Deb3GTYAJfB+FhRxsT7Jv//u2UkAKVUPsvpvijNnwUsTR98GVFC1yLAH9dfaCHlTb3Z3ZkP27Czki7TkW5TKALHxSHcPnVQvYyW/LygsnXcy92ZHGfShugzWK0nNUime6ySx5bkL6GpCGdzyz0hMhyFXSQ5pp4MJFYvJ+rBld0DtOfszB0z2XEyXUmRSOb8J/vYPKh/xrs |
Source: BitLockerToGo.exe, 00000002.00000003.3882165826.0000000002C84000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}exe [2424] |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002B96000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW! |
Source: MXpl6HFisn.exe, 00000000.00000002.1778270791.0000023CC2374000.00000004.00000020.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000001.00000002.1873704360.000001E65847C000.00000004.00000020.00020000.00000000.sdmp, (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, 00000004.00000002.1965180617.000002773172F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000& |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7D9421B6M |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7D9421B6 |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000 |
Source: BitLockerToGo.exe, 00000005.00000003.1890881232.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}b |
Source: BitLockerToGo.exe, 00000002.00000003.3882223341.0000000002C31000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ntEK\History\Firefox_fqs92o4p.default-release.txtl |
Source: BitLockerToGo.exe, 00000005.00000003.1890881232.0000000002BA8000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91e |
Source: (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Binary or memory string: fDvj1yreL7RfHuqV3C2PUy8owhmOA+mCYLiETYIkDcTHBTrmX+wpLezG9YdaDHr5cGnuEo5uEiXCaky47RoK/bChyJEW8jCuhk0aFdyQMUoc5jMY9pXAd5S+9cgnKo0TT1IMuNG02lx46KKqpDU5dsQWx9sExIa7NSHGDDbBP93PLYhRsNMkCBklZVvmCi+FdsT8bWRGD9u3K8O6qmB6HAcWy5V6iF6kPQBBtPN7IxxvZanQWddbsZJJFtVb0Kepu3SW |
Source: BitLockerToGo.exe, 00000005.00000002.1920564820.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000003.1919146241.0000000002BDE000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAWz8_x |
Source: BitLockerToGo.exe, 00000002.00000002.4068353569.0000000004F60000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ntEKn( |
Source: BitLockerToGo.exe, 00000002.00000002.4067895125.0000000002B90000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1C000 mov eax, dword ptr fs:[00000030h] |
2_2_02A1C000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62460 mov eax, dword ptr fs:[00000030h] |
2_2_02A62460 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62460 mov eax, dword ptr fs:[00000030h] |
2_2_02A62460 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A6286B mov eax, dword ptr fs:[00000030h] |
2_2_02A6286B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A6286B mov eax, dword ptr fs:[00000030h] |
2_2_02A6286B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A6286B mov eax, dword ptr fs:[00000030h] |
2_2_02A6286B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A6286B mov eax, dword ptr fs:[00000030h] |
2_2_02A6286B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov ecx, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A62F97 mov eax, dword ptr fs:[00000030h] |
2_2_02A62F97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A3D840 mov eax, dword ptr fs:[00000030h] |
2_2_02A3D840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1C000 mov eax, dword ptr fs:[00000030h] |
2_2_02A1C000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A141E0 mov eax, dword ptr fs:[00000030h] |
2_2_02A141E0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A641C3 mov eax, dword ptr fs:[00000030h] |
2_2_02A641C3 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A64405 mov eax, dword ptr fs:[00000030h] |
2_2_02A64405 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14840 mov eax, dword ptr fs:[00000030h] |
2_2_02A14840 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1C000 mov eax, dword ptr fs:[00000030h] |
2_2_02A1C000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A14D29 mov eax, dword ptr fs:[00000030h] |
2_2_02A14D29 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A153F8 mov eax, dword ptr fs:[00000030h] |
2_2_02A153F8 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1C000 mov eax, dword ptr fs:[00000030h] |
2_2_02A1C000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A63058 mov eax, dword ptr fs:[00000030h] |
2_2_02A63058 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A15718 mov eax, dword ptr fs:[00000030h] |
2_2_02A15718 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1C000 mov eax, dword ptr fs:[00000030h] |
2_2_02A1C000 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A638E8 mov eax, dword ptr fs:[00000030h] |
2_2_02A638E8 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A15970 mov ecx, dword ptr fs:[00000030h] |
2_2_02A15970 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: 2_2_02A1FF70 mov eax, dword ptr fs:[00000030h] |
2_2_02A1FF70 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey, |
2_2_02A0C390 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoEx,FormatMessageA, |
2_2_02ADC1B6 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetACP,IsValidCodePage,GetLocaleInfoW, |
2_2_02AFE6DB |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
2_2_02AFEAF8 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_02AFEA6D |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_02AFE8E0 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_02AFE987 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_02AFE9D2 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
2_2_02AFEE74 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_02AFEF7A |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_02AFED4B |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
2_2_02AFF050 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_02AF596A |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_02AF5EED |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
2_2_050A841C |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_050A8117 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_050A8346 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
2_2_050A8240 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_050A7D53 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_050A7D51 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_050A7D9E |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW, |
2_2_0509BD97 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoEx,FormatMessageA, |
2_2_05089F98 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_050A7E39 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
2_2_050A7EC4 |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Code function: EnumSystemLocalesW, |
2_2_0509B82B |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Users\user\Desktop\MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Users\user\Desktop\MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Windows VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Windows\AppReadiness VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\AppReadiness VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\AppReadiness VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
Jump to behavior |
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
Jump to behavior |