26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 1ad8785caeb5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ad8785caeb5…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8"],"about":{"@type":"SoftwareApplication","name":"a99adad8a9f9f1d9dcce30c42dd4be3a.exe","applicationCategory":["peexe","executable"],"identifier":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta81,Found string "Failed to enable compression for ssh session" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Header compression/decompression error" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "SSL_COMP_add_compression_method" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "decompression failure" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "bad compression algorithm" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "bad decompression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "compression disabled" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "illegal point compression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "inconsistent compression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "invalid compression algorithm" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "old session compression algorithm not returned" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "required compression algorithm missing" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "ssl/tls alert decompression failure" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "zlib compression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Brotli compression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Zstandard compression" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "invalid compression bit" (Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") file/memory contains long string(Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")28:T57b,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")29:T16a4,Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001608.00000000.85000.00430000.00000004.mdmp, 00000000-00001608.00000001.85406.00430000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "HMAC-DRBG-KDF" (Indicator: "HMAC"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "SSHKDF" (Indicator: "HKDF"; Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.0147B000.00000002.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp") Found reference to "%s4-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s" (Indicator: "HMAC"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "DHE-RSA-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "DHE-DSS-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "ADH-AES256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_DH_anon_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "ECDHE-ECDSA-AES256-SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" (Indicator: "SHA384"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")2a:Te67,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\")2b:T1107,Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptEnumProvidersW" (Indicator: "CryptEnumProvidersW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptGetUserKey" (Indicator: "CryptGetUserKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "CryptSignHashW" (Indicator: "CryptSignHashW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found api reference "?error CryptAcquireContextA 0x%08lx" (Indicator: "CryptAcquireContextA"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found api reference "error CryptGenRandom 0x%08lx" (Indicator: "CryptGenRandom"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")2c:Ta56,Assembly shows XOR instruction xor ecx 000000C0h in Stream UID: 00000000-00001608-33710-189-00087220 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00001608-33710-192-00086E60 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00001608-33710-192-00086E60 Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00001608-33710-193-00086D90 Assembly shows XOR instruction xor esi 0000009Eh in Stream UID: 00000000-00001608-33710-193-00086D90 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor ebp edi in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor ebp FFFFFFFFh in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor ebx edi in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00001608-33710-209-00081B10 Assembly shows XOR instruction xor ecx dword ptr [00093B1Ch] in Stream UID: 00000000-00001608-33710-994-0005C900 Assembly shows XOR instruction xor eax ACB17065h in Stream UID: 00000000-00001608-33710-1078-00058720 Assembly shows XOR instruction xor edi F2CD0048h in Stream UID: 00000000-00001608-33710-1078-00058720 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001608-33710-1664-00086F84 Assembly shows XOR instruction xor edx 000000B6h in Stream UID: 00000000-00001608-33710-1664-00086F84 Assembly shows XOR instruction xor edi C2F43346h in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor edx E4ABF66Bh in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor ebx E4ABF66Bh in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor ecx E4ABF66Bh in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor ecx 000000ECh in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor eax 24928905h in Stream UID: 00000000-00001608-33710-1790-00081204 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00001608-33710-2109-0007F1F0 Assembly shows XOR instruction xor edi 1A169566h in Stream UID: 00000000-00001608-33710-2109-0007F1F0 Assembly shows XOR instruction xor edi 8EA474C5h in Stream UID: 00000000-00001608-33710-2109-0007F1F02d:Te56,Observed string: "crypto/asn1/a_object.c" (Indicator: "crypto/asn1/a_object.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/a_strex.c" (Indicator: "crypto/asn1/a_strex.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/a_time.c" (Indicator: "crypto/asn1/a_time.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/ameth_lib.c" (Indicator: "crypto/asn1/ameth_lib.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/asn1_lib.c" (Indicator: "crypto/asn1/asn1_lib.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/asn_pack.c" (Indicator: "crypto/asn1/asn_pack.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/d2i_pr.c" (Indicator: "crypto/asn1/d2i_pr.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/tasn_dec.c" (Indicator: "crypto/asn1/tasn_dec.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/tasn_enc.c" (Indicator: "crypto/asn1/tasn_enc.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/tasn_fre.c" (Indicator: "crypto/asn1/tasn_fre.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/tasn_new.c" (Indicator: "crypto/asn1/tasn_new.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/tasn_utl.c" (Indicator: "crypto/asn1/tasn_utl.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/x_algor.c" (Indicator: "crypto/asn1/x_algor.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/x_info.c" (Indicator: "crypto/asn1/x_info.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/x_int64.c" (Indicator: "crypto/asn1/x_int64.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/asn1/x_pkey.c" (Indicator: "crypto/asn1/x_pkey.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/async/async.c" (Indicator: "crypto/async/async.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/async/async_wait.c" (Indicator: "crypto/async/async_wait.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bf_buff.c" (Indicator: "crypto/bio/bf_buff.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bf_prefix.c" (Indicator: "crypto/bio/bf_prefix.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bio_addr.c" (Indicator: "crypto/bio/bio_addr.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bio_lib.c" (Indicator: "crypto/bio/bio_lib.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bio_meth.c" (Indicator: "crypto/bio/bio_meth.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "0Ccrypto/bio/bio_print.c" (Indicator: "0Ccrypto/bio/bio_print.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "crypto/bio/bio_sock.c" (Indicator: "crypto/bio/bio_sock.c") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp2e:Tf24,Found string "SSL public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Using SSH public key file '%s'" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Using SSH private key file '%s'" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Initialized SSH public key authentication" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "SSH public key authentication failed: %s" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "SSH MD5 public key: %s" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "SSH SHA256 public key: %s" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "unable to use private key from PKCS12 file '%s'" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "private key from PKCS12 file '%s' does not match certificate in same file" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "failed to load private key from crypto engine" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "unable to set private key" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "crypto engine not set, cannot load private key" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "file type P12 for private key not supported" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "not supported file type for private key" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Certificate level %d: Public key type %s%s (%d/%d Bits/secBits), signed using %s" (Indicator: "public key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found string "Unable to open ED25519 private key file" (Indicator: "private key"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")2f:T621b,Found XOR loop in file "LummaC2.exe" at offset 256317; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 285981; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 291579; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 292919; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 294737; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 296735; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 298077; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 107015; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271488; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271508; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271512; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271520; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271920; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271940; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271956; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 291540; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 292880; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 294698; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 296696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 16723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 24183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 29759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 140835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 145527; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 234804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 278755; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 291468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 291871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 329458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 583685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 805018; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 974020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 975775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1107859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1338664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1372345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1384493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1414708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1482688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1489387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1577031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1579903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1620709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1624300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1695003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1718067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1747550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1748991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1877728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1964664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1983099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2000404; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2055567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2057235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2204147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2207618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2432407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2451587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2522799; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2627991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2830751; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2841286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3080909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3324095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3325503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3350759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3461999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3515631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3657373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3892311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3927259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4250062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4255131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4316496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4358263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4454306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4454376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4462438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4601661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4866220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5043547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5081551; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5170744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5234066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5291143; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5293618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5299900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5303942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5378759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5417482; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5478098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5495050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5497327; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5554012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5568661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5653452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5689090; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5790529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5791377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5809578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5817259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5822825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5828644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5859606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5883289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5902109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5974214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6089817; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6134771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 156643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 255083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 647466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 832329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 868565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 952163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1294477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1424097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1424153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1463819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1528841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1547689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1670543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1747127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1764758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1857750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1995867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2204597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2205132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2478357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2525939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2581514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2590232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2879274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3119866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3170752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3231519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3278502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3308699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3313198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3315602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3316446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3341528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3419427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3443915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3450742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3564351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3566342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3700529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3784547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3817034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3890426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3938908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4075225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4103217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4560773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4589964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4802515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5016506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5030764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5033600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5114060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5199058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5404146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5450229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5495099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5645933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5720529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5721977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5747019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5767702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5877115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5895453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6002004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6140484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3246454; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 136924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 168723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 313758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 376157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 386614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 403270; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 543744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 569968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 576811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 590723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 682216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 700898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 810347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 813371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 824944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 948758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1096700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1149246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1153863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1253667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1255683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1257691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1267087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1406180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1535336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1544479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1547844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611839; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1678055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1682356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1713216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1765522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1967955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2081197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2083055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2160253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2175868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2215458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2234777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2242893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2246516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2325808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2334587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2354068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2404895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2482519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2595728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2659977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2673792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2700048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2754107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2779748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2808031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2848803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2863291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2871576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2980347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3191744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3263999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3270656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3319159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3326032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3445075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3456305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3461003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3462777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3502102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3514464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3599183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3722063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3749895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3795231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3846333; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3860846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3896765; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3902463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3910816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3917924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3954959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4068841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4119639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4276331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4429530; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4461942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4481597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4550506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4728981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4737602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4829675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4876109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4955992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4970971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5112557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5150572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5185554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5224883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5263183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5275119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5305098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5379833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5422971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5431341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5447604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5493804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5525794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5560874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5572723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5601812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5603214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5619574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5625501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5641083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5653451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5672847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5681083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5692315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5694806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5715703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5738815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5738886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5762048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5810948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5859143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5874195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5874951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5879558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5883288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5885228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5886924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5902146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5902798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5924301; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5935209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5944913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5951651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5969340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5978607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5985919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5988553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5989462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5989770; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5998197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6002145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6002365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6003070; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6007409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6008254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6041978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6071731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6079191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6089553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6100509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6101689; code bytes = 803030:T12ce,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003577c8fa2f0095e13177214b1b00feffffffa8f92f00bd6b4975020000008228357724fa2f00f7994975340000c0004cf8ff00000000a14db9011800000000000000fcf92f004000000000000000e8f92f00000000000000000000000000000000000c0000000200000001012f00c2eb26770000000000003b00a8913f005d51ff12004cf8ff38001e002d00000010c33f000000000000000000d0903f0001000000a0913f0044fa2f0000293577ffffffff78fa2f00a14db901a0913f0058fa2f005c55357700003b0000000000a8913f0011243b0000000000a4892d7714a074ef (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000127111000000a8129b0000009b0048149b0095e13177c14b1b00feffffff000000002300000094f12f001100000000009b00a8129b0094f12f00145c3577435c3577c5a20177020000000c029b0000009b0050019b00000200000000000050019b0038f32f00a4013777f0f02f002300000000f8357750019b001413127160259b0000000000340000003ff00000110000000000000000000000e81e3b002cf12f000000000034000034c4009b00440000447665437269746963000000007f0000006e00006951010050d0079b0001000000000000000200000008000000 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000018000000000000003cf32f0000000000c8fa2f00a2e07b69e136447bfefffffff4f92f005c9c7b690d0c000014fa2f006f9c7b69000000000000000000000000000000000000000000000000f53b171248fa2f00ee2d7a690d0c000014fa2f00c8e1b901c8e1b901fe2d7a697cfa2f00010000000000000000001271000000009c53347776184975000000009f184975c151ff1211243b00e8efba01a76419362400000011243b00e8efba0114a074ef68fa2f0011243b0000000000845aef5d67f5ba01 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000008cf32f0018fa2f0078fa2f00a2e07b69e136447bfeffffff00000000a4892d7714a074ef34fa2f00316c0000c1f7c893c1f70000a0df267703ad663f45b2b7011225c101 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000218a63f007d6f001200000000000000000000000080000000000000007d6f0012008442000100000000000000020000000c000000a0384200a03842009b384200000000000000000000003b0000000001bcf12f0000000000dcf72f0095e1317779411b00feffffff435c35775059357794000000a00000009a384200983842009400000060f32f00fdfe267740ec2f0001000000dcf72f00a2e07b69e136447bfefffffff8f22f005c9c7b695c0c00000cf32f006f9c7b690000000000000000 (UID: 00000000-00004436)31:Tb20,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300a0ad3f001100001162690000709f420018a63f00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb4977d0cc460000e0fd7f9a5c367700e0f97f10c6b60644e0fd7f00000000400000003f0000002100000000e0fd7f04c6b606c15c367760823d772100000000e0fd7f9a5c367700e0f97f28c6b6065789357780833d7713174a75d8eb4977 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "Set-up.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004364) "Set-up.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47cb73589e5c008c47cb7300000000589e5c0030783d00086d357718813d770000000050993d00000000000000000070783d0095e1317723bf1c00feffffff6b2c367731194a7502100000000000000000010044783d00c89f35778c47cb730000000000000000 (UID: 00000000-00004364) "Set-up.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004364)32:Tabd,"Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "")33:T8ff,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SET-UP.EXE") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SET-UP.EXE") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LUMMAC2.EXE") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LUMMAC2.EXE") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ONEDRIVESETUP.EXE") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ONEDRIVESETUP.EXE"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1BB10B8C-6E63-4897-9FB2-3873CE30D7E1}") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1BB10B8C-6E63-4897-9FB2-3873CE30D7E1}"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{85379532-0003-4517-8FC4-6227B410C30C}") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{85379532-0003-4517-8FC4-6227B410C30C}"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX")34:T2d75,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter shlwapi (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter CLBCatQ.DLL (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\propsys.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter apphelp.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\urlmon.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004436) "LummaC2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001608) "LummaC2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001608) "Set-up.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004364) "Set-up.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004364)35:T96c8,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PathAddExtensionA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PathCombineA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter StrChrA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter StrToIntA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RtlFreeHeap (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleHandleExA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CopyFileExA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OpenFileMappingW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter MapViewOfFileEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004436) "LummaC2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001608) "LummaC2.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001608) "Set-up.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter if_nametoindex (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004364) "Set-up.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004364)36:T42d8,Found reference to API (Indicator: "lstrcpy"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "SelectObject"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "DeleteObject"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetObjectW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "DeleteDC"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CreateCompatibleDC"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "BitBlt"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetDIBits"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetCurrentObject"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "StretchBlt"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetCommandLineW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GlobalLock"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CreateProcessW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GlobalUnlock"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "ExitProcess"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetCurrentProcessId"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetCurrentThreadId"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetLogicalDrives"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "VariantClear"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "SysAllocString"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "VariantInit"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "SysFreeString"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "SHGetFileInfoW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetClipboardData"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "ReleaseDC"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetSystemMetrics"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CloseClipboard"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "OpenClipboard"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetForegroundWindow"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "GetDC"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CoInitializeEx"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CoUninitialize"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CoInitializeSecurity"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CoCreateInstance"; File: "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptEnumProvidersW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptGetProvParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptGetUserKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptSetHashParam"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "CryptSignHashW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")37:T459,"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SYSTEM\ControlSet001\Services\VBoxSF" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "Software\Policies\Microsoft\Windows NT\DNSClient" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp38:T761,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "Set-up.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135]39:T492,Pattern match: "ftp@example.com" Pattern match: "auth-agent-req@openssh.com" Pattern match: "direct-streamlocal@openssh.com" Pattern match: "sk-ecdsa-sha2-nistp256@openssh.com" Pattern match: "sk-ssh-ed25519@openssh.com" Pattern match: "ecdsa-sha2-nistp256-cert-v01@openssh.com" Pattern match: "ecdsa-sha2-nistp384-cert-v01@openssh.com" Pattern match: "ecdsa-sha2-nistp521-cert-v01@openssh.com" Pattern match: "ssh-ed25519-cert-v01@openssh.com" Pattern match: "ssh-rsa-cert-v01@openssh.com" Pattern match: "curve25519-sha256@libssh.org" Pattern match: "aes256-gcm@openssh.com" Pattern match: "aes128-gcm@openssh.com" Pattern match: "hmac-sha2-256-etm@openssh.com" Pattern match: "hmac-sha2-512-etm@openssh.com" Pattern match: "hmac-sha1-etm@openssh.com" Pattern match: "hmac-ripemd160@openssh.com" Pattern match: "gent@openssh.comauth" Pattern match: "auth-agent@openssh.com" Pattern match: "fsync@openssh.com" Pattern match: "efstatvfs@openssh.com" Pattern match: "estatvfs@openssh.com" Pattern match: "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" Pattern match: "sk-ssh-ed25519-cert-v01@openssh.com" Pattern match: "rijndael-cbc@lysator.liu.se"3a:T9b9,"SYSTEM\ControlSet001\Services\VBoxSF" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "Software\Policies\Microsoft\Windows NT\DNSClient" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces" in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004436.00000001.85498.003B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004436.00000001.85498.003B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004436.00000001.85498.003B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004436.00000001.85498.0696A000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004436.00000002.86750.003B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004436.00000002.86750.003B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004436.00000002.86750.003B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004436.00000002.86750.06960000.00000004.mdmp3b:T21ca,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "USER32.DLL" at base 76d50000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68440000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "ADVAPI32.DLL" at base 76230000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "NTDLL.DLL" at base 77300000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "WINMM.DLL" at base 71120000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "NTDLL" at base 77300000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "SHELL32.DLL" at base 755e0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "OLE32.DLL" at base 768e0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "KERNEL32.DLL" at base 77220000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "SHLWAPI" at base 76ea0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "MSCOREE.DLL" at base 6b910000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70a60000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "KERNEL32" at base 77220000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b880000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "SHLWAPI.DLL" at base 76ea0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "VERSION.DLL" at base 746a0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64b10000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "PSAPI.DLL" at base 75540000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "RPCRT4.DLL" at base 76be0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6b910000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63700000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "CRYPTBASE.DLL" at base 75100000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70ec0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6afc0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ca0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62480000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73dd0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "PROPSYS.DLL" at base 73f00000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "COMCTL32.DLL" at base 740d0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "OLEAUT32.DLL" at base 76c90000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "CLBCATQ.DLL" at base 75550000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73f00000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "NTMARTA.DLL" at base 74670000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76d30000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "PROFAPI.DLL" at base 75210000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "APPHELP.DLL" at base 750b0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e130000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 755e0000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75530000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76f60000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77220000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "SETUPAPI.DLL" at base 76a40000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "SECUR32.DLL" at base 74f40000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75240000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70740000 "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750b0000 "LummaC2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68440000 "LummaC2.exe" loaded module "OLE32.DLL" at base 768e0000 "LummaC2.exe" loaded module "ADVAPI32.DLL" at base 76230000 "LummaC2.exe" loaded module "KERNEL32.DLL" at base 77220000 "LummaC2.exe" loaded module "WS2_32.DLL" at base 774c0000 "LummaC2.exe" loaded module "WINHTTP.DLL" at base 70dd0000 "LummaC2.exe" loaded module "SHLWAPI.DLL" at base 76ea0000 "LummaC2.exe" loaded module "SSPICLI.DLL" at base 75090000 "LummaC2.exe" loaded module "CRYPTSP.DLL" at base 74c10000 "LummaC2.exe" loaded module "RPCRT4.DLL" at base 76be0000 "LummaC2.exe" loaded module "CREDSSP.DLL" at base 748d0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74bd0000 "LummaC2.exe" loaded module "WSHTCPIP" at base 74730000 "LummaC2.exe" loaded module "WSHIP6.DLL" at base 74bc0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71990000 "LummaC2.exe" loaded module "DNSAPI.DLL" at base 74a90000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74730000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74bc0000 "LummaC2.exe" loaded module "IPHLPAPI.DLL" at base 73570000 "LummaC2.exe" loaded module "RASADHLP.DLL" at base 71970000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734e0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74a10000 "LummaC2.exe" loaded module "CRYPT32.DLL" at base 75250000 "Set-up.exe" loaded module "IPHLPAPI.DLL" at base 73570000 "Set-up.exe" loaded module "DHCPCSVC6.DLL" at base 73480000 "Set-up.exe" loaded module "RPCRT4.DLL" at base 76be0000 "Set-up.exe" loaded module "DHCPCSVC.DLL" at base 733f0000 "Set-up.exe" loaded module "CRYPTBASE.DLL" at base 75100000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74bd0000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74bc0000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74730000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73dd0000 "Set-up.exe" loaded module "OLE32.DLL" at base 768e0000 "Set-up.exe" loaded module "ADVAPI32.DLL" at base 76230000 "Set-up.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73b40000 "Set-up.exe" loaded module "GDIPLUS.DLL" at base 73b40000 "Set-up.exe" loaded module "WINDOWSCODECS.DLL" at base 73640000 "Set-up.exe" loaded module "OLEAUT32.DLL" at base 76c900003c:T4ca,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")3d:T67f,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8" file has an entrypoint instructions - "jmp 0xf1600a,bswap esi,pop ebp,add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edx], al,add al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edi + 0x80], bl,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [edi - 0x80], bh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "LummaC2.exe" file has an entrypoint instructions - "push ebp,push ebx,push edi,push esi,sub esp, 0x224,call 0x43b340,test al, al,je 0x408a15,call 0x433fb0,test al, al,je 0x4089fe,call dword ptr [0x441d18],mov dword ptr [esp + 0xc], eax,call dword ptr [0x441d1c],mov ecx, eax,mov eax, 0xc279f17e,mov edx, 0x69c55686,shrd edx, eax, cl,shr eax, cl,test cl, 0x20,je 0x40876e,mov edx, eax,xor eax, eax,mov ecx, edx,not ecx,mov ebp, eax,not ebp,mov edi, ecx,or edi, 0x963aa979,mov esi, ebp,"3e:T442,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "LummaC2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "LummaC2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Set-up.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Set-up.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3f:Tbb2,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004436-00000C2B-319899552] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004436-00000C2B-320541947] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004436-00000C2B-322365820] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004436-00000C2B-322566765] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004436-00000C2B-322939806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004436-00000C2B-323052489] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004436-00000C2B-323493519] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004436-00000C2B-323918959] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004436-00000C2B-324022874] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004436-00000C2B-324538487] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004436-00000C2B-324635234] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004436-00000C2B-324727830] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004436-00000C2B-325231813] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004436-00000C2B-325674920] Observed system executable string:"%WINDIR%\system32\propsys.dll" [Source: 00000000-00004436-00000C2B-326898665] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00004436-00000C2B-327736855] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00004436-00000C2B-327840419] Observed system executable string:"%WINDIR%\system32\urlmon.dll" [Source: 00000000-00004436-00000C2B-328555913] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004436-00000C2B-350688735] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004364-00000C2B-384958374] Observed system executable string:"%WINDIR%\System32\VBox*.dll" [Source: 00000000-00004364-00000C2D-125870417138]40:T503,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "OLLYDBG" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "GBDYLLO" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "pediy06" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "FilemonClass" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "PROCMON_WINDOW_CLASS" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "RegmonClass" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "18467-41" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" searching for class "Regmonclass"41:Tc30,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "")42:T796,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")43:T5a9,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\system32\ntdll.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\users\%osuser%\appdata\local\temp\lummac2.exe" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "c:\users\%osuser%\appdata\local\temp\set-up.exe" "LummaC2.exe" reads file "c:\users\%osuser%\appdata\local\temp\lummac2.exe" "Set-up.exe" reads file "c:\windows\system32\drivers\etc\hosts"44:Td11,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\FLTLIB.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\MSVCP140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\VCRUNTIME140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\ucrtbase.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\api-ms-win-crt-heap-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll"45:Tcf7,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\MSVCP140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\ucrtbase.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"46:Tbd5,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\system32\mscoree.dll.local" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe.config" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\ladddad\" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.INI" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe.Local\" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LummaC2.exe:Zone.Identifier" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe:Zone.Identifier" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1AD8785CAEB519B67EA168477437D8166D9747196A46D22313F48EB4AB86FEC8.EXE.CONFIG" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\LADDDAD" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1AD8785CAEB519B67EA168477437D8166D9747196A46D22313F48EB4AB86FEC8.INI" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\1AD8785CAEB519B67EA168477437D8166D9747196A46D22313F48EB4AB86FEC8.EXE.LOCAL" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LummaC2.exe:ZONE.IDENTIFIER" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe:ZONE.IDENTIFIER" "Set-up.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe.Local\"47:T665,"LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4df168" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4e7f80" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4ddc70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4ddda8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4e1298" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4e1388" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}48:Te2a,Observed string: "SCP requires a known file size for upload" (Indicator: "scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Failed to free libssh2 scp subsystem: %d %s" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Unable to allocate a command buffer for SCP session" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "scp -%sf" (Indicator: "scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block requesting SCP startup" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block waiting for SCP response" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Failed reading SCP response" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid data in SCP response" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Unterminated response from SCP server" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, too short" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mtime" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mtime.usec" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, too short or malformed" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block waiting to send SCP ACK" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mode" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, invalid mode" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid response from SCP server, invalid size" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block sending SCP ACK" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "scp -%st" (Indicator: "scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "SCP failure" (Indicator: "scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block sending time data for SCP file" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Unable to send time data for SCP file" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Invalid SCP ACK response" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Would block send core file data for SCP file" (Indicator: " scp ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp49:Tfc2,Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001608.00000000.85000.009E0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004364.00000000.85096.01610000.00000002.mdmp, 00000000-00004364.00000001.87018.01610000.00000002.mdmp, 00000000-00004364.00000002.88939.01610000.00000002.mdmp") Found reference to API "WARNING: no socket in pollset, transfer may stall!" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Could not connect to server" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "SSL connect error" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Invalid socket argument" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Unix socket path too long: '%s'" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Timeout waiting for socket becoming writable" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Error while waiting for socket becoming writable" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "SSH CONNECT phase done" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Couldn't bind to interface '%s' with errno %d: %s" (Indicator: " bind "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Couldn't bind to '%s' with errno %d: %s" (Indicator: " bind "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "%s socket %d connected: [%s:%d] -> [%s:%d]" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "%s connect -> %d, connected=%d" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "Failed to connect to %s port %u after %lld ms: %s" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "%s connect timeout after %lldms, move on!" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "query connect reply: %dms" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "[%s] protocol connect phase DONE" (Indicator: " connect "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found reference to API "[%s] ftp_state_use_port(), socket bound to port %d" (Indicator: " socket "; Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp")4a:T3dfb,Found URL "https://httpbin.org/ip:1]:0+u2.16.840.1.113733.1.7.1.1'u1.3.6.1.4.1.311.10.11.85o+u1.2.840.10045.4.3vl(u1.2.840.10045.2.1r+u1.2.840.113549.1.1.10u+u1.2.840.113549.1.1.7" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "https://httpbin.org/ip0/443/httpbin.orgprovider=default,fips=yes,input=pvkprovider=default,fips=yes,input=pemhttp://crl.r2m01.amazontrust.com/r2m01.crlcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey@pewp@@ssxcomputername=hapubws-pc" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://crl.rootg2.amazontrust.com/rootg2.crlhosthttpbin.org0200*http://crl.r2m01.amazontrust.com/r2m01.crlprovider=default,fips=yes,input=msblob:authorityhttpbin.org2-a6e8-8c:\windows\system32\drivers\etc\hostshttpbin.orgencryptedprivatekeyinfoaes-256-wrap-padaes-256-wrap-padaes-192-wrap-padaes-192-wrap-padaes-128-wrap-padaes-128-wrap-padaes-256-wrap-invaes-256-wrap-invaes-192-wrap-invaes-192-wrap-invaes-128-wrap-invaes-128-wrap-invaria256aria192aria128des3sm4-gcmsm4-gcmsm4-ccmsm4-ccmsm4-ecbsm4-cbcsm4-ctraes-256-wrap-pad-invaes256-wrap-pad-invaes-256-wrap-pad-invaes-192-wrap-pad-invaes192-wrap-pad-invaes-192-wrap-pad-invaes-128-wrap-pad-invaes128-wrap-pad-invaes-128-wrap-pad-invcamellia-256-ecbcamellia-192-ecbcamellia-128-ecbcamellia-256-cbccamellia-192-cbccamellia-128-cbccamellia-128-cbc-ctscamellia-128-cbc-ctscamellia-192-cbc-ctscamellia-192-cbc-ctscamellia-256-cbc-ctscamellia-256-cbc-ctscamellia-256-ofbcamellia-192-ofbcamellia-128-ofbcamellia-256-cfbcamellia-192-cfbcamellia-128-cfbcamellia-256-cfb1camellia-256-cfb1camellia-192-cfb1camellia-192-cfb1camellia-128-cfb1camellia-128-cfb1camellia-256-cfb8camellia-256-cfb8camellia-192-cfb8camellia-192-cfb8camellia-128-cfb8camellia-128-cfb8camellia-256-ctrcamellia-192-ctrcamellia-128-ctr1.2.156.10197.1.104.81.2.156.10197.1.104.9des3-wrapdes-ede-ecbdes-ede-ecbdes-ede-cbcdes-ede-cbcagc/des-ede-ofbdes-ede-ofbdes-ede-cfbdes-ede-cfbsm4-ofb128sm4-cfb128chacha20chacha20sm4-ofbsm4-cfbsm4-xtssm4-xtssha-1sha1sha-224sha-256sha-384sha-512ripemdrmd160nulled25519ed448ecdsa1.2.156.10197.1.104.10chacha20-poly1305chacha20-poly1305+sz1e_e(%" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://crl.r2m01.amazontrust.com/r2m01.crl0ui0g0-!http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.cer0u\0.o8lt0o6goja" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0arizona1scottsdale1%0" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.ceramazon1amazon" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://crl.r2m01.amazontrust.com/r2m01.crl0ui0g0-!http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.cer0u\0.o8lt0m0/" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cerarizona1scottsdale1%0" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://crl.rootca1.amazontrust.com/rootca1.crlamazon1amazon" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl00j0." - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.ceramazon1amazon" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0l>;$&1.2.840.113549.1.5.12http://crl.rootca1.amazontrust.com/rootca1.crlhttp://crl.rootg2.amazontrust.com/rootg2.crlhost:" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amaom0:.http://crt.rootca1.amazontrustvz" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "http://crl.rootca1.amqz" - Source: "00000000-00004364.00000000.85096.00520000.00000004.mdmp") Found URL "https://httpbin.org/ip:1]:0+u2.16.840.1.113733.1.7.1.1'u1.3.6.1.4.1.311.10.11.85o+u1.2.840.10045.4.3vl(u1.2.840.10045.2.1r+u1.2.840.113549.1.1.10u+u1.2.840.113549.1.1.7" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "https://httpbin.org/ip0/443/httpbin.orgprovider=default,fips=yes,input=pvkprovider=default,fips=yes,input=pemhttp://crl.r2m01.amazontrust.com/r2m01.crlcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey@pewp@@ssxcomputername=hapubws-pc" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://crl.rootg2.amazontrust.com/rootg2.crlhosthttpbin.org0200*http://crl.r2m01.amazontrust.com/r2m01.crlprovider=default,fips=yes,input=msblob:authorityhttpbin.org2-a6e8-8c:\windows\system32\drivers\etc\hostshttpbin.orgencryptedprivatekeyinfoaes-256-wrap-padaes-256-wrap-padaes-192-wrap-padaes-192-wrap-padaes-128-wrap-padaes-128-wrap-padaes-256-wrap-invaes-256-wrap-invaes-192-wrap-invaes-192-wrap-invaes-128-wrap-invaes-128-wrap-invaria256aria192aria128des3sm4-gcmsm4-gcmsm4-ccmsm4-ccmsm4-ecbsm4-cbcsm4-ctraes-256-wrap-pad-invaes256-wrap-pad-invaes-256-wrap-pad-invaes-192-wrap-pad-invaes192-wrap-pad-invaes-192-wrap-pad-invaes-128-wrap-pad-invaes128-wrap-pad-invaes-128-wrap-pad-invcamellia-256-ecbcamellia-192-ecbcamellia-128-ecbcamellia-256-cbccamellia-192-cbccamellia-128-cbccamellia-128-cbc-ctscamellia-128-cbc-ctscamellia-192-cbc-ctscamellia-192-cbc-ctscamellia-256-cbc-ctscamellia-256-cbc-ctscamellia-256-ofbcamellia-192-ofbcamellia-128-ofbcamellia-256-cfbcamellia-192-cfbcamellia-128-cfbcamellia-256-cfb1camellia-256-cfb1camellia-192-cfb1camellia-192-cfb1camellia-128-cfb1camellia-128-cfb1camellia-256-cfb8camellia-256-cfb8camellia-192-cfb8camellia-192-cfb8camellia-128-cfb8camellia-128-cfb8camellia-256-ctrcamellia-192-ctrcamellia-128-ctr1.2.156.10197.1.104.81.2.156.10197.1.104.9des3-wrapdes-ede-ecbdes-ede-ecbdes-ede-cbcdes-ede-cbcagc/des-ede-ofbdes-ede-ofbdes-ede-cfbdes-ede-cfbsm4-ofb128sm4-cfb128chacha20chacha20sm4-ofbsm4-cfbsm4-xtssm4-xtssha-1sha1sha-224sha-256sha-384sha-512ripemdrmd160nulled25519ed448ecdsa1.2.156.10197.1.104.10chacha20-poly1305chacha20-poly1305+sz1e_e(%" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://crl.r2m01.amazontrust.com/r2m01.crl0ui0g0-!http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.cer0u\0.o8lt0o6goja" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl0arizona1scottsdale1%0" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0b7b\chlw91_" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.ceramazon1amazon" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://crl.r2m01.amazontrust.com/r2m01.crl0ui0g0-!http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.cer0u\0.o8lt0m0/" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cerarizona1scottsdale1%0" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://crl.rootca1.amazontrust.com/rootca1.crlamazon1amazon" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl00j0." - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.ceramazon1amazon" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0l>;$&1.2.840.113549.1.5.12http://crl.rootca1.amazontrust.com/rootca1.crlhttp://crl.rootg2.amazontrust.com/rootg2.crlhost:" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.rootca1.amaom0:.http://crt.rootca1.amazontrustvz" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://crl.rootca1.amqz" - Source: "00000000-00004364.00000001.87018.00520000.00000004.mdmp") Found URL "http://ocsp.r2m01.amazontrust.com06*http://crt.r2m01.amazontrust.com/r2m01.cer2m01p.r2r2m0swmsm" - Source: "00000000-00004364.00000002.88939.00520000.00000004.mdmp") Found URL "http://crl.rootca1.amazontrust.com/rootca1.crlamazon1amazon" - Source: "00000000-00004364.00000002.88939.00520000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0l>;$&1.2.840.113549.1.5.12winpcap" - Source: "00000000-00004364.00000002.88939.00520000.00000004.mdmp") Found URL "http://home.fortth14ht.top/ntrmovgoaovbjpksulkp13failed" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://localhost:%d/jsonget" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://httpbin.org/ipbefore" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00004364.00000002.88939.0147B000.00000002.mdmp") Found URL "http:// %d" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "Shutdown" (Indicator: "shutdown") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown ongoing" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown finished" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown not received, but closed" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown sent, want receive" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown send blocked" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp Observed string: "shutdown while in init" (Indicator: "shutdown ") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp58:T9eb,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "")59:T457,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"5a:T609,"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00004436) "1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe" called "Process32NextW with parameter System" (UID: 00000000-00004436) "Set-up.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter System" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00004364) "Set-up.exe" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00004364)5b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791588249015,"unified_at":"2026-10-09T23:24:09.015Z","metadata":{"hashes":{"sha256":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","sha1":"62a01c957ca7d637a1d8090475c4ef2843100bb8","md5":"a99adad8a9f9f1d9dcce30c42dd4be3a","sha512":"ef4d785015f24cdf4339e9ab0ce8f824456e3b60d9d605fedaeec2403797b4490949bebb248cc076d1fa3d031f82eb86d517bc1cdb4e009e413433d84a29b20c","ssdeep":"98304:Xez8a1mzYrkxZ8VYKOwErakov9RUxHJTjrhrpLpMOz8C+kj36YtKonKG6Lq7zzYf:Xez12Yo38VLEraBA3nhLMOJ+I3NtKonr","ssdeep_chunks":["98304:Xez8a1m","98304:ez8a1mz","98304:z8a1mzY","98304:8a1mzYr","98304:a1mzYrk","98304:1mzYrkx","98304:mzYrkxZ","98304:zYrkxZ8","98304:YrkxZ8V","98304:rkxZ8VY","98304:kxZ8VYK","98304:xZ8VYKO","98304:Z8VYKOw","98304:8VYKOwE","98304:VYKOwEr","98304:YKOwEra","98304:KOwErak","98304:OwErako","98304:wErakov","98304:Erakov9","98304:rakov9R","98304:akov9RU","98304:kov9RUx","98304:ov9RUxH","98304:v9RUxHJ","98304:9RUxHJT","98304:RUxHJTj","98304:UxHJTjr","98304:xHJTjrh","98304:HJTjrhr","98304:JTjrhrp","98304:TjrhrpL","98304:jrhrpLp","98304:rhrpLpM","98304:hrpLpMO","98304:rpLpMOz","98304:pLpMOz8","98304:LpMOz8C","98304:pMOz8C+","98304:MOz8C+k","98304:Oz8C+kj","98304:z8C+kj3","98304:8C+kj36","98304:C+kj36Y","98304:+kj36Yt","98304:kj36YtK","98304:j36YtKo","98304:36YtKon","98304:6YtKonK","98304:YtKonKG","98304:tKonKG6","98304:KonKG6L","98304:onKG6Lq","98304:nKG6Lq7","98304:KG6Lq7z","98304:G6Lq7zz","98304:6Lq7zzY","98304:Lq7zzYf","196608:Xez8a1m","196608:ez8a1mz","196608:z8a1mzY","196608:8a1mzYr","196608:a1mzYrk","196608:1mzYrkx","196608:mzYrkxZ","196608:zYrkxZ8","196608:YrkxZ8V","196608:rkxZ8VY","196608:kxZ8VYK","196608:xZ8VYKO","196608:Z8VYKOw","196608:8VYKOwE","196608:VYKOwEr","196608:YKOwEra","196608:KOwErak","196608:OwErako","196608:wErakov","196608:Erakov9","196608:rakov9R","196608:akov9RU","196608:kov9RUx","196608:ov9RUxH","196608:v9RUxHJ","196608:9RUxHJT","196608:RUxHJTj","196608:UxHJTjr","196608:xHJTjrh","196608:HJTjrhr","196608:JTjrhrp","196608:TjrhrpL","196608:jrhrpLp","196608:rhrpLpM","196608:hrpLpMO","196608:rpLpMOz","196608:pLpMOz8","196608:LpMOz8C","196608:pMOz8C+","196608:MOz8C+k","196608:Oz8C+kj","196608:z8C+kj3","196608:8C+kj36","196608:C+kj36Y","196608:+kj36Yt","196608:kj36YtK","196608:j36YtKo","196608:36YtKon","196608:6YtKonK","196608:YtKonKG","196608:tKonKG6","196608:KonKG6L","196608:onKG6Lq","196608:nKG6Lq7","196608:KG6Lq7z","196608:G6Lq7zz","196608:6Lq7zzY","196608:Lq7zzYf","98304:Xez12Yo","98304:ez12Yo3","98304:z12Yo38","98304:12Yo38V","98304:2Yo38VL","98304:Yo38VLE","98304:o38VLEr","98304:38VLEra","98304:8VLEraB","98304:VLEraBA","98304:LEraBA3","98304:EraBA3n","98304:raBA3nh","98304:aBA3nhL","98304:BA3nhLM","98304:A3nhLMO","98304:3nhLMOJ","98304:nhLMOJ+","98304:hLMOJ+I","98304:LMOJ+I3","98304:MOJ+I3N","98304:OJ+I3Nt","98304:J+I3NtK","98304:+I3NtKo","98304:I3NtKon","98304:3NtKonr"],"imphash":"2eabe9054cad5152567f0699947a2c5b","pehash":"8cc33cbff9495ef69e8b0295bb4dacc16c7c1f38"},"file_info":{"file_name":"a99adad8a9f9f1d9dcce30c42dd4be3a.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6156288,"entropy":8,"compile_timestamp":"2024-12-26T17:30:19","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1735285247000,"last_seen":1787872803000,"last_multi_scan":1787872803000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":" ","virtual_address":"0x2000","virtual_size":7159808,"raw_size":4445696},{"name":".rsrc","virtual_address":"0x6d6000","virtual_size":1340,"raw_size":1024},{"name":".idata ","virtual_address":"0x6d8000","virtual_size":8192,"raw_size":512},{"name":" ","virtual_address":"0x6da000","virtual_size":2736128,"raw_size":512},{"name":"lfpzggwa","virtual_address":"0x976000","virtual_size":1695744,"raw_size":1690624},{"name":"ncmmphhn","virtual_address":"0xb14000","virtual_size":8192,"raw_size":1024},{"name":".taggant","virtual_address":"0xb16000","virtual_size":16384,"raw_size":8704}],"section_names":[" ",".rsrc",".idata "," ","lfpzggwa","ncmmphhn",".taggant"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":85},"sandbox_signatures":{"informative_count":169,"suspicious_count":18,"malicious_count":6,"total":193},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.Themida","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.571947","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.571947 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Agent.g!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdebc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.AXUQ-0127","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XKN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.ShortLoader.Win32.29","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"LummaStealer","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"RENAISSANCE SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Contains ability to empty the Recycle Bin on the specified drive"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual environment using sandbox registry"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to transfer files using SCP"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform CAST-128/CAST-256 encryption"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"^$.km\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$27","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"after MemoryLoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" queried SystemProcessInformation at 00000000-00004436-00000105-10644805 [PID: 4436]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00004364-00000105-52833859 [PID: 4364]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00004364-00000105-52834296 [PID: 4364]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00004364-00000105-52835797 [PID: 4364]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00004364-00000105-52872421 [PID: 4364]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00004364-00000105-52883609 [PID: 4364]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CAST-128/CAST-256 encryption","description":"Found string \"cast128-cbc\" (Indicator: \"CAST128\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":1,"id":"string-599","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001608.00000000.85000.00430000.00000004.mdmp, 00000000-00001608.00000001.85406.00430000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98352","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains ability to perform CAST-128/CAST-256 encryption\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"%WINDIR%\\System32\\VBox*.dll\" (Source: \"00000000-00004364-00000C2D-125870417138\")\n Found string \"C:\\Windows\\System32\\VBox*.dll\" (Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004436-00000C2C-318827498\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004436-00000C2C-318827498\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"LummaC2.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"system\\controlset001\\services\\vboxsf\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004436-00000C2C-322564673\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004436-00000C2C-322565414\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004436-00000C2C-328402006\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001608-00000C2C-337428452\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004436)\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004436)\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004436)\n \"LummaC2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001608)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"IsWow64Process\" with parameter \"4436\" - (UID: 00000000-00004436)\n \"Set-up.exe\" called \"IsWow64Process\" with parameter \"4364\" - (UID: 00000000-00004364)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Set-up.exe\" called \"EnumWindows\" with parameter \"4055968\" - (UID: 00000000-00004364)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetWindowTextA\" (UID: 00000000-00004436)\n \"Set-up.exe\" called \"GetWindowTextA\" (UID: 00000000-00004364)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"CiceroUIWndFrame\" - (UID: 00000000-00004364)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Start\" - (UID: 00000000-00004364)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Network Flyout\" - (UID: 00000000-00004364)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Task Switching\" - (UID: 00000000-00004364)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Start menu\" - (UID: 00000000-00004364)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004436)\n \"Set-up.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004364)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00001608-33710-509-000735F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"LummaC2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-821591\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-66873120\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-67305574\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-67537604\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-67756278\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-67990611\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00004364-0000010C-68224712","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"LummaC2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Set-up.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$33","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"LummaC2.exe\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\LummaC2.exe\"\" - (UID: 00000000-00004436)\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Set-up.exe\"\" - (UID: 00000000-00004436)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"100.60.124.177:443\"\n \"23.38.160.237:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004364.00000001.87018.015D2000.00000004.mdmp, 00000000-00004364.00000002.88939.015D2000.00000004.mdmp, 00000000-00004364.00000003.89165.015D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004436-00000574-10662796\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004436-00000574-10662947\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004436-00000574-10667082\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n Process 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process Set-up.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\My_mutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"LummaC2.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\openssh-ssh-agent","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"k.pst\" (Indicator: \".pst\") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77460000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63700000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Set-up.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64360000\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64B10000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BE0000\n \"LummaC2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BE0000\n \"Set-up.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020737c69@ADVAPI32.dll\"\n \"0e000f00e4737c69@ADVAPI32.dll\"\n \"0e000f0050747c69@ADVAPI32.dll\"\n \"11001200d47d7c69@ADVAPI32.dll\"\n \"110012007c7e7c69@ADVAPI32.dll\"\n \"12001300cc7e7c69@ADVAPI32.dll\"\n \"12001300387f7c69@ADVAPI32.dll\"\n \"14001500e4b77c69@ADVAPI32.dll\"\n \"1400150000b87c69@ADVAPI32.dll\"\n \"140015001cb87c69@ADVAPI32.dll\"\n \"1700180038b87c69@ADVAPI32.dll\"\n \"0d000e0054b87c69@ADVAPI32.dll\"\n \"1100120064b87c69@ADVAPI32.dll\"\n \"110012007cb87c69@ADVAPI32.dll\"\n \"0d000e009c7f7c69@shell32.dll\"\n \"0d000e0028807c69@shell32.dll\"\n \"0f001000ecb97c69@ADVAPI32.dll\"\n \"1400150038ba7c69@ADVAPI32.dll\"\n \"1400150054ba7c69@ADVAPI32.dll\"\n \"0c000d00a8ba7c69@ADVAPI32.dll\"\n \"0c000d00b8ba7c69@ADVAPI32.dll\"\n \"0e000f00c8ba7c69@ADVAPI32.dll\"\n \"0e000f00dcba7c69@ADVAPI32.dll\"\n \"0b000c00f0ba7c69@ADVAPI32.dll\"\n \"180019008cbd7c69@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an executable section named \"\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an executable section named \"lfpzggwa\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an executable section named \"ncmmphhn\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an executable section named \".taggant\"\n \"LummaC2.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \"\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \".rsrc\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \".idata\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \"lfpzggwa\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \"ncmmphhn\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an writable section named \".taggant\"\n \"LummaC2.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x43d600\" greater than 0x100000\n Raw size of \"lfpzggwa\" is \"0x19cc00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x6d4000\" greater than 0x100000\n Virtual size of \"\" is \"0x29c000\" greater than 0x100000\n Virtual size of \"lfpzggwa\" is \"0x19e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"LummaC2.exe\" (UID: 00000000-00001608) was launched with new environment variables: \"XBH_FNT=\"1900544\", USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"LummaC2.exe\" (UID: 00000000-00001608) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"censeractersj.click\"\n \"home.fortth14ht.top\"\n \"httpbin.org\"\n \"steamcommunity.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$40","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"LummaC2.exe\" (UID: 00000000-00001608)\n Spawned process \"Set-up.exe\" (UID: 00000000-00004364)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"LummaC2.exe\" (UID: 00000000-00001608)\n Spawned process \"Set-up.exe\" (UID: 00000000-00004364)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 5210410)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Amazon RSA 2048 M01, O=Amazon, C=US\" (SHA1: BE:92:90:DB:BE:70:82:16:AE:8B:6B:F2:FB:27:0A:9E:28:30:85:04; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Amazon Root CA 1, O=Amazon, C=US\" (SHA1: 2A:D9:74:A7:75:F7:3C:BD:BB:D8:F5:AC:3A:49:25:5F:A8:FB:1F:8C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Starfield Services Root Certificate Authority - G2, O=\"Starfield Technologies\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"LummaC2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LummaC2.exe\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Set-up.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" connecting to \"\\ThemeApiPort\"\n \"Set-up.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"after MemoryLoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00004436]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Able to identify virtual environment using sandbox registry\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\lummac2.exe\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\set-up.exe\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" writes file \"%temp%\\lummac2.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, GenP\" (Indicator: \"ping \"; Source: \"00000000-00001608.00000000.85000.00430000.00000004.mdmp, 00000000-00001608.00000001.85406.004C9000.00000004.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$47","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001608-00000C2C-338806703\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001608-00000C2C-338807006\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp\n Observed string: \"curl user interface\" (Indicator: \"curl \") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp\n Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"$48","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"imap.c\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"pop3.c\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"smtp.c\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]\n Observed email domain:\"~mx.enscale\" [Source: 00000000-00004364.00000002.88939.0147B000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 0149f47eabf9a20d0893e2a44e5a6323\n Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00004364.00000000.85096.00520000.00000004.mdmp, 00000000-00004364.00000001.87018.00520000.00000004.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"100.60.124.177\" on port \"443\"\n HTTPS traffic to \"23.38.160.237\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"LummaC2.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: LummaC2.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"sftp.c\" (Indicator: \"sftp.\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00001608.00000001.85406.00430000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001608.00000001.85406.00430000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001608.00000001.85406.004C9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"LummaC2.exe\")\n Found string \"GetClipboardData\" (File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found string \"GetClipboardData\" (Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" tries to directly access volume data \"C:\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" tries to directly access volume data \"Z:\"\n \"Set-up.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"LummaC2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Set-up.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")\n Found reference to API \"CreateToolhelp32Snapshot failed.\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"Module32First\" (Indicator: \"Module32First\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"after MemoryGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")\n Found reference to API \"calling getsockname()\" (Indicator: \"getsockname\"; Source: \"00000000-00004364.00000002.88939.0147B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$54","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"Set-up.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"file/memory contains long string(File: \"LummaC2.exe\")\n Found string \"SHEmptyRecycleBinW\" (File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$57","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001608.00000000.85000.00090000.00000002.mdmp, 00000000-00001608.00000000.85000.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"LummaC2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" opened \"\\Device\\KsecDD\"\n \"Set-up.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,services.exe,winlogon.exe,spoolsv.exe,wininit.exe\" (Source: \"00000000-00004364.00000002.88939.00520000.00000004.mdmp, 00000000-00004364.00000003.89165.00520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00004436]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has section name with entropy \"7.981974155379952\"\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has section name lfpzggwa with entropy \"7.953387010367614\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00004436]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" wrote 37376 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LummaC2.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010400 ...\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" wrote 35464 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Set-up.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 100.60.124.177 on port 443 is sent without HTTP header\n TCP traffic to 23.38.160.237 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.DLL at 00000000-00001608-33710-571-00071140","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4901081e\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2d01081b\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"540101a8\"\n \"cx\": \"1280\"\n \"cy\": \"1024\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$5a","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00001608-33710-209-00081B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@USER32.DLL at 00000000-00001608-33710-209-00081B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" claimed CRC 6193248 while the actual is CRC 6178084","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineW\n CreateProcessW\n GetSystemDirectoryW\n GetLogicalDrives\n GetClipboardData","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"intel_graph":{"map":{"Adversary:3f37a04b8b19f66de435857e436008e546080ab377197c71c0f42a54a50897d9":{"type":"Adversary","value":"RENAISSANCE SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:0f867793d504480bbc3932b0912a477a95dfddaea4bf538ff2e544600f65cc9d":{"type":"Domain","value":"censeractersj.click","verdict":{"verdict":"unknown"}},"Domain:917ed0899683ad618c54995d164ccb3f34738f1304dc2f4f2472e7e30e6a5838":{"type":"Domain","value":"httpbin.org","verdict":{"verdict":"unknown"}},"Domain:91fdb98fa980872a3372931757acb29a67d457bfea0bfcf93f8a86348df653c8":{"type":"Domain","value":"bashfulacid.lat","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:home.fortth14ht.top":{"type":"Domain","value":"home.fortth14ht.top"},"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8":{"type":"File","value":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","Detected suspicious dynamic behaviour","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat LummaStealer","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355":{"type":"File","value":"b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a":{"type":"File","value":"b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db":{"type":"File","value":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat LummaStealer","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:100.60.124.177":{"type":"Ip","value":"100.60.124.177"},"Ip:23.38.160.237":{"type":"Ip","value":"23.38.160.237"},"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49":{"type":"Threat","value":"LummaStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat LummaStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},"Url:04c8162280ba2e72e163f8cd756d30b2f342b9fc8bc5edee945fb0891819818d":{"type":"Url","value":"http://manyrestro.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:15f1e7ad773772337843addc106d07192952439ac51d7dabe1af41b8c03b1f9b":{"type":"Url","value":"http://bashfulacid.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:20b6856614e99b7b3da113d735e2c0b05ae31d3d247766ab05f25869848d0900":{"type":"Url","value":"http://censeractersj.click:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:7c0880a2a5426b2336a05330b18c8b91149b02439c79589f6a8fa4e0344aa5e8":{"type":"Url","value":"http://slipperyloo.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:b3fc8959365ce7d7a4cbeae99bc39ddfbf764fad0e6f6c8f67805ad03a85fcec":{"type":"Url","value":"http://curverpluch.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:c4855beb7f29f45dc8f15438c4bca879559cd3dbfe25e6c2f9be655290cadde0":{"type":"Url","value":"http://talkynicer.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:e2574a1a2b3c7981be8c8223866ad0842b729e05163b6941d835eeb2aa378ba5":{"type":"Url","value":"http://shapestickyr.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f47c92a3510a8cafcfdbd0f597fc8c444bb769e2a78dc24ec76fe2befa02f0b9":{"type":"Url","value":"http://tentabatte.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f5c047e94dbeca7f44dbb607331e4df1cea20d518232614d8f3fe0bc86d1f4ec":{"type":"Url","value":"http://wordyfindy.lat:80","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542675119836404528","root":"Domain:91fdb98fa980872a3372931757acb29a67d457bfea0bfcf93f8a86348df653c8","edges":[],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1542675116778816829","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","Detected suspicious dynamic behaviour","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat LummaStealer","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},{"id":"1542675112882222869","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:0f867793d504480bbc3932b0912a477a95dfddaea4bf538ff2e544600f65cc9d"}],"verdict":{"verdict":"unknown"}},{"id":"1542675112878028541","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:917ed0899683ad618c54995d164ccb3f34738f1304dc2f4f2472e7e30e6a5838"}],"verdict":{"verdict":"unknown"}},{"id":"1542675134487168820","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},{"id":"1542675112886417183","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"is_threat","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611499","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:04c8162280ba2e72e163f8cd756d30b2f342b9fc8bc5edee945fb0891819818d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417186","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:15f1e7ad773772337843addc106d07192952439ac51d7dabe1af41b8c03b1f9b"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417189","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:20b6856614e99b7b3da113d735e2c0b05ae31d3d247766ab05f25869848d0900"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611505","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:7c0880a2a5426b2336a05330b18c8b91149b02439c79589f6a8fa4e0344aa5e8"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417192","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:b3fc8959365ce7d7a4cbeae99bc39ddfbf764fad0e6f6c8f67805ad03a85fcec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611508","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:c4855beb7f29f45dc8f15438c4bca879559cd3dbfe25e6c2f9be655290cadde0"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611502","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:e2574a1a2b3c7981be8c8223866ad0842b729e05163b6941d835eeb2aa378ba5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611511","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:f47c92a3510a8cafcfdbd0f597fc8c444bb769e2a78dc24ec76fe2befa02f0b9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611514","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355"},{"edge_kind":"contains_c2_config","from_key":"File:b087358007f10e6f9cc5278bffa36fbe3eab4d22cd900ba24decc62599631355","to_key":"Url:f5c047e94dbeca7f44dbb607331e4df1cea20d518232614d8f3fe0bc86d1f4ec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417182","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"is_threat","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611498","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:04c8162280ba2e72e163f8cd756d30b2f342b9fc8bc5edee945fb0891819818d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417185","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:15f1e7ad773772337843addc106d07192952439ac51d7dabe1af41b8c03b1f9b"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417188","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:20b6856614e99b7b3da113d735e2c0b05ae31d3d247766ab05f25869848d0900"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611504","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:7c0880a2a5426b2336a05330b18c8b91149b02439c79589f6a8fa4e0344aa5e8"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417191","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:b3fc8959365ce7d7a4cbeae99bc39ddfbf764fad0e6f6c8f67805ad03a85fcec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611507","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:c4855beb7f29f45dc8f15438c4bca879559cd3dbfe25e6c2f9be655290cadde0"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611501","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:e2574a1a2b3c7981be8c8223866ad0842b729e05163b6941d835eeb2aa378ba5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611510","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:f47c92a3510a8cafcfdbd0f597fc8c444bb769e2a78dc24ec76fe2befa02f0b9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611513","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"memory","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a"},{"edge_kind":"contains_c2_config","from_key":"File:b1c4a054c4c91ecfe2f0f204582a1bb9f3a14664ce4ccd1874d1cb4f8f072d5a","to_key":"Url:f5c047e94dbeca7f44dbb607331e4df1cea20d518232614d8f3fe0bc86d1f4ec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675121883588717","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"is_threat","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417193","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:04c8162280ba2e72e163f8cd756d30b2f342b9fc8bc5edee945fb0891819818d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417184","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:15f1e7ad773772337843addc106d07192952439ac51d7dabe1af41b8c03b1f9b"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417187","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:20b6856614e99b7b3da113d735e2c0b05ae31d3d247766ab05f25869848d0900"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611503","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:7c0880a2a5426b2336a05330b18c8b91149b02439c79589f6a8fa4e0344aa5e8"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112886417190","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:b3fc8959365ce7d7a4cbeae99bc39ddfbf764fad0e6f6c8f67805ad03a85fcec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611506","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:c4855beb7f29f45dc8f15438c4bca879559cd3dbfe25e6c2f9be655290cadde0"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611500","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:e2574a1a2b3c7981be8c8223866ad0842b729e05163b6941d835eeb2aa378ba5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611509","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:f47c92a3510a8cafcfdbd0f597fc8c444bb769e2a78dc24ec76fe2befa02f0b9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675112890611512","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"contains_c2_config","from_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","to_key":"Url:f5c047e94dbeca7f44dbb607331e4df1cea20d518232614d8f3fe0bc86d1f4ec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542675121025875457","root":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat LummaStealer","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat LummaStealer","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},{"id":"1542675119834529593","root":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49","edges":[{"edge_kind":"used_by","from_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49","to_key":"Adversary:3f37a04b8b19f66de435857e436008e546080ab377197c71c0f42a54a50897d9"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"contacted_ip","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Ip:100.60.124.177"},{"edge_kind":"contacted_ip","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Ip:23.38.160.237"},{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:0f867793d504480bbc3932b0912a477a95dfddaea4bf538ff2e544600f65cc9d"},{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:917ed0899683ad618c54995d164ccb3f34738f1304dc2f4f2472e7e30e6a5838"},{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:home.fortth14ht.top"},{"edge_kind":"contacted_domain","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:23.38.160.237"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","edges":[{"edge_kind":"dropped","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"extracted","from_key":"File:1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":106,"dropped_files_count":1,"extracted_files_count":1,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":3,"embedded_urls_count":9,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a8323957a3d910332099c57","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","analysis_start_time":"2026-08-17T15:07:03+00:00","indicators_count":{"informative":169,"suspicious":52,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"100.60.124.177","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"address":"23.38.160.237","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"dns_resolutions":[{"domain":"censeractersj.click","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"domain":"httpbin.org","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"domain":"home.fortth14ht.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"domain":"steamcommunity.com","address":"23.38.160.237","ttl":10,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"http_requests":null,"embedded_domains":[{"value":"bashfulacid.lat","sources":[{"report_type":"qsp","report_id":""}]},{"value":"censeractersj.click","sources":[{"report_type":"qsp","report_id":""}]},{"value":"httpbin.org","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"http://talkynicer.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://slipperyloo.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://censeractersj.click:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://shapestickyr.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://bashfulacid.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://wordyfindy.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://manyrestro.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://curverpluch.lat:80","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://tentabatte.lat:80","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}],"processes":[{"pid":4436,"ppid":0,"name":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe","command_line":"","sha256":"1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8","normalized_path":"C:\\1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8.exe","uid":"00000000-00004436","icon":"$5b"},{"pid":1608,"ppid":4436,"name":"LummaC2.exe","command_line":"","sha256":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","normalized_path":"%TEMP%\\LummaC2.exe","parent_uid":"00000000-00004436","uid":"00000000-00001608"},{"pid":4364,"ppid":4436,"name":"Set-up.exe","command_line":"","sha256":"73aa5ee19f0ea048dcff2f44d6fd5ac41c13e2d7e61371459e756836f72cad43","normalized_path":"%TEMP%\\Set-up.exe","parent_uid":"00000000-00004436","uid":"00000000-00004364"}],"all_imported_dlls":["advapi32.dll","psapi.dll","crypt32.dll","cryptsp.dll","wshqos.dll","bcrypt.dll","api-ms-win-crt-convert-l1-1-0.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","shell32.dll","clrjit.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msasn1.dll","api-ms-win-crt-private-l1-1-0.dll","fltLib.dll","ucrtbase.dll","mscorrc.dll","profapi.dll","sspicli.dll","lpk.dll","api-ms-win-core-timezone-l1-1-0.dll","clr.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","webio.dll","WSHTCPIP.DLL","IPHLPAPI.DLL","rpcrt4.dll","mscoree.dll","credssp.dll","dhcpcsvc.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","System.Core.ni.dll","uxtheme.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","FWPUCLNT.DLL","vcruntime140.dll","msctf.dll","version.dll","winnsi.dll","tzres.dll","KernelBase.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","ole32.dll","vcruntime140_clr0400.dll","Wldap32.dll","iertutil.dll","devobj.dll","oleaut32.dll","mscoreei.dll","ntmarta.dll","api-ms-win-downlevel-user32-l1-1-0.dll","userenv.dll","secur32.dll","mswsock.dll","dhcpcsvc6.dll","api-ms-win-crt-locale-l1-1-0.dll","VxSSL32.dll","ws2_32.dll","user32.dll","api-ms-win-core-file-l1-2-0.dll","shlwapi.dll","comctl32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","imm32.dll","cryptbase.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","wship6.dll","schannel.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","mscorlib.ni.dll","urlmon.dll","setupapi.dll","winhttp.dll","rsaenh.dll","api-ms-win-core-processthreads-l1-1-1.dll","winmm.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","apphelp.dll","shdocvw.dll","WindowsCodecs.dll","kernel32.dll","msvcrt.dll","nsi.dll","api-ms-win-crt-stdio-l1-1-0.dll","sechost.dll","clbcatq.dll","cfgmgr32.dll","rasadhlp.dll","ntdll.dll","api-ms-win-crt-math-l1-1-0.dll","ucrtbase_clr0400.dll","propsys.dll","wininet.dll","GdiPlus.dll","api-ms-win-crt-runtime-l1-1-0.dll","dnsapi.dll","gdi32.dll","msvcp140.dll"]},"file_activity":{"dropped_files":[{"name":"c9831759e15b3a52_lummac2.exe","sha256":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"LummaC2.exe","sha256":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"files_written":[{"path":"%TEMP%\\LummaC2.exe","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"path":"%TEMP%\\Set-up.exe","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\My_mutex","sources":[{"report_type":"sandbox","report_id":"6a8323957a3d910332099c57"}]}]}},"report_ids":{"sandbox_job_ids":["6a8323957a3d910332099c57"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 1ad8785caeb5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1ad8785caeb5…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 1ad8785caeb5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1ad8785caeb5…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 1ad8785caeb5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1ad8785caeb5…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]