24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Blank.Script Sample 3eab47f296f6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3eab47f296f6…. Malware family: Trojan.Blank.Script. Threat score 100/100. 3/27 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","keywords":["Malicious","Trojan.Blank.Script","malware analysis","sandbox report","threat intelligence","3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5"],"about":{"@type":"SoftwareApplication","name":"LumaForge.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Blank.Script","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1c9d,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "zlib data compression library" (Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "unknown compression method" (Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "Failed to extract %s: decompression resulted in return code %d!" (Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found string "compression" (Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp") Found string "The predefined compression dictionary. This is a sequence of bytes" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "The functions in this module allow compression and decompression using the" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "compress(data[, level]) -- Compress data, with compression level 0-9 or -1." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "If it is a path, the file will be opened and closed by ZipFile." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "compression: ZIP_STORED (no compression), ZIP_DEFLATED (requires zlib)," (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "ZIP_ZSTANDARD (requires compression.zstd)." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "allowZip64: if True ZipFile will create files with ZIP64 extensions" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "compresslevel: None (default for the given compression type) or" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "see the CompressionParameter enum in compression.zstd for" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "compression settings, as for LZMACompressor, LZMADecompressor and" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp") Found string "*level* is the expected compression level. The statistics for each" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "compression level differ, so tuning the dictionary to the compression" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp") Found string "compressor can be specified either as a preset compression" (Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp")26:Tbb1,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "LumaForge.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "LumaForge.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "LumaForge.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "LumaForge.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "LumaForge.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "LumaForge.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "LumaForge.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "LumaForge.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "LumaForge.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "LumaForge.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API "BatchedWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp")27:T824,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "LumaForge.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "LumaForge.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "LumaForge.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp")28:Tb27,file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "LumaForge.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to "_hmac.HMAC" (Indicator: "HMAC"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found reference to "_hashlib.HMAC" (Indicator: "HMAC"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp")29:T6b2,Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "LumaForge.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "LumaForge.exe") Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; File: "LumaForge.exe") Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; File: "LumaForge.exe") Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; File: "LumaForge.exe") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "LumaForge.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "LumaForge.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "LumaForge.exe") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp")2a:T160f,Found XOR loop in file "VCRUNTIME140.dll" at offset 65996; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 105766; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 116065; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 15084; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 35123; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 43752; code bytes = 8030 Found XOR loop in file "VCRUNTIME140_1.dll" at offset 45437; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 138179; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 283464; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 219147; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 278875; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 288023; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 6913; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 9223; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 183624; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 179035; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 188183; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1845; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 3233; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15526; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15577; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 15633; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17400; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54360; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 54372; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55312; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55324; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55972; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55983; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56639; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56646; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57552; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57605; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57628; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 75763; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 89561; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 90198; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 153928; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 52815; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 126356; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 149339; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 158487; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 28867; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 135496; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 130907; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 140055; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 81478; code bytes = 30d0 Found XOR loop in file "_bz2.pyd" at offset 11448; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 40055; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 80712; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 76123; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 85271; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 9475; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 80712; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 76123; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 85271; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 4739; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 70984; code bytes = 33c1 Found XOR loop in file "_asyncio.pyd" at offset 66395; code bytes = 8030 Found XOR loop in file "_asyncio.pyd" at offset 75543; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 14883; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 62280; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 57691; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 66839; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 3955; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 51016; code bytes = 33c1 Found XOR loop in file "_overlapped.pyd" at offset 46427; code bytes = 8030 Found XOR loop in file "_overlapped.pyd" at offset 55575; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 2691; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 31560; code bytes = 33c1 Found XOR loop in file "_multiprocessing.pyd" at offset 26971; code bytes = 8030 Found XOR loop in file "_multiprocessing.pyd" at offset 36119; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 4595; code bytes = 33c1 Found XOR loop in file "_queue.pyd" at offset 29512; code bytes = 33c1 Found XOR loop in file "_queue.pyd" at offset 14176; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 24923; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 34071; code bytes = 80302b:T8ec,Found string "https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found string "https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312" (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "argument types, see https://github.com/python/cpython/issues/86361." (Indicator: "github.com"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")2c:T4ef,Found system information discovery API: "ExpandEnvironmentStringsW" in file "LumaForge.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "LumaForge.exe" Found system information discovery API: "GetMonitorInfoW" in file "LumaForge.exe" Found system information discovery API: "GetSystemInfo" in file "LumaForge.exe" Found system information discovery API: "GetMonitorInfoW" in "00000000-00000640.00000001.219159.60543000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00000640.00000001.219159.60543000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000640.00000001.219159.60543000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ" in "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStrings" in "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp"2d:Ted4,"LumaForge.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "LumaForge.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "LumaForge.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002468) "LumaForge.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000587e9e15a7000000000000000000000000001db4f87f0000587e9e15a700000036bb7dc0f87f00000000000000000000000000000000000000000000000000000000000000000000000000000000000050d77dc0f87f00000000000000000000587e9e15a7000000000000000000000000000000000400bc0100000000000000527f0cbef87f00000100000000000000136f3992f87f000000000000eb271c0000000000000400bc00002392f87f00000100000000000000587e9e15a700000005703992f87f0000070000000000000000000000000000000000000000000000c5411db4f87f00000000000000000000f8693992f87f000000000000 (UID: 00000000-00002468) "LumaForge.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938c2bdf87f000080000000000000000000000000000000d0aaa690bd010000103380c0f87f00000000000000000000000032bff87f000060799e15a70000001041bfbdf87f0000e0012391bd01000020799e15a7000000000000000000000000000000000000000100000000000000b840bfbdf87f000006000000000000000100000000000000000032bff87f00003b4d09bef87f00000000000000000000587e9e15a70000000000000000000000d02a44bff87f000010b3aabff87f0000e8f8bebdf87f000010b3aabff87f0000d02a44bff87f00000d000000f87f00000d00000000000000a0f69abff87f0000f5873fbff87f0000d02a44bf (UID: 00000000-00002468) "LumaForge.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000010294691bd01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd4aa5217c2b0000000000000000000000000000000000000000000000000000000000000000000090ddff90bd0100000900000000000000603bb68ebd010000a88e5392f87f0000404d93c0f87f00000000000000000000341f7dc0f87f00000000000000000000b2c818aff87f0000a88e5392f87f0000010000000000000001000000 (UID: 00000000-00002468)2e:Tc66,"LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802 (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\encoding (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\http1.0 (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\msgs (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\opt0.4 (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Africa (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\America (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\America\Argentina (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\America\Indiana (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\America\Kentucky (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\America\North_Dakota (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Antarctica (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Arctic (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Asia (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Atlantic (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Australia (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Brazil (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Canada (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Chile (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Etc (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Europe (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Indian (UID: 00000000-00000640) "LumaForge.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI000002802\_tcl_data\tzdata\Mexico (UID: 00000000-00000640)2f:Td1c,"LumaForge.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000640) "LumaForge.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000640) "LumaForge.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00000640) "LumaForge.exe" called "LoadLibrary" with a parameter VCRUNTIME140_1.dll (UID: 00000000-00000640) "LumaForge.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\ucrtbase.dll (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\python314.dll (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter api-ms-win-core-file-l2-1-4 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\python3 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter python3 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\DLLs\python3 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_ctypes.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_bz2.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_lzma.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_zstd.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_socket.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_ssl.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_asyncio.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_overlapped.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\select.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_queue.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_tkinter.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_hashlib.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\websockets\speedups.cp314-win_amd64.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI000002802\_uuid.pyd (UID: 00000000-00002468) "LumaForge.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002468)30:T264c,"LumaForge.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000640) "LumaForge.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter VirtualAlloc2FromApp (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemoryEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetNumaProcessorNodeEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetNumaNodeProcessorMaskEx (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetNumaProcessorNode (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_Create (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_Free (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_SetInt (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStr (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_SetStrList (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInitConfig_GetError (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter Py_InitializeFromInitConfig (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__zstd (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__ssl (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__asyncio (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__overlapped (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__queue (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__tkinter (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CancelSynchronousIo (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__hashlib (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit_speedups (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter PyInit__uuid (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002468) "LumaForge.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002468)31:Td0b8,Found reference to API (Indicator: "OpenProcessToken"; File: "LumaForge.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "LumaForge.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "LumaForge.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "LumaForge.exe") Found reference to API (Indicator: "DeleteObject"; File: "LumaForge.exe") Found reference to API (Indicator: "SelectObject"; File: "LumaForge.exe") Found reference to API (Indicator: "Sleep"; File: "LumaForge.exe") Found reference to API (Indicator: "Process32FirstW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "LumaForge.exe") Found reference to API (Indicator: "RaiseException"; File: "LumaForge.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "LumaForge.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "LumaForge.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "LumaForge.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "LumaForge.exe") Found reference to API (Indicator: "Process32NextW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "LumaForge.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "LumaForge.exe") Found reference to API (Indicator: "TerminateProcess"; File: "LumaForge.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "LumaForge.exe") Found reference to API (Indicator: "FindNextFileW"; File: "LumaForge.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "LumaForge.exe") Found reference to API (Indicator: "K32EnumProcessModules"; File: "LumaForge.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "LumaForge.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "LumaForge.exe") Found reference to API (Indicator: "FlsAlloc"; File: "LumaForge.exe") Found reference to API (Indicator: "FreeLibrary"; File: "LumaForge.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCPInfo"; File: "LumaForge.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "LumaForge.exe") Found reference to API (Indicator: "OpenProcess"; File: "LumaForge.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "LumaForge.exe") Found reference to API (Indicator: "GetTempPathW"; File: "LumaForge.exe") Found reference to API (Indicator: "FlsFree"; File: "LumaForge.exe") Found reference to API (Indicator: "SetStdHandle"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFileType"; File: "LumaForge.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "LumaForge.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "LumaForge.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "LumaForge.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetErrorMode"; File: "LumaForge.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "LumaForge.exe") Found reference to API (Indicator: "FlsSetValue"; File: "LumaForge.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "LumaForge.exe") Found reference to API (Indicator: "LCMapStringW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "LumaForge.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "LumaForge.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "LumaForge.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "LumaForge.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "LumaForge.exe") Found reference to API (Indicator: "VirtualProtect"; File: "LumaForge.exe") Found reference to API (Indicator: "WriteFile"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateFileW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "LumaForge.exe") Found reference to API (Indicator: "FormatMessageW"; File: "LumaForge.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "LumaForge.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "LumaForge.exe") Found reference to API (Indicator: "HeapAlloc"; File: "LumaForge.exe") Found reference to API (Indicator: "FindClose"; File: "LumaForge.exe") Found reference to API (Indicator: "EncodePointer"; File: "LumaForge.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "LumaForge.exe") Found reference to API (Indicator: "LocalFree"; File: "LumaForge.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "LumaForge.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "LumaForge.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "LumaForge.exe") Found reference to API (Indicator: "HeapSize"; File: "LumaForge.exe") Found reference to API (Indicator: "CloseHandle"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "LumaForge.exe") Found reference to API (Indicator: "GetACP"; File: "LumaForge.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetProcAddress"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "LumaForge.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "LumaForge.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "LumaForge.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "LumaForge.exe") Found reference to API (Indicator: "HeapFree"; File: "LumaForge.exe") Found reference to API (Indicator: "DeleteFileW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "LumaForge.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateProcessW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "LumaForge.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "LumaForge.exe") Found reference to API (Indicator: "MulDiv"; File: "LumaForge.exe") Found reference to API (Indicator: "GetLastError"; File: "LumaForge.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "LumaForge.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetLastError"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "LumaForge.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "LumaForge.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "LumaForge.exe") Found reference to API (Indicator: "FlsGetValue"; File: "LumaForge.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "LumaForge.exe") Found reference to API (Indicator: "CompareStringW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "LumaForge.exe") Found reference to API (Indicator: "ExitProcess"; File: "LumaForge.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "LumaForge.exe") Found reference to API (Indicator: "GetOEMCP"; File: "LumaForge.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "LumaForge.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "LumaForge.exe") Found reference to API (Indicator: "ReadFile"; File: "LumaForge.exe") Found reference to API (Indicator: "GetStdHandle"; File: "LumaForge.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "LumaForge.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "LumaForge.exe") Found reference to API (Indicator: "DestroyIcon"; File: "LumaForge.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "LumaForge.exe") Found reference to API (Indicator: "PeekMessageW"; File: "LumaForge.exe") Found reference to API (Indicator: "ReleaseDC"; File: "LumaForge.exe") Found reference to API (Indicator: "GetDC"; File: "LumaForge.exe") Found reference to API (Indicator: "RegisterClassW"; File: "LumaForge.exe") Found reference to API (Indicator: "ShowWindow"; File: "LumaForge.exe") Found reference to API (Indicator: "GetClientRect"; File: "LumaForge.exe") Found reference to API (Indicator: "TranslateMessage"; File: "LumaForge.exe") Found reference to API (Indicator: "MessageBoxA"; File: "LumaForge.exe") Found reference to API (Indicator: "GetCursorPos"; File: "LumaForge.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "LumaForge.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "LumaForge.exe") Found reference to API (Indicator: "InvalidateRect"; File: "LumaForge.exe") Found reference to API (Indicator: "MessageBoxW"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "LumaForge.exe") Found reference to API (Indicator: "MoveWindow"; File: "LumaForge.exe") Found reference to API (Indicator: "DestroyWindow"; File: "LumaForge.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "LumaForge.exe") Found reference to API (Indicator: "CompareStringEx"; File: "LumaForge.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "LumaForge.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "LumaForge.exe") Found reference to API (Indicator: "LoadLibrary"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateDirectory"; File: "LumaForge.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "LumaForge.exe") Found reference to API (Indicator: "TlsFree"; File: "LumaForge.exe") Found reference to API (Indicator: "TlsAlloc"; File: "LumaForge.exe") Found reference to API (Indicator: "TlsSetValue"; File: "LumaForge.exe") Found reference to API (Indicator: "RtlUnwind"; File: "LumaForge.exe") Found reference to API (Indicator: "TlsGetValue"; File: "LumaForge.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "LumaForge.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "LumaForge.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "LumaForge.exe") Found reference to API (Indicator: "CertOpenStore"; File: "LumaForge.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "LumaForge.exe") Found reference to API (Indicator: "CertFreeCRLContext"; File: "LumaForge.exe") Found reference to API (Indicator: "CertEnumCRLsInStore"; File: "LumaForge.exe") Found reference to API (Indicator: "CertAddStoreToCollection"; File: "LumaForge.exe") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; File: "LumaForge.exe") Found reference to API (Indicator: "CertCloseStore"; File: "LumaForge.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "LumaForge.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "LumaForge.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "LumaForge.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "LumaForge.exe") Found reference to API (Indicator: "SysFreeString"; File: "LumaForge.exe") Found reference to API (Indicator: "SysStringLen"; File: "LumaForge.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "LumaForge.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "LumaForge.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "LumaForge.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "LumaForge.exe") Found reference to API (Indicator: "VerifyVersionInfoA"; File: "LumaForge.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "LumaForge.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "LumaForge.exe") Found reference to API (Indicator: "UuidToStringW"; File: "LumaForge.exe") Found reference to API (Indicator: "UuidFromStringW"; File: "LumaForge.exe") Found reference to API (Indicator: "RpcStringFreeW"; File: "LumaForge.exe") Found reference to API (Indicator: "getpeername"; File: "LumaForge.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "LumaForge.exe") Found reference to API (Indicator: "getservbyport"; File: "LumaForge.exe") Found reference to API (Indicator: "WSASetLastError"; File: "LumaForge.exe") Found reference to API (Indicator: "htonl"; File: "LumaForge.exe") Found reference to API (Indicator: "getsockname"; File: "LumaForge.exe") Found reference to API (Indicator: "ntohs"; File: "LumaForge.exe") Found reference to API (Indicator: "WSAIoctl"; File: "LumaForge.exe") Found reference to API (Indicator: "getservbyname"; File: "LumaForge.exe") Found reference to API (Indicator: "inet_ntoa"; File: "LumaForge.exe") Found reference to API (Indicator: "gethostbyname"; File: "LumaForge.exe") Found reference to API (Indicator: "htons"; File: "LumaForge.exe") Found reference to API (Indicator: "getsockopt"; File: "LumaForge.exe") Found reference to API (Indicator: "WSACleanup"; File: "LumaForge.exe") Found reference to API (Indicator: "inet_addr"; File: "LumaForge.exe") Found reference to API (Indicator: "closesocket"; File: "LumaForge.exe") Found reference to API (Indicator: "recvfrom"; File: "LumaForge.exe") Found reference to API (Indicator: "ntohl"; File: "LumaForge.exe") Found reference to API (Indicator: "getprotobyname"; File: "LumaForge.exe") Found reference to API (Indicator: "ioctlsocket"; File: "LumaForge.exe") Found reference to API (Indicator: "WSAStartup"; File: "LumaForge.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "LumaForge.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "LumaForge.exe") Found reference to API (Indicator: "SetEvent"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateEventA"; File: "LumaForge.exe") Found reference to API (Indicator: "CancelIoEx"; File: "LumaForge.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "LumaForge.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateEventW"; File: "LumaForge.exe") Found reference to API (Indicator: "UnregisterWait"; File: "LumaForge.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "LumaForge.exe") Found reference to API (Indicator: "ResetEvent"; File: "LumaForge.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "LumaForge.exe") Found reference to API (Indicator: "WSAStringToAddressW"; File: "LumaForge.exe") Found reference to API (Indicator: "WSASend"; File: "LumaForge.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "LumaForge.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "LumaForge.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "LumaForge.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "LumaForge.exe") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000640.00000000.217238.9BDE3000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetDllDirectoryW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcessModules"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.951D9000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000000.217784.A4AB3000.00000002.mdmp, 00000000-00002468.00000000.217784.A77F3000.00000002.mdmp, 00000000-00002468.00000000.217784.AAA96000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp, 00000000-00002468.00000002.221624.A96A3000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathName"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "OpenFileMapping"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.951D9000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000000.217784.A4AB3000.00000002.mdmp, 00000000-00002468.00000000.217784.A77F3000.00000002.mdmp, 00000000-00002468.00000000.217784.AAA96000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp, 00000000-00002468.00000002.221624.A96A3000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API (Indicator: "CopyFile2"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp")32:T6db,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "LumaForge.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "LumaForge.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "LumaForge.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "LumaForge.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.60543000.00000002.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp")33:T8c0,"VCRUNTIME140.dll" contains export function called "_CreateFrameInfo" at ordinal 1 "VCRUNTIME140.dll" contains export function called "_CxxThrowException" at ordinal 2 "VCRUNTIME140.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 3 "VCRUNTIME140.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 4 "VCRUNTIME140.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 5 "VCRUNTIME140.dll" contains export function called "__AdjustPointer" at ordinal 6 "VCRUNTIME140.dll" contains export function called "__BuildCatchObject" at ordinal 7 "VCRUNTIME140.dll" contains export function called "__BuildCatchObjectHelper" at ordinal 8 "VCRUNTIME140.dll" contains export function called "__C_specific_handler" at ordinal 9 "VCRUNTIME140.dll" contains export function called "__C_specific_handler_noexcept" at ordinal 10 "VCRUNTIME140.dll" contains export function called "__CxxDetectRethrow" at ordinal 11 "VCRUNTIME140.dll" contains export function called "__CxxExceptionFilter" at ordinal 12 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler" at ordinal 13 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler2" at ordinal 14 "VCRUNTIME140.dll" contains export function called "__CxxFrameHandler3" at ordinal 15 "VCRUNTIME140.dll" contains export function called "__CxxQueryExceptionSize" at ordinal 16 "VCRUNTIME140.dll" contains export function called "__CxxRegisterExceptionObject" at ordinal 17 "VCRUNTIME140.dll" contains export function called "__CxxUnregisterExceptionObject" at ordinal 18 "VCRUNTIME140.dll" contains export function called "__DestructExceptionObject" at ordinal 19 "VCRUNTIME140.dll" contains export function called "__FrameUnwindFilter" at ordinal 20 "VCRUNTIME140.dll" contains export function called "__GetPlatformExceptionInfo" at ordinal 21 "VCRUNTIME140.dll" contains export function called "__NLG_Dispatch2" at ordinal 22 "VCRUNTIME140.dll" contains export function called "__NLG_Return2" at ordinal 23 "VCRUNTIME140.dll" contains export function called "__RTCastToVoid" at ordinal 24 "VCRUNTIME140.dll" contains export function called "__RTDynamicCast" at ordinal 2534:T6ec,Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "VCRUNTIME140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_ctypes.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_bz2.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_socket.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_asyncio.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "_hashlib.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_overlapped.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_multiprocessing.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "_queue.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")35:T8b6,"LumaForge.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_asyncio.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_overlapped.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_multiprocessing.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_queue.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT36:T572,"Software\Microsoft\LanguageOverlay" in Source: 00000000-00000640.00000000.217238.9BDE3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000640.00000001.219159.260F0000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00000640.00000002.221076.260F0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002468.00000000.217784.90880000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002468.00000000.217784.90880000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002468.00000001.219704.90880000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002468.00000001.219704.90880000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00002468.00000002.221624.90880000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00002468.00000002.221624.90880000.00000004.mdmp37:Tda2,"LumaForge.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff894de0000 "LumaForge.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff8be050000 "LumaForge.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8be050000 "LumaForge.exe" loaded module "RPCRT4.DLL" at base 7ff8bf180000 "LumaForge.exe" loaded module "VCRUNTIME140.DLL" at base 7ff8b3fa0000 "LumaForge.exe" loaded module "VCRUNTIME140_1.DLL" at base 7ff8b2450000 "LumaForge.exe" loaded module "NTDLL.DLL" at base 7ff8c07b0000 "LumaForge.exe" loaded module "KERNELBASE" at base 7ff8be050000 "LumaForge.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8bb200000 "LumaForge.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8be050000 "LumaForge.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8be050000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\UCRTBASE.DLL" at base 7ff894c90000 "LumaForge.exe" loaded module "KERNELBASE.DLL" at base 7ff8be050000 "LumaForge.exe" loaded module "KERNEL32.DLL" at base 7ff8c03c0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\PYTHON314.DLL" at base 7ff88b3b0000 "LumaForge.exe" loaded module "API-MS-WIN-CORE-FILE-L2-1-4" at base 7ff8be050000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_CTYPES.PYD" at base 7ff89bca0000 "LumaForge.exe" loaded module "KERNEL32" at base 7ff8c03c0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_BZ2.PYD" at base 7ff89b640000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_LZMA.PYD" at base 7ff899420000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_ZSTD.PYD" at base 7ff894c10000 "LumaForge.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8be400000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_SOCKET.PYD" at base 7ff8991a0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_SSL.PYD" at base 7ff898420000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_ASYNCIO.PYD" at base 7ff8951d0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_OVERLAPPED.PYD" at base 7ff8a9ce0000 "LumaForge.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8bd090000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\SELECT.PYD" at base 7ff8a96a0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_QUEUE.PYD" at base 7ff8a77f0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_TKINTER.PYD" at base 7ff8951b0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_HASHLIB.PYD" at base 7ff894a70000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\WEBSOCKETS\SPEEDUPS.CP314-WIN_AMD64.PYD" at base 7ff8a64f0000 "LumaForge.exe" loaded module "%TEMP%\_MEI000002802\_UUID.PYD" at base 7ff8a4ab0000 "LumaForge.exe" loaded module "UXTHEME.DLL" at base 7ff8bb200000 "LumaForge.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8bcc20000 "LumaForge.exe" loaded module "COMCTL32.DLL" at base 7ff8a8510000 "LumaForge.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 1bd92e20000 "LumaForge.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff8bf0c0000 "LumaForge.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff8be5b0000 "LumaForge.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff8be5b0000 "LumaForge.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff8be8b0000 "LumaForge.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff8c05d000038:T840,"LumaForge.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "LumaForge.exe" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Linker" and name: "Linker" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Linker" and name: "Linker" "_asyncio.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_asyncio.pyd" was detected as "Microsoft Linker" and name: "Linker" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Linker" and name: "Linker" "_overlapped.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_overlapped.pyd" was detected as "Microsoft Linker" and name: "Linker" "_multiprocessing.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_multiprocessing.pyd" was detected as "Microsoft Linker" and name: "Linker" "_queue.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_queue.pyd" was detected as "Microsoft Linker" and name: "Linker"39:T1db4,"LumaForge.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000ea00,add rsp, 0x28,jmp 0x14000e5f0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000f000,test eax, eax,je 0x14000e7c9,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d60b], rcx,je 0x14000e7c9,cmp rcx, rax,je 0x14000e7d0,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3d5f9], rcx,jne 0x14000e7b7,xor al, al,add rsp, 0x28,ret ,mov al, 1," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180022731,call 0x180022750,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800225e8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1c89c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1800227ea," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002f75,call 0x180002f94,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002e2c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1f058],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000302e," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800131e5,call 0x180013380,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001309c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3e4b],mov rcx, rbx,call qword ptr [rip + 0x3e4a],call qword ptr [rip + 0x3e34],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180007ab5,call 0x180007c50,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000796c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc573],mov rcx, rbx,call qword ptr [rip + 0xc562],call qword ptr [rip + 0xc56c],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a7e5,call 0x18000a804,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a69c,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x77e8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a89e," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002ef5,call 0x180003090,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002dac,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x612b],mov rcx, rbx,call qword ptr [rip + 0x611a],call qword ptr [rip + 0x6124],mov rcx, rax," "_asyncio.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001c75,call 0x180001e10,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001b2c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x73ab],mov rcx, rbx,call qword ptr [rip + 0x73aa],call qword ptr [rip + 0x7394],mov rcx, rax," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004415,call 0x1800045b0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800042cc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2bf3],mov rcx, rbx,call qword ptr [rip + 0x2be2],call qword ptr [rip + 0x2bec],mov rcx, rax," "_overlapped.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001965,call 0x180001b00,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000181c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x46b3],mov rcx, rbx,call qword ptr [rip + 0x46a2],call qword ptr [rip + 0x46ac],mov rcx, rax," "_multiprocessing.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001475,call 0x180001610,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000132c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1bc3],mov rcx, rbx,call qword ptr [rip + 0x1b6a],call qword ptr [rip + 0x1bcc],mov rcx, rax," "_queue.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001be5,call 0x180001d80,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001a9c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x144b],mov rcx, rbx,call qword ptr [rip + 0x144a],call qword ptr [rip + 0x1434],mov rcx, rax,"3a:T4f2,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "LumaForge.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "LumaForge.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp")3b:T6410,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140.dll]- [targetUID: 00000000-00002468] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002468] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_decimal.pyd]- [targetUID: 00000000-00002468] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ssl.pyd]- [targetUID: 00000000-00002468] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_lzma.pyd]- [targetUID: 00000000-00002468] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ctypes.pyd]- [targetUID: 00000000-00002468] "cp936.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp936.enc]- [targetUID: 00000000-00000640] "clock.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\clock.tcl]- [targetUID: 00000000-00000640] "cp949.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp949.enc]- [targetUID: 00000000-00000640] "cns11643.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cns11643.enc]- [targetUID: 00000000-00000640] "euc-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\euc-kr.enc]- [targetUID: 00000000-00000640] "ksc5601.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\ksc5601.enc]- [targetUID: 00000000-00000640] "big5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\big5.enc]- [targetUID: 00000000-00000640] "cp950.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp950.enc]- [targetUID: 00000000-00000640] "gb12345.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\gb12345.enc]- [targetUID: 00000000-00000640] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_bz2.pyd]- [targetUID: 00000000-00002468] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_socket.pyd]- [targetUID: 00000000-00002468] "gb2312.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\gb2312.enc]- [targetUID: 00000000-00000640] "gb2312-raw.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\gb2312-raw.enc]- [targetUID: 00000000-00000640] "euc-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\euc-jp.enc]- [targetUID: 00000000-00000640] "jis0208.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\jis0208.enc]- [targetUID: 00000000-00000640] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000002802\_asyncio.pyd]- [targetUID: 00000000-00002468] "jis0212.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\jis0212.enc]- [targetUID: 00000000-00000640] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_hashlib.pyd]- [targetUID: 00000000-00002468] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_overlapped.pyd]- [targetUID: 00000000-00002468] "cp932.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp932.enc]- [targetUID: 00000000-00000640] "macJapan.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macJapan.enc]- [targetUID: 00000000-00000640] "shiftjis.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\shiftjis.enc]- [targetUID: 00000000-00000640] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_multiprocessing.pyd]- [targetUID: 00000000-00002468] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_queue.pyd]- [targetUID: 00000000-00002468] "init.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\init.tcl]- [targetUID: 00000000-00002468] "auto.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\auto.tcl]- [targetUID: 00000000-00002468] "http.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\http1.0\http.tcl]- [targetUID: 00000000-00000640] "history.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\history.tcl]- [targetUID: 00000000-00000640] "bn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\bn.msg]- [targetUID: 00000000-00000640] "el.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\el.msg]- [targetUID: 00000000-00000640] "be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\be.msg]- [targetUID: 00000000-00000640] "mk.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\mk.msg]- [targetUID: 00000000-00000640] "ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ar.msg]- [targetUID: 00000000-00000640] "fa_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fa_in.msg]- [targetUID: 00000000-00000640] "kok.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kok.msg]- [targetUID: 00000000-00000640] "he.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\he.msg]- [targetUID: 00000000-00000640] "bg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\bg.msg]- [targetUID: 00000000-00000640] "ar_lb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ar_lb.msg]- [targetUID: 00000000-00000640] "ar_sy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ar_sy.msg]- [targetUID: 00000000-00000640] "ar_jo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ar_jo.msg]- [targetUID: 00000000-00000640] "mr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\mr.msg]- [targetUID: 00000000-00000640] "hi.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\hi.msg]- [targetUID: 00000000-00000640] "fa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fa.msg]- [targetUID: 00000000-00000640] "ja.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ja.msg]- [targetUID: 00000000-00000640] "ko.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ko.msg]- [targetUID: 00000000-00000640] "hu.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\hu.msg]- [targetUID: 00000000-00000640] "cs.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\cs.msg]- [targetUID: 00000000-00000640] "lt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\lt.msg]- [targetUID: 00000000-00000640] "is.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\is.msg]- [targetUID: 00000000-00000640] "it.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\it.msg]- [targetUID: 00000000-00000640] "eo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\eo.msg]- [targetUID: 00000000-00000640] "de.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\de.msg]- [targetUID: 00000000-00000640] "de_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\de_be.msg]- [targetUID: 00000000-00000640] "lv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\lv.msg]- [targetUID: 00000000-00000640] "et.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\et.msg]- [targetUID: 00000000-00000640] "fr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fr.msg]- [targetUID: 00000000-00000640] "es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es.msg]- [targetUID: 00000000-00000640] "nb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\nb.msg]- [targetUID: 00000000-00000640] "da.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\da.msg]- [targetUID: 00000000-00000640] "fi.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fi.msg]- [targetUID: 00000000-00000640] "ga.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ga.msg]- [targetUID: 00000000-00000640] "hr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\hr.msg]- [targetUID: 00000000-00000640] "ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ca.msg]- [targetUID: 00000000-00000640] "nl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\nl.msg]- [targetUID: 00000000-00000640] "macCentEuro.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macCentEuro.enc]- [targetUID: 00000000-00000640] "macCyrillic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macCyrillic.enc]- [targetUID: 00000000-00000640] "macCroatian.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macCroatian.enc]- [targetUID: 00000000-00000640] "macDingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macDingbats.enc]- [targetUID: 00000000-00000640] "iso8859-16.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-16.enc]- [targetUID: 00000000-00000640] "macRomania.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macRomania.enc]- [targetUID: 00000000-00000640] "macIceland.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macIceland.enc]- [targetUID: 00000000-00000640] "iso8859-14.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-14.enc]- [targetUID: 00000000-00000640] "iso8859-15.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-15.enc]- [targetUID: 00000000-00000640] "iso8859-11.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-11.enc]- [targetUID: 00000000-00000640] "macTurkish.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macTurkish.enc]- [targetUID: 00000000-00000640] "iso8859-10.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-10.enc]- [targetUID: 00000000-00000640] "macUkraine.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macUkraine.enc]- [targetUID: 00000000-00000640] "iso8859-13.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-13.enc]- [targetUID: 00000000-00000640] "iso8859-8.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-8.enc]- [targetUID: 00000000-00000640] "iso8859-5.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-5.enc]- [targetUID: 00000000-00000640] "iso8859-9.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-9.enc]- [targetUID: 00000000-00000640] "iso8859-7.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-7.enc]- [targetUID: 00000000-00000640] "iso8859-6.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-6.enc]- [targetUID: 00000000-00000640] "iso8859-2.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-2.enc]- [targetUID: 00000000-00000640] "iso8859-3.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-3.enc]- [targetUID: 00000000-00000640] "iso8859-1.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-1.enc]- [targetUID: 00000000-00000640] "iso8859-4.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso8859-4.enc]- [targetUID: 00000000-00000640] "macRoman.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macRoman.enc]- [targetUID: 00000000-00000640] "macGreek.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macGreek.enc]- [targetUID: 00000000-00000640] "dingbats.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\dingbats.enc]- [targetUID: 00000000-00000640] "jis0201.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\jis0201.enc]- [targetUID: 00000000-00000640] "tis-620.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\tis-620.enc]- [targetUID: 00000000-00000640] "macThai.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\macThai.enc]- [targetUID: 00000000-00000640] "cp1258.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1258.enc]- [targetUID: 00000000-00000640] "koi8-u.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\koi8-u.enc]- [targetUID: 00000000-00000640] "cp1251.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1251.enc]- [targetUID: 00000000-00000640] "cp1255.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1255.enc]- [targetUID: 00000000-00000640] "cp1254.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1254.enc]- [targetUID: 00000000-00000640] "koi8-r.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\koi8-r.enc]- [targetUID: 00000000-00000640] "cp1257.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1257.enc]- [targetUID: 00000000-00000640] "cp1250.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1250.enc]- [targetUID: 00000000-00000640] "cp1252.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1252.enc]- [targetUID: 00000000-00002468] "symbol.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\symbol.enc]- [targetUID: 00000000-00002468] "gb1988.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\gb1988.enc]- [targetUID: 00000000-00000640] "cp1253.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1253.enc]- [targetUID: 00000000-00000640] "cp1256.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp1256.enc]- [targetUID: 00000000-00000640] "cp862.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp862.enc]- [targetUID: 00000000-00000640] "cp852.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp852.enc]- [targetUID: 00000000-00000640] "cp860.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp860.enc]- [targetUID: 00000000-00000640] "cp869.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp869.enc]- [targetUID: 00000000-00000640] "cp861.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp861.enc]- [targetUID: 00000000-00000640] "cp737.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp737.enc]- [targetUID: 00000000-00000640] "cp864.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp864.enc]- [targetUID: 00000000-00000640] "cp855.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp855.enc]- [targetUID: 00000000-00000640] "cp775.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp775.enc]- [targetUID: 00000000-00000640] "cp866.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp866.enc]- [targetUID: 00000000-00000640] "cp857.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp857.enc]- [targetUID: 00000000-00000640] "cp863.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp863.enc]- [targetUID: 00000000-00000640] "cp865.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp865.enc]- [targetUID: 00000000-00000640] "cp850.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp850.enc]- [targetUID: 00000000-00000640] "ascii.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\ascii.enc]- [targetUID: 00000000-00000640] "cp437.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp437.enc]- [targetUID: 00000000-00000640] "cp874.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\cp874.enc]- [targetUID: 00000000-00000640] "koi8-ru.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\koi8-ru.enc]- [targetUID: 00000000-00000640] "koi8-t.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\koi8-t.enc]- [targetUID: 00000000-00000640] "gv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\gv.msg]- [targetUID: 00000000-00000640] "ebcdic.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\ebcdic.enc]- [targetUID: 00000000-00000640] "af.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\af.msg]- [targetUID: 00000000-00000640] "fo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fo.msg]- [targetUID: 00000000-00000640] "eu.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\eu.msg]- [targetUID: 00000000-00000640] "kl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kl.msg]- [targetUID: 00000000-00000640] "kw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kw.msg]- [targetUID: 00000000-00000640] "gl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\gl.msg]- [targetUID: 00000000-00000640] "id.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\id.msg]- [targetUID: 00000000-00000640] "ms.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ms.msg]- [targetUID: 00000000-00000640] "de_at.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\de_at.msg]- [targetUID: 00000000-00000640] "pkgIndex.tcl" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\http1.0\pkgIndex.tcl]- [targetUID: 00000000-00002468] "mt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\mt.msg]- [targetUID: 00000000-00000640] "fa_ir.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fa_ir.msg]- [targetUID: 00000000-00000640] "ko_kr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ko_kr.msg]- [targetUID: 00000000-00000640] "en_ph.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_ph.msg]- [targetUID: 00000000-00000640] "en_hk.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_hk.msg]- [targetUID: 00000000-00000640] "en_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_in.msg]- [targetUID: 00000000-00000640] "en_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_be.msg]- [targetUID: 00000000-00000640] "en_au.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_au.msg]- [targetUID: 00000000-00000640] "en_nz.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_nz.msg]- [targetUID: 00000000-00000640] "en_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_ca.msg]- [targetUID: 00000000-00000640] "eu_es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\eu_es.msg]- [targetUID: 00000000-00000640] "fr_ch.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fr_ch.msg]- [targetUID: 00000000-00000640] "fo_fo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fo_fo.msg]- [targetUID: 00000000-00000640] "kl_gl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kl_gl.msg]- [targetUID: 00000000-00000640] "ga_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ga_ie.msg]- [targetUID: 00000000-00000640] "en_ie.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_ie.msg]- [targetUID: 00000000-00000640] "fr_be.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fr_be.msg]- [targetUID: 00000000-00000640] "fr_ca.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\fr_ca.msg]- [targetUID: 00000000-00000640] "en_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_gb.msg]- [targetUID: 00000000-00000640] "ms_my.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ms_my.msg]- [targetUID: 00000000-00000640] "bn_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\bn_in.msg]- [targetUID: 00000000-00000640] "ar_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\ar_in.msg]- [targetUID: 00000000-00000640] "kok_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kok_in.msg]- [targetUID: 00000000-00000640] "es_cr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_cr.msg]- [targetUID: 00000000-00000640] "af_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\af_za.msg]- [targetUID: 00000000-00000640] "es_co.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_co.msg]- [targetUID: 00000000-00000640] "gl_es.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\gl_es.msg]- [targetUID: 00000000-00000640] "en_sg.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_sg.msg]- [targetUID: 00000000-00000640] "gv_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\gv_gb.msg]- [targetUID: 00000000-00000640] "es_sv.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_sv.msg]- [targetUID: 00000000-00000640] "es_pr.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_pr.msg]- [targetUID: 00000000-00000640] "es_hn.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_hn.msg]- [targetUID: 00000000-00000640] "es_ec.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_ec.msg]- [targetUID: 00000000-00000640] "kw_gb.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\kw_gb.msg]- [targetUID: 00000000-00000640] "id_id.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\id_id.msg]- [targetUID: 00000000-00000640] "es_ni.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_ni.msg]- [targetUID: 00000000-00000640] "es_pe.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_pe.msg]- [targetUID: 00000000-00000640] "mr_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\mr_in.msg]- [targetUID: 00000000-00000640] "es_cl.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_cl.msg]- [targetUID: 00000000-00000640] "es_ve.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_ve.msg]- [targetUID: 00000000-00000640] "hi_in.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\hi_in.msg]- [targetUID: 00000000-00000640] "es_uy.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_uy.msg]- [targetUID: 00000000-00000640] "en_zw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_zw.msg]- [targetUID: 00000000-00000640] "en_bw.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_bw.msg]- [targetUID: 00000000-00000640] "es_pa.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_pa.msg]- [targetUID: 00000000-00000640] "es_bo.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_bo.msg]- [targetUID: 00000000-00000640] "es_do.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_do.msg]- [targetUID: 00000000-00000640] "es_mx.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_mx.msg]- [targetUID: 00000000-00000640] "es_py.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_py.msg]- [targetUID: 00000000-00000640] "es_gt.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_gt.msg]- [targetUID: 00000000-00000640] "en_za.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\en_za.msg]- [targetUID: 00000000-00000640] "it_ch.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\it_ch.msg]- [targetUID: 00000000-00000640] "es_ar.msg" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\msgs\es_ar.msg]- [targetUID: 00000000-00000640] "iso2022.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso2022.enc]- [targetUID: 00000000-00000640] "iso2022-jp.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso2022-jp.enc]- [targetUID: 00000000-00000640] "iso2022-kr.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\iso2022-kr.enc]- [targetUID: 00000000-00000640] "euc-cn.enc" has type "Unknown"- Location: [%TEMP%\_MEI000002802\_tcl_data\encoding\euc-cn.enc]- [targetUID: 00000000-00000640]3c:T672,"LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "LumaForge.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "")3d:Tc4a,"LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "LUMAFORGE"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "")3e:T5e1,"LumaForge.exe" trying to touch file "C:\LumaForge.exe.Local\" "LumaForge.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\COMCTL32.dll" "LumaForge.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "LumaForge.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "LumaForge.exe" trying to touch file "C:\Windows\System32\imm32.dll" "LumaForge.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "LumaForge.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "LumaForge.exe" trying to touch file "C:\MSVCP140.dll" "LumaForge.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSVCP140.dll" "LumaForge.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "LumaForge.exe" trying to touch file "C:\FLTLIB.DLL" "LumaForge.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "LumaForge.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "LumaForge.exe" trying to touch file "C:\VCRUNTIME140.dll" "LumaForge.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll" "LumaForge.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "LumaForge.exe" trying to touch file "C:\VCRUNTIME140_1.dll" "LumaForge.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140_1.dll" "LumaForge.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll"3f:Tc0c,"LumaForge.exe" trying to access non-existent file "C:\LumaForge.exe.Local\" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_asyncio.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_bz2.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_ctypes.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_decimal.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_hashlib.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_lzma.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_multiprocessing.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_overlapped.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_queue.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_socket.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_ssl.pyd" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\clock.tcl" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\big5.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cns11643.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1250.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1251.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1252.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1253.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1254.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1255.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1256.enc" "LumaForge.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_tcl_data\encoding\cp1257.enc"40:T65f,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "LumaForge.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "LumaForge.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp")41:T193d,file/memory contains long string with (Indicator: " socket "; File: "_socket.pyd") file/memory contains long string with (Indicator: " connect "; File: "_socket.pyd") file/memory contains long string with (Indicator: " bind "; File: "_socket.pyd") file/memory contains long string with (Indicator: " socket "; File: "_overlapped.pyd") file/memory contains long string with (Indicator: " socket "; File: "http.tcl") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "LumaForge.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "LumaForge.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "LumaForge.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "LumaForge.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "LumaForge.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "LumaForge.exe") Found reference to API "All functions which accept a handle object also accept an integer --" (Indicator: " accept "; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found reference to API "used with a socket or two-way pipe." (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found reference to API "threading shutdown instead of interpreter shutdown." (Indicator: " shutdown "; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found reference to API "S_IFSOCK: socket file" (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found reference to API "(e.g. Windows or SSL socket on Unix)." (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found reference to API "Note: The wrapped version will only accept the object format" (Indicator: " accept "; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found reference to API "does not accept an iterable for an input." (Indicator: " accept "; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "Utility function to accept strings in functions that otherwise" (Indicator: " accept "; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found reference to API "- 'socket' (optional): Socket instance;" (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "wait: If True then shutdown will not return until all running" (Indicator: " shutdown "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "cancel_futures: If True then shutdown will cancel all pending" (Indicator: " shutdown "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "Create socket transport." (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91610000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91610000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91610000.00000004.mdmp") Found reference to API "Start a socket server, call back for each client connected." (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "be a sequence (e.g. list) of hosts to bind to." (Indicator: " bind "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "reuse_address tells the kernel to reuse a local socket in" (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp") Found reference to API "will wait for completion of the SSL shutdown procedure" (Indicator: " shutdown "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "As a special case, accept None and return type(None) instead. Also wrap strings" (Indicator: " accept "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found reference to API "all the necessary arguments for creating a socket connected to that service." (Indicator: " socket "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")42:T2dee,Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "|w.gw" Heuristic match: "u=.ps" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0huddg" Pattern match: "www.memtest86.com" Pattern match: "http://$url" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000002802/tcl8/8.4/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000002802/tcl8/8.5/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000002802/tcl8/8.6/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei000002802/tcl8/8.5/msgcat-1.6.1.tm" Heuristic match: "bwebsockets\utils.py" Heuristic match: "bwebsockets\version.py" Heuristic match: "btcl8\8.4\platform-1.0.19.tm" Heuristic match: "btcl8\8.4\platform\shell-1.1.4.tm" Heuristic match: "btcl8\8.5\msgcat-1.6.1.tm" Heuristic match: "btcl8\8.5\tcltest-2.5.8.tm" Heuristic match: "btcl8\8.6\http-2.9.8.tm" Heuristic match: "bwebsockets\__init__.py" Heuristic match: "bwebsockets\__main__.py" Heuristic match: "bwebsockets\asyncio\__init__.py" Heuristic match: "bwebsockets\asyncio\client.py" Heuristic match: "bwebsockets\asyncio\connection.py" Heuristic match: "bwebsockets\asyncio\messages.py" Heuristic match: "bwebsockets\asyncio\router.py" Heuristic match: "bwebsockets\asyncio\server.py" Heuristic match: "bwebsockets\auth.py" Heuristic match: "bwebsockets\cli.py" Heuristic match: "bwebsockets\client.py" Heuristic match: "bwebsockets\connection.py" Heuristic match: "bwebsockets\datastructures.py" Heuristic match: "bwebsockets\exceptions.py" Heuristic match: "bwebsockets\extensions\__init__.py" Heuristic match: "bwebsockets\extensions\base.py" Heuristic match: "bwebsockets\extensions\permessage_deflate.py" Heuristic match: "bwebsockets\frames.py" Heuristic match: "bwebsockets\headers.py" Heuristic match: "bwebsockets\http11.py" Heuristic match: "bwebsockets\imports.py" Heuristic match: "bwebsockets\legacy\__init__.py" Heuristic match: "bwebsockets\legacy\auth.py" Heuristic match: "bwebsockets\legacy\client.py" Heuristic match: "bwebsockets\legacy\exceptions.py" Heuristic match: "bwebsockets\legacy\framing.py" Heuristic match: "bwebsockets\legacy\handshake.py" Heuristic match: "bwebsockets\legacy\http.py" Heuristic match: "bwebsockets\legacy\protocol.py" Heuristic match: "bwebsockets\legacy\server.py" Heuristic match: "bwebsockets\protocol.py" Heuristic match: "bwebsockets\proxy.py" Heuristic match: "bwebsockets\server.py" Heuristic match: "bwebsockets\streams.py" Heuristic match: "bwebsockets\sync\__init__.py" Heuristic match: "bwebsockets\sync\client.py" Heuristic match: "bwebsockets\sync\connection.py" Heuristic match: "bwebsockets\sync\messages.py" Heuristic match: "bwebsockets\sync\router.py" Heuristic match: "bwebsockets\sync\server.py" Heuristic match: "bwebsockets\sync\utils.py" Heuristic match: "bwebsockets\trio\__init__.py" Heuristic match: "bwebsockets\trio\client.py" Heuristic match: "bwebsockets\trio\connection.py" Heuristic match: "bwebsockets\trio\messages.py" Heuristic match: "bwebsockets\trio\router.py" Heuristic match: "bwebsockets\trio\server.py" Heuristic match: "bwebsockets\trio\utils.py" Heuristic match: "bwebsockets\typing.py" Heuristic match: "bwebsockets\uri.py" Heuristic match: "encodings\cp775.py" Heuristic match: "encodings\cp737.py" Heuristic match: "encodings\cp850.py" Heuristic match: "??\c:\users\1tkvzbo\appdata\local\temp\_mei000002802\websockets\extensions\permessage_deflate.py" Pattern match: "http://www.zlib.net/" Pattern match: "https://datatracker.ietf.org/doc/html/rfc6455#section-5.6" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "myimport.zip/mydirectory" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.metapathfinder.invalidate_caches" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.executionloader.get_filename" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.exec_module" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_code" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.is_package" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.pathentryfinder.find_spec" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_source" Heuristic match: "__init__.py" Pattern match: "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py#l679-l688" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.create_module" Heuristic match: "encodings\__init__.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.resourceloader.get_data" Heuristic match: "??\c:\users\hapubws\appdata\local\temp\_mei000002802\tcl8\8.6\<.tm" Heuristic match: "struct.py" Pattern match: "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#l24-l25" Pattern match: "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#l81-l97" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py#l11" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l422" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l312" Heuristic match: "re\_parser.py" Pattern match: "https://docs.pytho" Pattern match: "https://json.org" Heuristic match: "\__init__.py" Heuristic match: "encodings\_win_cp_codecs.py" Heuristic match: "encodings\aliases.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "52.py" Heuristic match: "c:\struct.py" Heuristic match: "pyimod01_archive.py" Heuristic match: "c:\pyimod01_archive.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\ctypes\__init__.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\sysconfig\__init__.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\threading.py" Heuristic match: "``_concatenategenericalias`` from typing.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\_bootstrap_external.py" Heuristic match: "c:\pyimod02_importers.py" Heuristic match: "pyimod02_importers.py" Heuristic match: "pyimod03_ctypes.py" Heuristic match: "c:\pyimod03_ctypes.py" Heuristic match: "pyimod04_pywin32.py" Heuristic match: "c:\pyimod04_pywin32.py" Heuristic match: "pyiboot01_bootstrap.py" Heuristic match: "ctypes\__init__.py" Heuristic match: "sysconfig\__init__.py" Heuristic match: "threading.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\ctypes\_endian.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\inspect.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\annotationlib.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\util.py" Heuristic match: "thread.name" Heuristic match: "it__.py" Heuristic match: "_weakrefset.py" Heuristic match: "types.py" Heuristic match: "ctypes\_endian.py" Heuristic match: "pyi_rth_inspect.py" Heuristic match: "inspect.py" Heuristic match: "dis.py" Heuristic match: "annotationlib.py" Heuristic match: "parameter.name" Heuristic match: "pythonpath=tools/peg_generator python3 -m pegen.keywordgen grammar/python.gram grammar/tokens lib/keyword.py" Heuristic match: "ast.py" Heuristic match: "enum.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\ast.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\dis.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\token.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\tokenize.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\machinery.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\_bootstrap.py" Heuristic match: "enum.name" Heuristic match: "keyword.py" Heuristic match: "bytecode.info" Heuristic match: "collections\__init__.py" Heuristic match: ">>> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> path.name" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Pattern match: "https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64" Heuristic match: ">>> item.name" Pattern match: "https://github.com/python/cpython/issues/86361" Pattern match: "https://datatracker.ietf.org/doc/html/rfc7692#section-7.1" Pattern match: "https://docs.python.org/3/library/multiprocessing.html" Pattern match: "https://support.apple.com/en-us/ht201236" Pattern match: "https://creativecommons.org/licenses/by-sa/3.0/" Pattern match: "http://tango.free%" Pattern match: "https://datatracker.ietf.org/doc/html/rfc6455#section-5.5.2" Heuristic match: "glob.py" Heuristic match: "operator.py" Heuristic match: "reprlib.py" Heuristic match: "opcode.py" Heuristic match: "ata.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\opcode.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\_opcode_metadata.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\__init__.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\zipfile\__init__.py" Heuristic match: "c:\users\1tkvzbo\appdata\local\temp\_mei000002802\importlib\_abc.py" Pattern match: "https://peps.python.org/pep-0205/" Heuristic match: "_opcode_metadata.py" Heuristic match: "linecache.py" Heuristic match: "importlib\__init__.py" Heuristic match: "re\__init__.py" Pattern match: "https://docs.python.org/3/howto/mro.html" Heuristic match: "re\_compiler.py" Heuristic match: "re\_constants.py" Heuristic match: "re\_casefix.py" Heuristic match: "functools.py" Heuristic match: "copyreg.py" Heuristic match: "__.py" Heuristic match: "tokenize.py" Pattern match: "tar.gz/tar.bz2/tar.xz/tar.zst"43:T4f1f,Found URL "http://www.zlib.net/varfileinfotranslationtcl/tk" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!.m!k&" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000640.00000001.219159.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp") Found URL "http://www.zlib.net/varfileinfotranslationtcl/tk" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!.m!k&" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0a.miko>u\pekh?u!t]qzi^0oh*ppbmi3ls!)geh0" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://docs.pythotliblidate_cachest" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc7692" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://support.apple.com/en-us/ht201236" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://creativecommons.org/licenses/by-sa/3.0/)" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "http://tango.free%org/tango_desktop_project" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html._special_chars_mapisstring_maxcache2parse_templatesubpattern_constantsopengroupsubpatternclosegroupscanner.__init__scanner.scanexact_token_types" - Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002468.00000000.217784.91210000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002468.00000000.217784.91210000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002468.00000000.217784.91210000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00002468.00000000.217784.91710000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002468.00000000.217784.91810000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000000.217784.91810000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/records" - Source: "00000000-00002468.00000000.217784.91910000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000000.217784.91910000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002468.00000000.217784.91E70000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000000.217784.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000000.217784.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000000.217784.91F80000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002468.00000000.217784.91F80000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00002468.00000000.217784.94BEE000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00002468.00000001.219704.8B359000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000001.219704.90880000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002468.00000001.219704.90880000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://docs.pythotliblidate_cachest" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000001.219704.909C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc7692" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://support.apple.com/en-us/ht201236" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://creativecommons.org/licenses/by-sa/3.0/)" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "http://tango.free%org/tango_desktop_project" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000001.219704.90E10000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html._special_chars_mapisstring_maxcache2parse_templatesubpattern_constantsopengroupsubpatternclosegroupscanner.__init__scanner.scanexact_token_types" - Source: "00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002468.00000001.219704.91210000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002468.00000001.219704.91210000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002468.00000001.219704.91210000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00002468.00000001.219704.91710000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002468.00000001.219704.91810000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000001.219704.91810000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/records" - Source: "00000000-00002468.00000001.219704.91910000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000001.219704.91910000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002468.00000001.219704.91E70000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000001.219704.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000001.219704.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000001.219704.91F80000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002468.00000001.219704.91F80000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00002468.00000002.221624.8B18C000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://docs.pythotliblidate_cachest" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361.for" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc7692" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://support.apple.com/en-us/ht201236" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://creativecommons.org/licenses/by-sa/3.0/)" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "http://tango.free%org/tango_desktop_project" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/entry-points/" - Source: "00000000-00002468.00000002.221624.91210000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/recording-installed-packages/" - Source: "00000000-00002468.00000002.221624.91210000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00002468.00000002.221624.91210000.00000004.mdmp") Found URL "http://docs.python.org/3/library/subprocess" - Source: "00000000-00002468.00000002.221624.91710000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distributionthe" - Source: "00000000-00002468.00000002.221624.91810000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000002.221624.91810000.00000004.mdmp") Found URL "https://peps.python.org/pep-0506/records" - Source: "00000000-00002468.00000002.221624.91910000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000002.221624.91910000.00000004.mdmp") Found URL "https://packaging.python.org/en/latest/specifications/core-metadata/" - Source: "00000000-00002468.00000002.221624.91E70000.00000004.mdmp") Found URL "https://packaging.python.org/specifications/entry-points/>" - Source: "00000000-00002468.00000002.221624.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000002.221624.91E70000.00000004.mdmp") Found URL "https://datatracker.ietf.org/doc/html/rfc6455" - Source: "00000000-00002468.00000002.221624.91F80000.00000004.mdmp") Found URL "https://data.iana.org/time-zones/tz-link.html" - Source: "00000000-00002468.00000002.221624.91F80000.00000004.mdmp")44:Tb39,"LumaForge.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI000002802\*.* (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-fibers-l1-1-1.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-kernel32-legacy-l1-1-1.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00002468) "LumaForge.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00002468)45:T21af,Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8B18C000.00000002.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000000.217784.915C4000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000001.219704.915C4000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.915C4000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found string "C:\Users\1TkvzBo\AppData\Local\Temp\_MEI000002802\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "If it is a path, the file will be opened and closed by ZipFile." (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "allowZip64: if True ZipFile will create files with ZIP64 extensions" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91110000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91110000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.91110000.00000004.mdmp") Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found string "email.base64mime" (Indicator: "base64"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found string "zipfile._path" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91110000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91110000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.91110000.00000004.mdmp") Found string "zipfile._path.glob" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91110000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91110000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.91110000.00000004.mdmp") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp") Found string "BadZipFile" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp") Found string "PyZipFile" (Indicator: "pyzipfile"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp") Found string "PyZipFile" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp") Found string "C:\Users\1TkvzBo\AppData\Local\Temp\_MEI000002802\zipfile\__pycache__\__init__.cpython-314.pyc" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp") Found string ">>> zf = ZipFile(data, 'w')" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "Path accepts the zipfile object itself or a filename" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "resolve to the zipfile." (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "If the zipfile has no filename, such attributes are not" (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "path_name -- filesystem location of a Python script, zipfile," (Indicator: "zipfile"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")46:Te7e,Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "LumaForge.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "LumaForge.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "LumaForge.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "LumaForge.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "LumaForge.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "LumaForge.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "LumaForge.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "LumaForge.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "LumaForge.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.951D9000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000000.217784.A4AB3000.00000002.mdmp, 00000000-00002468.00000000.217784.A77F3000.00000002.mdmp, 00000000-00002468.00000000.217784.AAA96000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp, 00000000-00002468.00000002.221624.A96A3000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp")47:T4d1,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "LumaForge.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "LumaForge.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "LumaForge.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "LumaForge.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "LumaForge.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp")48:T43f,Found string "where a single '*' indicates a type variable tuple::" (Indicator: "where "; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "where the use of '**' creates a parameter specification::" (Indicator: "where "; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "Where there is no registered implementation for a specific type, its method" (Indicator: "where "; Source: "00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp") Found string "Where a nested list appears, it contains classes derived from the class" (Indicator: "where "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")49:Tb19,Found string "password" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.8BA51000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp") Found string "secrets" (Indicator: "secret"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.91910000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.91910000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.91910000.00000004.mdmp") Found string "pwd is the password to decrypt files (only used for reading)." (Indicator: "password"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "The username, password, hostname, and port sub-components of netloc" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "``(username, password)`` pair or a list of such pairs." (Indicator: "password"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "It receives ``username`` and ``password`` arguments and returns" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "by namelist(). You can specify the password to decrypt all files" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found string "Set default password for encrypted files." (Indicator: "password"; Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found string "File %r is encrypted, password required for extraction" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp") Found string "Return file bytes for name. 'pwd' is the password to decrypt" (Indicator: "password"; Source: "00000000-00002468.00000000.217784.91010000.00000004.mdmp, 00000000-00002468.00000001.219704.91010000.00000004.mdmp")4a:Te6d,Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <>

" (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> "; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "event add <> " (Indicator: ""; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")4b:T68a,Found string "Route attribute access on a class to __getattr__." (Indicator: "route"; Source: "00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp") Found string "gethostname() -- return the current hostname" (Indicator: "hostname"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "gethostbyname() -- map a hostname to its IP number" (Indicator: "hostname"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "gethostbyaddr() -- map an IP number or hostname to DNS info" (Indicator: "hostname"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "A ping may serve as a keepalive or as a check that the remote endpoint" (Indicator: "ping"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp") Found string "ConcurrencyError: If another ping was sent with the same data and" (Indicator: "ping"; Source: "00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp")4c:T12fb,Found string "\Device\HarddiskVolume3\LumaForge.exe" (Indicator: "\Device\"; Source: "00000000-00000640-00000BC0-2389052843") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\LumaForge.exe" (Indicator: "\Device\"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000000.217238.9BDE3000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000000.217238.279F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.279F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000000.217238.279F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.279F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "\Device\HarddiskVolume3\LumaForge.exe" (Indicator: "\Device\"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000000.217784.90560000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.90560000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000000.217784.90560000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.90560000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.92808000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.92808000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.92808000.00000004.mdmp") Found string "C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002468.00000000.217784.90880000.00000004.mdmp, 00000000-00002468.00000000.217784.92808000.00000004.mdmp, 00000000-00002468.00000001.219704.90880000.00000004.mdmp, 00000000-00002468.00000001.219704.92808000.00000004.mdmp, 00000000-00002468.00000002.221624.90880000.00000004.mdmp, 00000000-00002468.00000002.221624.92808000.00000004.mdmp")4d:T9e1,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "LumaForge.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "LumaForge.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "LumaForge.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000640.00000001.219159.60543000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000000.217784.94BEE000.00000002.mdmp, 00000000-00002468.00000000.217784.94C7A000.00000002.mdmp, 00000000-00002468.00000000.217784.951B8000.00000002.mdmp, 00000000-00002468.00000000.217784.951D9000.00000002.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000000.217784.A4AB3000.00000002.mdmp, 00000000-00002468.00000000.217784.A77F3000.00000002.mdmp, 00000000-00002468.00000000.217784.AAA96000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.94A77000.00000002.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000001.219704.9C6F4000.00000002.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.92505000.00000002.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp, 00000000-00002468.00000002.221624.9842E000.00000002.mdmp, 00000000-00002468.00000002.221624.99437000.00000002.mdmp, 00000000-00002468.00000002.221624.9B64E000.00000002.mdmp, 00000000-00002468.00000002.221624.A96A3000.00000002.mdmp, 00000000-00002468.00000002.221624.AB0B5000.00000002.mdmp")4e:T9f1,"LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\LUMAFORGE.EXE"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "LumaForge.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T885,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140.dll]- [targetUID: 00000000-00002468] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002468] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_decimal.pyd]- [targetUID: 00000000-00002468] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ssl.pyd]- [targetUID: 00000000-00002468] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_lzma.pyd]- [targetUID: 00000000-00002468] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ctypes.pyd]- [targetUID: 00000000-00002468] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_bz2.pyd]- [targetUID: 00000000-00002468] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_socket.pyd]- [targetUID: 00000000-00002468] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000002802\_asyncio.pyd]- [targetUID: 00000000-00002468] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_hashlib.pyd]- [targetUID: 00000000-00002468] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_overlapped.pyd]- [targetUID: 00000000-00002468] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_multiprocessing.pyd]- [targetUID: 00000000-00002468] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_queue.pyd]- [targetUID: 00000000-00002468]50:T885,"VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140.dll]- [targetUID: 00000000-00002468] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002468] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_decimal.pyd]- [targetUID: 00000000-00002468] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ssl.pyd]- [targetUID: 00000000-00002468] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_lzma.pyd]- [targetUID: 00000000-00002468] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_ctypes.pyd]- [targetUID: 00000000-00002468] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_bz2.pyd]- [targetUID: 00000000-00002468] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_socket.pyd]- [targetUID: 00000000-00002468] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI000002802\_asyncio.pyd]- [targetUID: 00000000-00002468] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_hashlib.pyd]- [targetUID: 00000000-00002468] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_overlapped.pyd]- [targetUID: 00000000-00002468] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_multiprocessing.pyd]- [targetUID: 00000000-00002468] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\_MEI000002802\_queue.pyd]- [targetUID: 00000000-00002468]51:T1488,"LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\VCRUNTIME140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_asyncio.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_multiprocessing.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_overlapped.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LumaForge.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI000002802\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...52:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macIceland.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-14.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-15.enc" which has been seen in the context of ransomware (Indicator: .ENC)53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790974528446,"unified_at":"2026-10-02T20:55:28.446Z","metadata":{"hashes":{"sha256":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","sha1":"73c004cf2c2702fe53d414dbc13c66d199413a0e","md5":"5278f0e980f4e1e1cba03734e64eeab6","sha512":"ab0b8ec8e2300f0cec34a9cb8f469166ab7feb5d8815b8ad04ae57f4f56a568070354ee25a5042a1eaf928230c9622e83dbe1417b65eca5e03ece98dbc712922","ssdeep":"393216:whL1F2omXEAphVtnIUQSg+xeXr3qRvFgt6:QpsomRphDto+xar3GvFg","ssdeep_chunks":["393216:whL1F2o","393216:hL1F2om","393216:L1F2omX","393216:1F2omXE","393216:F2omXEA","393216:2omXEAp","393216:omXEAph","393216:mXEAphV","393216:XEAphVt","393216:EAphVtn","393216:AphVtnI","393216:phVtnIU","393216:hVtnIUQ","393216:VtnIUQS","393216:tnIUQSg","393216:nIUQSg+","393216:IUQSg+x","393216:UQSg+xe","393216:QSg+xeX","393216:Sg+xeXr","393216:g+xeXr3","393216:+xeXr3q","393216:xeXr3qR","393216:eXr3qRv","393216:Xr3qRvF","393216:r3qRvFg","393216:3qRvFgt","393216:qRvFgt6","786432:whL1F2o","786432:hL1F2om","786432:L1F2omX","786432:1F2omXE","786432:F2omXEA","786432:2omXEAp","786432:omXEAph","786432:mXEAphV","786432:XEAphVt","786432:EAphVtn","786432:AphVtnI","786432:phVtnIU","786432:hVtnIUQ","786432:VtnIUQS","786432:tnIUQSg","786432:nIUQSg+","786432:IUQSg+x","786432:UQSg+xe","786432:QSg+xeX","786432:Sg+xeXr","786432:g+xeXr3","786432:+xeXr3q","786432:xeXr3qR","786432:eXr3qRv","786432:Xr3qRvF","786432:r3qRvFg","786432:3qRvFgt","786432:qRvFgt6","393216:QpsomRp","393216:psomRph","393216:somRphD","393216:omRphDt","393216:mRphDto","393216:RphDto+","393216:phDto+x","393216:hDto+xa","393216:Dto+xar","393216:to+xar3","393216:o+xar3G","393216:+xar3Gv","393216:xar3GvF","393216:ar3GvFg"],"imphash":"e3e80a143805ea18936c8f612e25d363","pehash":"377dd19a20574afd68311064cd5bbebe16536b69"},"file_info":{"file_name":"LumaForge.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":14738385,"entropy":8,"compile_timestamp":"2026-10-02T19:40:21","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790974176000,"last_seen":1790974177000,"last_multi_scan":1790974177000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":204800,"raw_size":204800},{"name":".rdata","virtual_address":"0x33000","virtual_size":84308,"raw_size":84480},{"name":".data","virtual_address":"0x48000","virtual_size":19192,"raw_size":3584},{"name":".pdata","virtual_address":"0x4d000","virtual_size":10092,"raw_size":10240},{"name":".fptable","virtual_address":"0x50000","virtual_size":256,"raw_size":512},{"name":".rsrc","virtual_address":"0x51000","virtual_size":62492,"raw_size":62976},{"name":".reloc","virtual_address":"0x61000","virtual_size":1888,"raw_size":2048}],"section_names":[".text",".rdata",".data",".pdata",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":158,"suspicious_count":17,"malicious_count":0,"total":175},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Blank.Script.2228","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Blank.Script","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"Uses bzip2 compression library to compress data"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Process binds to unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"LumaForge.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"LumaForge.exe\")\n Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"LumaForge.exe\" called \"FindResourceW\" with parameter \"140705583479328\" - (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"LumaForge.exe\" called \"LoadResource with parameter {'hModule': '140705582284800', 'hResInfo': '140705583766384'}\" (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"LumaForge.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00000640.00000000.217238.9BDE3000.00000004.mdmp\n 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"LumaForge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\LumaForge\\settings.tmp\" to \"%LOCALAPPDATA%\\LumaForge\\settings.json\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"LumaForge.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"LumaForge.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"LumaForge.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"LumaForge.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"LumaForge.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"LumaForge.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002468.00000000.217784.8EB50000.00000004.mdmp, 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp, 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"LumaForge.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00000640.00000000.217238.260F0000.00000004.mdmp, 00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"LumaForge.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"LumaForge.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"LumaForge.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"LumaForge.exe\")\n Found reference to API \"flags is a bitmask for getaddrinfo().\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"LumaForge.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"LumaForge.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"LumaForge.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"LumaForge.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000640)\n \"LumaForge.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002468)\n \"LumaForge.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"LumaForge.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000640)\n \"LumaForge.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"LumaForge.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000640)\n \"LumaForge.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"LumaForge.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002468)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: LumaForge.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"run_query(\"SELECT * FROM students\") # OK\" (Indicator: \"select * from \"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")\n Found string \"run_query(\"SELECT * FROM \" + literal_string) # OK\" (Indicator: \"select * from \"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")\n Found string \"f\"SELECT * FROM students WHERE name = {arbitrary_string}\"\" (Indicator: \"select * from \"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"LumaForge.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"LumaForge.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set\" (Indicator: \"set\"; File: \"screen_4.png\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"LumaForge.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"LumaForge.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"LumaForge.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; File: \"LumaForge.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"LumaForge.exe\")\n Found reference to API \"VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; File: \"LumaForge.exe\")\n Found reference to API \"640,3776,3024,,RtlGetVersion,NTDLL.dll,\"00:56:37.875\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")\n Found reference to API \"Tcl_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"LumaForge.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"LumaForge.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"LumaForge.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"LumaForge.exe\" called \"CreateProcessW\" with parameter \"\"C:\\LumaForge.exe\"\" - (UID: 00000000-00000640)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00002468.00000000.217784.90D10000.00000004.mdmp, 00000000-00002468.00000002.221624.90D10000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\"), \"Select entry points from self that match the\" (Source: 00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91E70000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91E70000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91E70000.00000004.mdmp, Indicator: \"select entry points from self that match the\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"LumaForge.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"LumaForge.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"LumaForge.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"LumaForge.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"LumaForge.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"LumaForge.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"LumaForge.exe\")\n Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"LumaForge.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$33","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\LanguageOverlay\" in Source: 00000000-00000640.00000000.217238.9BDE3000.00000004.mdmp\n 00000000-00000640.00000001.219159.9BDE3000.00000004.mdmp\n \"REGISTRY\\USER\\S-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00000640.00000001.219159.260F0000.00000004.mdmp\n 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00002468.00000000.217784.90880000.00000004.mdmp\n 00000000-00002468.00000001.219704.90880000.00000004.mdmp\n 00000000-00002468.00000002.221624.90880000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00002468.00000000.217784.90880000.00000004.mdmp\n 00000000-00002468.00000001.219704.90880000.00000004.mdmp\n 00000000-00002468.00000002.221624.90880000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process LumaForge.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:640:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:640:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"SM0:640:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"Local\\SM0:640:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2468:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2468:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"SM0:2468:304:WilStaging_02\"\n Process LumaForge.exe created mutex with name \"Local\\SM0:2468:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$34","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"LumaForge.exe\" failed to load missing module \"%TEMP%\\_MEI000002802\\python3\" - [base:0; Status:c0000135]\n \"LumaForge.exe\" failed to load missing module \"python3\" - [base:0; Status:c0000135]\n \"LumaForge.exe\" failed to load missing module \"%TEMP%\\_MEI000002802\\DLLs\\python3\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$35","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"ping@lfw.org\"\n Pattern match: \"yselivanov@sprymix.com\"\n Pattern match: \"patthoyts@users.sourceforge.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")\n \"argument types, see https://github.com/python/cpython/issues/86361.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"LumaForge.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BD4B0000\n \"LumaForge.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BE400000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"LumaForge.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at BF180000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020422cbef87f0000@ntdll.dll\"\n \"220023000000000040422cbef87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$38","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"LumaForge.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"VCRUNTIME140.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"VCRUNTIME140_1.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_decimal.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_ssl.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_lzma.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_ctypes.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_bz2.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_socket.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_asyncio.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_hashlib.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_overlapped.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_multiprocessing.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_queue.pyd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"LumaForge.exe\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \".text\"\n \"VCRUNTIME140.dll\" has an executable section named \"fothk\"\n \"VCRUNTIME140_1.dll\" has an executable section named \".text\"\n \"_decimal.pyd\" has an executable section named \".text\"\n \"_ssl.pyd\" has an executable section named \".text\"\n \"_lzma.pyd\" has an executable section named \".text\"\n \"_ctypes.pyd\" has an executable section named \".text\"\n \"_bz2.pyd\" has an executable section named \".text\"\n \"_socket.pyd\" has an executable section named \".text\"\n \"_asyncio.pyd\" has an executable section named \".text\"\n \"_hashlib.pyd\" has an executable section named \".text\"\n \"_overlapped.pyd\" has an executable section named \".text\"\n \"_multiprocessing.pyd\" has an executable section named \".text\"\n \"_queue.pyd\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"LumaForge.exe\" has an writable section named \".data\"\n \"LumaForge.exe\" has an writable section named \".fptable\"\n \"VCRUNTIME140.dll\" has an writable section named \".data\"\n \"VCRUNTIME140_1.dll\" has an writable section named \".data\"\n \"_decimal.pyd\" has an writable section named \".data\"\n \"_ssl.pyd\" has an writable section named \".data\"\n \"_lzma.pyd\" has an writable section named \".data\"\n \"_ctypes.pyd\" has an writable section named \".data\"\n \"_bz2.pyd\" has an writable section named \".data\"\n \"_socket.pyd\" has an writable section named \".data\"\n \"_asyncio.pyd\" has an writable section named \".data\"\n \"_asyncio.pyd\" has an writable section named \"AsyncioD\"\n \"_hashlib.pyd\" has an writable section named \".data\"\n \"_overlapped.pyd\" has an writable section named \".data\"\n \"_multiprocessing.pyd\" has an writable section named \".data\"\n \"_queue.pyd\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"LumaForge.exe\" has high imagebase \"0x140000000\"\n \"VCRUNTIME140.dll\" has high imagebase \"0x180000000\"\n \"VCRUNTIME140_1.dll\" has high imagebase \"0x180000000\"\n \"_decimal.pyd\" has high imagebase \"0x180000000\"\n \"_ssl.pyd\" has high imagebase \"0x180000000\"\n \"_lzma.pyd\" has high imagebase \"0x180000000\"\n \"_ctypes.pyd\" has high imagebase \"0x180000000\"\n \"_bz2.pyd\" has high imagebase \"0x180000000\"\n \"_socket.pyd\" has high imagebase \"0x180000000\"\n \"_asyncio.pyd\" has high imagebase \"0x180000000\"\n \"_hashlib.pyd\" has high imagebase \"0x180000000\"\n \"_overlapped.pyd\" has high imagebase \"0x180000000\"\n \"_multiprocessing.pyd\" has high imagebase \"0x180000000\"\n \"_queue.pyd\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"LumaForge.exe\" (UID: 00000000-00002468) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\LumaForge.exe\", USERDNSDOMAIN=\"ms1tHITvnELwxWO\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI000002802\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"LumaForge.exe\" (UID: 00000000-00002468) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"LumaForge.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"LumaForge.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"LumaForge.exe\" (UID: 00000000-00002468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"LumaForge.exe\" (UID: 00000000-00002468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"LumaForge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000002802\\VCRUNTIME140.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"VCRUNTIME140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\"- Location: [%TEMP%\\_MEI000002802\\VCRUNTIME140.dll]- [targetUID: 00000000-00002468]\n \"VCRUNTIME140_1.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- Location: [%TEMP%\\_MEI000002802\\VCRUNTIME140_1.dll]- [targetUID: 00000000-00002468]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"LumaForge.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000002802\\_asyncio.pyd\"\n \"LumaForge.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000002802\\_bz2.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"LumaForge.exe\" queries basic process information of the \"C:\\LumaForge.exe\" (UID: 640)\n \"LumaForge.exe\" queries basic process information of the \"C:\\LumaForge.exe\" (UID: 2468)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"LumaForge.exe\" reads file \"c:\\lumaforge.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"LumaForge.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000002802\\VCRUNTIME140.dll\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI000002802\\VCRUNTIME140_1.dll\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\Users\\1TkvzBo\\AppData\\Local\\Temp\\_MEI000002802\\FLTLIB.DLL\"\n \"LumaForge.exe\" trying to access non-existent file \"C:\\Users\\1TkvzBo\\AppData\\Local\\Temp\\_MEI000002802\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"LumaForge.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei000002802\\vcruntime140.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; File: \"kl.msg\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"LumaForge.exe\")\n Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"LumaForge.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"LumaForge.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"LumaForge.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"LumaForge.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"LumaForge.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"LumaForge.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"LumaForge.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"LumaForge.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"LumaForge.exe\")\n Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"b_tcl_data\\msgs\\es_mx.msg\" [Source: 00000000-00000640.00000000.217238.260F0000.00000004.mdmp\n 00000000-00000640.00000001.219159.260F0000.00000004.mdmp\n 00000000-00000640.00000002.221076.260F0000.00000004.mdmp]\n Observed email domain:\"b_tcl_data\\msgs\\es_mx.msg\" [Source: 00000000-00002468.00000000.217784.8EB50000.00000004.mdmp\n 00000000-00002468.00000001.219704.8EB50000.00000004.mdmp\n 00000000-00002468.00000002.221624.8EB50000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"8.6.15.0\" found in string \"Tcl/Tk for Python (tcl-core-8.6.15.0)\"\n Potential IP \"127.0.0.1\" found in string \"ipv4_connect = create_task(open_connection(\"127.0.0.1\", 80))\"\n Potential IPs \"192.0.2.0\"\n \"192.0.2.0\" found in string \"IPv4Address('192.0.2.0') <= IPv4Network('192.0.2.0/24')\"\n Potential IP \"192.0.2.0\" found in string \">>> list(summarize_address_range(IPv4Address('192.0.2.0'),\"\n Potential IP \"192.0.2.130\" found in string \"... IPv4Address('192.0.2.130')))\"\n Potential IPs \"192.0.2.0\"\n \"192.0.2.128\" found in string \"[IPv4Network('192.0.2.0/25'), IPv4Network('192.0.2.128/31'),\"\n Potential IP \"192.0.2.130\" found in string \"IPv4Network('192.0.2.130/32')]\"\n Potential IP \"123.45.67.89\" found in string \"inet_aton() -- convert IP addr string (123.45.67.89) to 32-bit packed format\"\n Potential IP \"123.45.67.89\" found in string \"inet_ntoa() -- convert 32-bit packed format IP to string (123.45.67.89)\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"InvalidProtocol: If the request protocol isn't HTTP/1.1; then\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002468\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in process \"00000000-00000640\"\n YARA signature for zlib compression library used in process \"00000000-00002468\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00000640\"\n YARA signature for file using Zlib compression matched on process \"00000000-00002468\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"LumaForge.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"18,2944,3181,,CreateCompatibleBitmap,Gdi32.dll,\"00:56:40.468\",RX=0,PX=0\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"640,3776,3024,,RtlGetVersion,NTDLL.dll,\"00:56:37.875\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000640.00000001.219159.260F0000.00000004.mdmp, 00000000-00000640.00000002.221076.260F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: LumaForge.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"04,,GetKeyState,user32.dll,\"00:56:40.812\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"LumaForge.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"LumaForge.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"LumaForge.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at B41D0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"LumaForge.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: LumaForge.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"LumaForge.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"LumaForge.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"LumaForge.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"LumaForge.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"LumaForge.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"LumaForge.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"LumaForge.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"LumaForge.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"LumaForge.exe\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"LumaForge.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname() -- return the current hostname\" (Indicator: \"gethostname\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"LumaForge.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"LumaForge.exe\")\n Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00002468.00000000.217784.90E10000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000000.217784.991A9000.00000002.mdmp, 00000000-00002468.00000001.219704.90E10000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.90E10000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"LumaForge.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.9BCB4000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$49","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: LumaForge.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"LumaForge.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"LumaForge.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"LumaForge.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"LumaForge.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: LumaForge.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"LumaForge.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000640.00000001.219159.60543000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000000.217784.92398000.00000002.mdmp, 00000000-00002468.00000001.219704.8B359000.00000002.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.A9CE6000.00000002.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.94D88000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: LumaForge.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002468.00000000.217784.90AC0000.00000004.mdmp, 00000000-00002468.00000001.219704.90AC0000.00000004.mdmp, 00000000-00002468.00000002.221624.90AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fread\" (Source: LumaForge.exe, API is part of module: MSVCRT.DLL)\n Found string \"fwrite\" (Source: LumaForge.exe, API is part of module: MSVCRT.DLL)\n Found string \"fseek\" (Source: LumaForge.exe, API is part of module: MSVCRT.DLL)\n Found string \"fopen\" (Source: LumaForge.exe, API is part of module: MSVCRT.DLL)\n Found string \"AreFileApisANSI\" (Source: LumaForge.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: LumaForge.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: LumaForge.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: LumaForge.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: LumaForge.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"fothk\" has very low entropy (0.02)\n indicating potential NOP sled\n Section \"AsyncioD\" has very low entropy (0.38)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"LumaForge.exe\" has section name .rsrc with entropy \"7.5548822354346745\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00002468.00000002.221624.9B64E000.00000002.mdmp\" at offset 3556; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"LumaForge.exe\" has resource with unusual entropy \"RT_ICON:7.950949195950686\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$51","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"* RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518\" (Indicator: \"webdav\"; Source: \"00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp\")\n Found string \"* RFC 5842: Binding Extensions to WebDAV\" (Indicator: \"webdav\"; Source: \"00000000-00002468.00000000.217784.909C0000.00000004.mdmp, 00000000-00002468.00000000.217784.91210000.00000004.mdmp, 00000000-00002468.00000001.219704.909C0000.00000004.mdmp, 00000000-00002468.00000001.219704.91210000.00000004.mdmp, 00000000-00002468.00000002.221624.909C0000.00000004.mdmp, 00000000-00002468.00000002.221624.91210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"C:\\LumaForge.exe\" binds to port 17623","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00002468\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted a file with a known ransomware suffix","description":"$52","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10108c9\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"201083f\"\n \"cx\": \"17\"\n \"cy\": \"747\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"109e8\"\n \"cx\": \"17\"\n \"cy\": \"747\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"201083f\"\n \"cx\": \"17\"\n \"cy\": \"781\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"130108dc\"\n \"cx\": \"17\"\n \"cy\": \"747\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"130108dc\"\n \"cx\": \"17\"\n \"cy\": \"781\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"c0108cf\"\n \"cx\": \"17\"\n \"cy\": \"747\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10908\"\n \"cx\": \"17\"\n \"cy\": \"747\"}\n \"LumaForge.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10107de\"\n \"cx\": \"17\"\n \"cy\": \"747\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"161\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"144\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"145\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"LumaForge.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"LumaForge.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\LumaForge\\settings.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"VCRUNTIME140.dll\" claimed CRC 14787420 while the actual is CRC 123501\n \"VCRUNTIME140_1.dll\" claimed CRC 123501 while the actual is CRC 52724\n \"_decimal.pyd\" claimed CRC 52724 while the actual is CRC 323619\n \"_ssl.pyd\" claimed CRC 323619 while the actual is CRC 199103\n \"_lzma.pyd\" claimed CRC 199103 while the actual is CRC 208204\n \"_ctypes.pyd\" claimed CRC 208204 while the actual is CRC 143626\n \"_bz2.pyd\" claimed CRC 143626 while the actual is CRC 115741\n \"_socket.pyd\" claimed CRC 115741 while the actual is CRC 115611\n \"_asyncio.pyd\" claimed CRC 115611 while the actual is CRC 92378\n \"_hashlib.pyd\" claimed CRC 92378 while the actual is CRC 130395\n \"_overlapped.pyd\" claimed CRC 130395 while the actual is CRC 99583\n \"_multiprocessing.pyd\" claimed CRC 99583 while the actual is CRC 66282\n \"_queue.pyd\" claimed CRC 66282 while the actual is CRC 80612","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n Sleep\n Process32FirstW\n GetModuleHandleW\n UnhandledExceptionFilter\n Process32NextW\n GetModuleFileNameW\n IsDebuggerPresent\n TerminateProcess\n FindNextFileW\n GetFileSizeEx\n OpenProcess\n GetTempPathW\n GetModuleHandleExW\n GetDriveTypeW\n VirtualProtect\n WriteFile\n CreateFileW\n LoadLibraryExW\n GetProcAddress\n CreateDirectoryW\n DeleteFileW\n GetFileAttributesExW\n GetStartupInfoW\n CreateProcessW\n FindFirstFileExW\n CreateToolhelp32Snapshot\n FindFirstFileW\n GetCommandLineA\n GetCommandLineW\n GetCursorPos\n GetSystemInfo\n VirtualAlloc\n GetComputerNameExW\n WSASocketW\n send\n listen\n recv\n bind\n connect\n closesocket\n recvfrom\n accept\n sendto\n WSAStartup\n ConnectNamedPipe\n WSASendTo\n WSASend\n socket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"VCRUNTIME140.dll\" claims program is from Mon Nov 21 08:39:02 2033\n \"VCRUNTIME140_1.dll\" claims program is from Thu Jun 10 23:23:34 1982","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}],"intel_graph":{"map":{"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4":{"type":"File","value":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},"File:08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99":{"type":"File","value":"08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99"},"File:0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc":{"type":"File","value":"0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc"},"File:25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9":{"type":"File","value":"25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9"},"File:25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250":{"type":"File","value":"25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250"},"File:36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2":{"type":"File","value":"36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2"},"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5":{"type":"File","value":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5"},"File:5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad":{"type":"File","value":"5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad"},"File:5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395":{"type":"File","value":"5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395"},"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8":{"type":"File","value":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},"File:8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610":{"type":"File","value":"8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610"},"File:8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706":{"type":"File","value":"8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706"},"File:9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba":{"type":"File","value":"9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba"},"File:ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793":{"type":"File","value":"ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793"},"File:ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61":{"type":"File","value":"ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61"},"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b":{"type":"File","value":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c":{"type":"File","value":"bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c"},"File:bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762":{"type":"File","value":"bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762"},"File:d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11":{"type":"File","value":"d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11"},"File:dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a":{"type":"File","value":"dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a"},"File:e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626":{"type":"File","value":"e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626"},"File:fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd":{"type":"File","value":"fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd"}},"chains":[{"id":"1555683299082146060","root":"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"sandbox_files","root":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","edges":[{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626"},{"edge_kind":"extracted","from_key":"File:3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","to_key":"File:0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":247,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ac018de0a53baa9cd0502ab","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":100,"malware_family":"Trojan.Blank.Script","submit_name":"LumaForge.exe","analysis_start_time":"2026-10-02T20:49:38+00:00","indicators_count":{"informative":158,"suspicious":27,"malicious":0},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}],"processes":[{"pid":640,"ppid":0,"name":"LumaForge.exe","command_line":"","sha256":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","normalized_path":"C:\\LumaForge.exe","uid":"00000000-00000640","icon":"$53"},{"pid":2468,"ppid":640,"name":"LumaForge.exe","command_line":"","sha256":"3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5","normalized_path":"C:\\LumaForge.exe","parent_uid":"00000000-00000640","uid":"00000000-00002468"}],"all_imported_dlls":["imm32.dll","crypt32.dll","mswsock.dll","shell32.dll","netapi32.dll","zlib1.dll","clbcatq.dll","tcl86t.dll","TextInputFramework.dll","gdi32full.dll","comctl32.dll","combase.dll","shlwapi.dll","userenv.dll","kernel.appcore.dll","WinTypes.dll","cryptbase.dll","ole32.dll","version.dll","gdi32.dll","advapi32.dll","VxSSL64.dll","cryptsp.dll","libcrypto-3.dll","SHCore.dll","kernel32.dll","CoreMessaging.dll","bcryptprimitives.dll","logoncli.dll","CoreUIComponents.dll","msvcrt.dll","ws2_32.dll","samcli.dll","user32.dll","vcruntime140_1.dll","oleaut32.dll","uxtheme.dll","msvcp140.dll","ucrtbase.dll","VCRUNTIME140.dll","fltLib.dll","msctf.dll","VCRUNTIME140_1.dll","tk86t.dll","vcruntime140.dll","libffi-8.dll","rpcrt4.dll","win32u.dll","sechost.dll","libssl-3.dll","netutils.dll","KernelBase.dll","msvcp_win.dll","python314.dll","bcrypt.dll","IPHLPAPI.DLL","comdlg32.dll","ntdll.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"VCRUNTIME140.dll","sha256":"052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"VCRUNTIME140_1.dll","sha256":"6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_asyncio.pyd","sha256":"dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_bz2.pyd","sha256":"d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_ctypes.pyd","sha256":"25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_decimal.pyd","sha256":"8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_hashlib.pyd","sha256":"36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_lzma.pyd","sha256":"5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_multiprocessing.pyd","sha256":"9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_overlapped.pyd","sha256":"ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_queue.pyd","sha256":"bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_socket.pyd","sha256":"25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"_ssl.pyd","sha256":"5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"auto.tcl","sha256":"08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"clock.tcl","sha256":"bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"ascii.enc","sha256":"fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"big5.enc","sha256":"ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"cns11643.enc","sha256":"8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"cp1250.enc","sha256":"e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"cp1251.enc","sha256":"0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}],"files_written":[{"path":"%TEMP%\\_MEI000002802\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_asyncio.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_multiprocessing.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_overlapped.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-11.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\koi8-ru.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\koi8-t.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\history.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\init.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\he.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\hi.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\hi_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\hr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\hu.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\id.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\id_id.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\is.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\it.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\it_ch.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ja.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kl_gl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ko.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ko_kr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kok.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kok_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kw.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\kw_gb.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\lt.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\lv.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\mk.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\mr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\mr_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ms.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ms_my.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\mt.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\nb.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\nl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\nl_be.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\nn.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\pl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\pt.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\pt_br.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ro.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ru.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ru_ua.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sh.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sk.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sl.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sq.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sv.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\sw.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ta.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\ta_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\te.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\te_in.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\th.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\tr.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\uk.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\vi.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\zh.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\zh_cn.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\zh_hk.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\zh_sg.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\msgs\\zh_tw.msg","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\opt0.4\\optparse.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\opt0.4\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\package.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\parray.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\safe.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tclIndex","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tm.tcl","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Abidjan","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Accra","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Addis_Ababa","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Algiers","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Asmara","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Asmera","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Bamako","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Bangui","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Banjul","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%TEMP%\\_MEI000002802\\_tcl_data\\tzdata\\Africa\\Bissau","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%LOCALAPPDATA%\\LumaForge","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"path":"%LOCALAPPDATA%\\LumaForge\\settings.tmp","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"SM0:640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"Local\\SM0:640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"SM0:2468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]},{"name":"Local\\SM0:2468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac018de0a53baa9cd0502ab"}]}]}},"report_ids":{"sandbox_job_ids":["6ac018de0a53baa9cd0502ab"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Blank.Script Sample 3eab47f296f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3eab47f296f6…. Malware family: Trojan.Blank.Script. Threat score 100/100. 3/27 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Blank.Script Sample 3eab47f296f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3eab47f296f6…. Malware family: Trojan.Blank.Script. Threat score 100/100. 3/27 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3eab47f296f64c5a0a69b6655410cd72a08cd56b245031afbb071f0d613398b5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Blank.Script Sample 3eab47f296f6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3eab47f296f6…. Malware family: Trojan.Blank.Script. Threat score 100/100. 3/27 AV engines flagged this file. 0 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]]