26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 7039e6fb048b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7039e6fb048b…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69"],"about":{"@type":"SoftwareApplication","name":"5b8011576b37d84db9122786cded9f55.exe","applicationCategory":["peexe","executable"],"identifier":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb30,Found string "Failed to enable compression for ssh session" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Header compression/decompression error" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSL_COMP_add_compression_method" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "decompression failure" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "bad compression algorithm" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "bad decompression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "compression disabled" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "compression failure" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "compression id not within private range" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "compression library error" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "duplicate compression id" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "illegal point compression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "inconsistent compression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "invalid compression algorithm" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "no compression specified" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "old session compression algorithm not returned" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "required compression algorithm missing" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "ssl/tls alert decompression failure" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "zlib compression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Brotli compression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Zstandard compression" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "invalid compression bit" (Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") file/memory contains long string(Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "dd_dotnet48_decompression_log.txt" (Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp")28:T58f,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "after MemoryLoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")29:T57b,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")2a:T102f,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32")2b:Te56,Observed string: "crypto/asn1/a_object.c" (Indicator: "crypto/asn1/a_object.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/a_strex.c" (Indicator: "crypto/asn1/a_strex.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/a_time.c" (Indicator: "crypto/asn1/a_time.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/ameth_lib.c" (Indicator: "crypto/asn1/ameth_lib.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/asn1_lib.c" (Indicator: "crypto/asn1/asn1_lib.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/asn_pack.c" (Indicator: "crypto/asn1/asn_pack.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/d2i_pr.c" (Indicator: "crypto/asn1/d2i_pr.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/tasn_dec.c" (Indicator: "crypto/asn1/tasn_dec.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/tasn_enc.c" (Indicator: "crypto/asn1/tasn_enc.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/tasn_fre.c" (Indicator: "crypto/asn1/tasn_fre.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/tasn_new.c" (Indicator: "crypto/asn1/tasn_new.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/tasn_utl.c" (Indicator: "crypto/asn1/tasn_utl.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/x_algor.c" (Indicator: "crypto/asn1/x_algor.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/x_info.c" (Indicator: "crypto/asn1/x_info.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/x_int64.c" (Indicator: "crypto/asn1/x_int64.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/asn1/x_pkey.c" (Indicator: "crypto/asn1/x_pkey.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/async/async.c" (Indicator: "crypto/async/async.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/async/async_wait.c" (Indicator: "crypto/async/async_wait.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bf_buff.c" (Indicator: "crypto/bio/bf_buff.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bf_prefix.c" (Indicator: "crypto/bio/bf_prefix.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bio_addr.c" (Indicator: "crypto/bio/bio_addr.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bio_lib.c" (Indicator: "crypto/bio/bio_lib.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bio_meth.c" (Indicator: "crypto/bio/bio_meth.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "0Ccrypto/bio/bio_print.c" (Indicator: "0Ccrypto/bio/bio_print.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "crypto/bio/bio_sock.c" (Indicator: "crypto/bio/bio_sock.c") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp2c:Tf24,Found string "SSL public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Using SSH public key file '%s'" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Using SSH private key file '%s'" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Initialized SSH public key authentication" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSH public key authentication failed: %s" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSH MD5 public key: %s" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSH SHA256 public key: %s" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "unable to use private key from PKCS12 file '%s'" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "private key from PKCS12 file '%s' does not match certificate in same file" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "failed to load private key from crypto engine" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "unable to set private key" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "crypto engine not set, cannot load private key" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "file type P12 for private key not supported" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "not supported file type for private key" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Private key does not match the certificate public key" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Certificate level %d: Public key type %s%s (%d/%d Bits/secBits), signed using %s" (Indicator: "public key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to open ED25519 private key file" (Indicator: "private key"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")2d:T8af6,Found XOR loop in file "LummaC2.exe" at offset 256317; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 285981; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 291579; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 292919; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 294737; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 296735; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 298077; code bytes = 30d0 Found XOR loop in file "LummaC2.exe" at offset 107015; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271488; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271508; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271512; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271520; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271920; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271940; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 271956; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 291540; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 292880; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 294698; code bytes = 8030 Found XOR loop in file "LummaC2.exe" at offset 296696; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A970CF2.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A970CF2.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A970CF2.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A970CF2.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 214643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 215971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 459672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 518457; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 528696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 541742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 543366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 611570; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 667273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 678140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 825112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 870933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 975790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1057193; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1087144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1100993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1129544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1167165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1186207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1191892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1231250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1241473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1242122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1258416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1264685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1316429; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1316549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1363156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1419036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1425371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1433105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1492393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1516597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1517825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1544414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1551744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1693301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1730125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1745051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1853746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1892953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1894911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1932176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1961679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1980290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1995638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2013401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2015352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2040513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2077853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2150801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2214224; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2217352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2260908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2315057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2341477; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2371248; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2412900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2548045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2570500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2616849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2655946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2670545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2827876; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2866232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2871077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2898126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2940451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3002204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3215128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3447430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3565125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3648651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3666686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3745262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3817798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3827192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3903001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3903380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4009380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4089406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4105199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4131476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4167269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4173462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4214487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4297834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4304209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4346305; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4385300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4402513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4478203; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4859409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4875363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4926361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5030299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5032807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5117103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5196368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5385716; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5447274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5452651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5493528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5503929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5559234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5573171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5584047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5610200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5610264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5670785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5745319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5749214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5860592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5864600; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6015229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6038382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6042047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6060509; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6076087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6079363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6095132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6100365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6129020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6144254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6149267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 112601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 116400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 163981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 301906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 350135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 433713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 465312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 482550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 503445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 509399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 520476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 539020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 558721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 619320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 625297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 725116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 730708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 759809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 774464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 820828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 894904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 898621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 950620; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 978519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1056752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1105115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1112512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1127726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1222968; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1313762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1350950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1419671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1544970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1547244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1549703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1571181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1598421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1640840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1659085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1666679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1693866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1760540; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1763832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1768138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1812567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1824337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1907141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1910044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1911842; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1924026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1944535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1965761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2007560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2065344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2071700; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2094312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2211861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2333154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2346127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2410727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2464903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2468193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2477327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2493558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2620740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2623743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2678181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2758992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2807529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2834075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2916044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2937888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3005465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3116954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3233308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3235496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3240872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3243328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3313188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3395921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3403701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3440136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3460231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3497060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3518037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3527020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3563209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3575166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3660290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3709837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3815160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3854612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3950259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3973417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4080476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4096567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4109269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4141249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4142572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4198361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4214544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4278784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4386869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4395447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4467617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4488966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4491737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4600394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4791122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4841287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4892634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4950974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4964802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5093577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5135736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5193816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5315170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5382251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5416036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5496216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5564198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5576970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5592085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5617871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5632582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5635908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5638707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5642324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5844465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5950786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6082336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6150709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 82041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 98462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 339441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 341823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 344897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 393505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 470333; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 493501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 495137; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 543117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 596851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 683785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 694529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 760566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 813717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 825809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 859984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 866137; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 901661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 941671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 957015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1146913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1252153; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1254589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1422945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1476100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1533059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1585041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1606081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1618298; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1703305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1751401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1786458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1839905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1847702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1851699; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1854644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1864630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1944040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2037133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2078468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2084493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2138837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2146003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2203521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2205541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2229541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2242229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2295353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2357713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2360205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2363181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2446813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2668739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2706725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2763229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2766469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2771173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2837992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2840748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2896460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2906437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2955509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3070303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3154708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3263373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3432931; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3441733; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3502106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3527354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3570696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3616225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3647355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3730425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3741473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3746853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3784652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3789837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3803203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3811443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3880111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3929437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4020212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4054503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4065291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4067380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4082162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4139123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4330847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4350275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4441963; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4537507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4577016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4618054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4718409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4728996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4775961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4840994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4937237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4953984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5001770; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5029281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5203392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5255099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5310721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5333489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5362942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5365086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5370794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5386965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5417936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5423433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5427087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5447045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5451290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5458778; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5488496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5534166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5539447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5547440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5548501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5548801; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5550548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5577747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5599299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5603342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5613926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5619159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5622977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5698688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5706543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5747232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5756969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5770055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5782152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5787017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5805730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5807460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5809142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5834791; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5853743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5853851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5863216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5867409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5898043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5923021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5925432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5925559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5932657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5934583; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5938438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5950433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5950822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5954028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5954392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5968017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5981648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5985039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5990682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5996142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5997526; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6008482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6016442; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6022615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6024243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6031586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6056434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6059435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6071375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6083697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6085890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6099555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6107943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6112991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6121043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6121707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6131698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6173378; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6176622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6180289; code bytes = 80302e:T12ce,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000095e10477f9070a00feffffff9cf72a00bd6b2075020000008228087718f82a00f7992075340000c02bfa0000f4e955015be455011800000000000000f0f72a004000000000000000dcf72a00000000000000000000000000000000000c0000000200000001012a00c2ebb6760000000000003f0060874300dd4f22642bfa000038001e002b000000903b4300000000000000000088864300010000005887430038f82a0000290877ffffffff6cf82a00000000009479bd7614a010ef50f82a00316c0000c1f7c893c1f70000a289bd7600000000a1dfb67614a010ef (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000e06d110000005008330000003300e809330095e1047719070a00feffffff000000002200000088ef2a0011000000000033005008330088ef2a00145c0877435c087701f02877020000000c02330000003300500133000002000000000000500133002cf12a00a4010a77e4ee2a002200000000f80877500133001413e06d6025330000000000330000003ff00000110000000000000000000000e81e3f0020ef2a000000000033000033c4003300450000457665437269746963000000007f0000006e000069510100502812330001000000000000000200000008000000 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000180000000000000030f12a0000000000bcf82a0092e03569f890460dfeffffffe8f72a004c9c35690d0c000008f82a005f9c3569000000000000000000000000000000000000000000000000f0935a643cf82a00ee2d34690d0c000008f82a005177560151775601fe2d346970f82a0001000000000000000000e06d000000009c53077776182075000000009f182075134f2264e9785701000000009479bd7614a010ef50f82a00316c0000c1f7c893e9785701400000006d553e013a553e01338c5701 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000088f12a000000000094f82a0092e03569ac9effffd88affff14a010ef28f82a0075d63d01b059bd76ac9effffd88affff14a010ef40f82a0080705e01 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000248394600817100f00000000000000000000000008000000000000000817100f0e09346000100000000000000020000000c000000883746008837460083374600000000000000000000003f0000000001b0ef2a0000000000d0f52a0095e10477a10d0a00feffffff435c08775059087794000000a000000082374600803746009400000054f12a00fdfeb67634ea2a0001000000d0f52a0092e03569f890460dfeffffffecf02a004c9c35695c0c000000f12a005f9c35690000000000000000 (UID: 00000000-00005848)2f:Tb20,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300082b46000f00010e4ef9000e63006f006e00660069006700750072006100740069006f006e00000055004200570053005c0041000b00000b34f900004839460090d243006f00630061006c005c00500072006f0067007200 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebcc76503b4a0000a0fd7f9a5c097700e0f97fe0c2e30644a0fd7f00000000400000003f0000002100000000a0fd7fd4c2e306c15c0977608210772100000000a0fd7f9a5c097700e0f97ff8c2e306578908778083107713172175d8ebcc76 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "Set-up.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003732) "Set-up.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c479f73284b47008c479f7300000000284b470030772200086d087718811077000000005098220000000000000000007077220095e104772d940b00feffffff6b2c09773119217502100000000000000000010044772200c89f08778c479f730000000000000000 (UID: 00000000-00003732) "Set-up.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003732)30:Tabd,"Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "Set-up.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "")31:T8ff,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LUMMAC2.EXE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LUMMAC2.EXE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SET-UP.EXE") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SET-UP.EXE") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ONEDRIVESETUP.EXE") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ONEDRIVESETUP.EXE"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1BB10B8C-6E63-4897-9FB2-3873CE30D7E1}") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1BB10B8C-6E63-4897-9FB2-3873CE30D7E1}"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{85379532-0003-4517-8FC4-6227B410C30C}") "Set-up.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{85379532-0003-4517-8FC4-6227B410C30C}"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "Set-up.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX")32:T2cb5,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter shlwapi (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter CLBCatQ.DLL (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\propsys.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter apphelp.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\urlmon.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005848) "LummaC2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004116) "LummaC2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004116) "Set-up.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003732) "Set-up.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003732)33:T94fd,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PathAddExtensionA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PathCombineA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter StrChrA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter StrToIntA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RtlFreeHeap (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleHandleExA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CopyFileExA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OpenFileMappingW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter MapViewOfFileEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter InitPropVariantFromStringAsVector (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PSCoerceToCanonicalValue (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PropVariantToStringAlloc (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter SaferGetPolicyInformation (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005848) "LummaC2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004116) "LummaC2.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004116) "Set-up.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter if_nametoindex (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00003732) "Set-up.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003732)34:T6fb0,Found reference to API (Indicator: "lstrcpy"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SelectObject"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateCompatibleDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "DeleteDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetDIBits"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "BitBlt"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "StretchBlt"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetCurrentObject"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetObjectW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "DeleteObject"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "ExitProcess"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetCurrentProcessId"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetCommandLineW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateProcessW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GlobalLock"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GlobalUnlock"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetLogicalDrives"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SysAllocString"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SysFreeString"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "VariantClear"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "VariantInit"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SHGetFileInfoW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "ReleaseDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetClipboardData"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CloseClipboard"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "OpenClipboard"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSystemMetrics"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetForegroundWindow"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CoCreateInstance"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CoInitializeEx"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CoUninitialize"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CoInitializeSecurity"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RegCloseKey"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetLengthSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "MakeAbsoluteSD"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InitializeAcl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InitializeSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSidLengthRequired"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "IsValidSecurityDescriptor"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CopySid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSidSubAuthority"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RegQueryValueExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSecurityDescriptorControl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "AddAce"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetAclInformation"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "IsValidSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RegOpenKeyExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "HeapFree"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "OutputDebugStringA"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "Sleep"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetLocaleInfoW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InitializeCriticalSection"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "MapViewOfFile"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "FindResourceExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "HeapReAlloc"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetProcessHeap"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InterlockedIncrement"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetLastError"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetFullPathNameW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetTickCount"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LocalFree"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetEvent"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "WaitForSingleObject"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "OutputDebugStringW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateFileW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetModuleHandleExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetModuleFileNameW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetVersionExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InterlockedDecrement"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "TerminateProcess"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetModuleHandleW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "EnterCriticalSection"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SearchPathW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LeaveCriticalSection"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "HeapSize"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LoadLibraryExW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetThreadUILanguage"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "UnmapViewOfFile"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetFileAttributesW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "HeapAlloc"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CloseHandle"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "FormatMessageW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateFileMappingW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetCurrentProcess"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "lstrlenW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetModuleHandleA"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetLastError"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LoadLibraryW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetVersionExA"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LoadResource"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "HeapDestroy"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RaiseException"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateEventW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "FreeLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetStartupInfoA"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "OpenEventW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "InterlockedExchange"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CreateThread"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "GetProcAddress"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SysAllocStringLen"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "SysStringLen"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CommandLineToArgvW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LoadStringW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "TranslateMessage"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "DispatchMessageW"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "UnregisterClassA"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RtlFreeHeap"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RtlAllocateHeap"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "RtlUnwind"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CoTaskMemFree"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "CLSIDFromString"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExA"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")35:T534,"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000001.80422.00910000.00000002.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000001.80422.00910000.00000002.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp36:T7eb,"SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SYSTEM\ControlSet001\Services\VBoxSF" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "Software\Policies\Microsoft\Windows NT\DNSClient" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp 00000000-00005848.00000002.82275.003F0000.00000004.mdmp37:T6a4,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Set-up.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135]38:T492,Pattern match: "ftp@example.com" Pattern match: "auth-agent-req@openssh.com" Pattern match: "direct-streamlocal@openssh.com" Pattern match: "sk-ecdsa-sha2-nistp256@openssh.com" Pattern match: "sk-ssh-ed25519@openssh.com" Pattern match: "ecdsa-sha2-nistp256-cert-v01@openssh.com" Pattern match: "ecdsa-sha2-nistp384-cert-v01@openssh.com" Pattern match: "ecdsa-sha2-nistp521-cert-v01@openssh.com" Pattern match: "ssh-ed25519-cert-v01@openssh.com" Pattern match: "ssh-rsa-cert-v01@openssh.com" Pattern match: "curve25519-sha256@libssh.org" Pattern match: "aes256-gcm@openssh.com" Pattern match: "aes128-gcm@openssh.com" Pattern match: "hmac-sha2-256-etm@openssh.com" Pattern match: "hmac-sha2-512-etm@openssh.com" Pattern match: "hmac-sha1-etm@openssh.com" Pattern match: "hmac-ripemd160@openssh.com" Pattern match: "gent@openssh.comauth" Pattern match: "auth-agent@openssh.com" Pattern match: "fsync@openssh.com" Pattern match: "efstatvfs@openssh.com" Pattern match: "estatvfs@openssh.com" Pattern match: "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" Pattern match: "sk-ssh-ed25519-cert-v01@openssh.com" Pattern match: "rijndael-cbc@lysator.liu.se"39:Ta07,"SYSTEM\ControlSet001\Services\VBoxSF" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "Software\Policies\Microsoft\Windows NT\DNSClient" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces" in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005848.00000001.80422.003F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005848.00000002.82275.003F0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006504.00000000.82155.00181000.00000020.mdmp3a:T20fd,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "ADVAPI32.DLL" at base 76ce0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "NTDLL.DLL" at base 77030000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "WINMM.DLL" at base 6de00000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "NTDLL" at base 77030000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "SHELL32.DLL" at base 75ed0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "OLE32.DLL" at base 75b80000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "KERNEL32.DLL" at base 76b20000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "SHLWAPI" at base 76d90000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "MSCOREE.DLL" at base 6b690000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 709a0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "KERNEL32" at base 76b20000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b600000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "SHLWAPI.DLL" at base 76d90000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "VERSION.DLL" at base 743d0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 63fd0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "USER32.DLL" at base 771b0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "PSAPI.DLL" at base 77190000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "RPCRT4.DLL" at base 75ad0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6b690000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62bc0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "CRYPTBASE.DLL" at base 74e30000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6b430000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68d60000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62160000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61940000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c40000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "PROPSYS.DLL" at base 73a20000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "COMCTL32.DLL" at base 73e00000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "OLEAUT32.DLL" at base 75990000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "CLBCATQ.DLL" at base 76c00000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a20000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "NTMARTA.DLL" at base 743a0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75340000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "PROFAPI.DLL" at base 74f40000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "APPHELP.DLL" at base 74de0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e6b0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ed0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74f70000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75d80000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b20000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "SETUPAPI.DLL" at base 75540000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "SECUR32.DLL" at base 74c70000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75110000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 713b0000 "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74de0000 "LummaC2.exe" loaded module "OLE32.DLL" at base 75b80000 "LummaC2.exe" loaded module "ADVAPI32.DLL" at base 76ce0000 "LummaC2.exe" loaded module "KERNEL32.DLL" at base 76b20000 "LummaC2.exe" loaded module "WS2_32.DLL" at base 75d10000 "LummaC2.exe" loaded module "WINHTTP.DLL" at base 703c0000 "LummaC2.exe" loaded module "SHLWAPI.DLL" at base 76d90000 "LummaC2.exe" loaded module "SSPICLI.DLL" at base 74dc0000 "LummaC2.exe" loaded module "CRYPTSP.DLL" at base 74940000 "LummaC2.exe" loaded module "RPCRT4.DLL" at base 75ad0000 "LummaC2.exe" loaded module "CREDSSP.DLL" at base 74600000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74900000 "LummaC2.exe" loaded module "WSHTCPIP" at base 74460000 "LummaC2.exe" loaded module "WSHIP6.DLL" at base 748f0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71520000 "LummaC2.exe" loaded module "DNSAPI.DLL" at base 747c0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74460000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 748f0000 "LummaC2.exe" loaded module "IPHLPAPI.DLL" at base 73290000 "LummaC2.exe" loaded module "RASADHLP.DLL" at base 716c0000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73200000 "LummaC2.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74740000 "LummaC2.exe" loaded module "CRYPT32.DLL" at base 74fe0000 "Set-up.exe" loaded module "IPHLPAPI.DLL" at base 73290000 "Set-up.exe" loaded module "DHCPCSVC6.DLL" at base 731a0000 "Set-up.exe" loaded module "RPCRT4.DLL" at base 75ad0000 "Set-up.exe" loaded module "DHCPCSVC.DLL" at base 73120000 "Set-up.exe" loaded module "CRYPTBASE.DLL" at base 74e30000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74900000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 748f0000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74460000 "Set-up.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c40000 "Set-up.exe" loaded module "OLE32.DLL" at base 75b80000 "Set-up.exe" loaded module "ADVAPI32.DLL" at base 76ce0000 "Set-up.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73880000 "Set-up.exe" loaded module "GDIPLUS.DLL" at base 73880000 "Set-up.exe" loaded module "WINDOWSCODECS.DLL" at base 732e0000 "Set-up.exe" loaded module "OLEAUT32.DLL" at base 759900003b:T4c7,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS")3c:T953,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69" file has an entrypoint instructions - "jmp 0xf2e00a,punpckhdq mm3, qword ptr [esi],add byte ptr [eax], al,add byte ptr [eax], al,jmp 0xf3000f,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "LummaC2.exe" file has an entrypoint instructions - "push ebp,push ebx,push edi,push esi,sub esp, 0x224,call 0x43b340,test al, al,je 0x408a15,call 0x433fb0,test al, al,je 0x4089fe,call dword ptr [0x441d18],mov dword ptr [esp + 0xc], eax,call dword ptr [0x441d1c],mov ecx, eax,mov eax, 0xc279f17e,mov edx, 0x69c55686,shrd edx, eax, cl,shr eax, cl,test cl, 0x20,je 0x40876e,mov edx, eax,xor eax, eax,mov ecx, edx,not ecx,mov ebp, eax,not ebp,mov edi, ecx,or edi, 0x963aa979,mov esi, ebp," "DISMHOST.EXE.6A970CF2.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"3d:T442,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "LummaC2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "LummaC2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Set-up.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Set-up.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3e:Tb23,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005848-00000C2B-242838527] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005848-00000C2B-243458638] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005848-00000C2B-245071072] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005848-00000C2B-245275999] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005848-00000C2B-245610014] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005848-00000C2B-245751811] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005848-00000C2B-246198637] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005848-00000C2B-246627749] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005848-00000C2B-246754765] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005848-00000C2B-247271255] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005848-00000C2B-247357500] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005848-00000C2B-247445877] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005848-00000C2B-247563288] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005848-00000C2B-247967177] Observed system executable string:"%WINDIR%\system32\propsys.dll" [Source: 00000000-00005848-00000C2B-249248637] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00005848-00000C2B-250328172] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00005848-00000C2B-250437805] Observed system executable string:"%WINDIR%\system32\urlmon.dll" [Source: 00000000-00005848-00000C2B-251143837] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003732-00000C2B-261224157] Observed system executable string:"%WINDIR%\System32\VBox*.dll" [Source: 00000000-00003732-00000C2D-2933680066]3f:T503,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "OLLYDBG" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "GBDYLLO" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "pediy06" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "FilemonClass" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "PROCMON_WINDOW_CLASS" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "RegmonClass" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "18467-41" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" searching for class "Regmonclass"40:T480,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "after MemoryLoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")41:T84d,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "")42:T796,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")43:T5a9,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\system32\ntdll.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\users\%osuser%\appdata\local\temp\lummac2.exe" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "c:\users\%osuser%\appdata\local\temp\set-up.exe" "LummaC2.exe" reads file "c:\users\%osuser%\appdata\local\temp\lummac2.exe" "Set-up.exe" reads file "c:\windows\system32\drivers\etc\hosts"44:Tcfe,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\FLTLIB.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\MSVCP140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\VCRUNTIME140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\ucrtbase.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to touch file "C:\api-ms-win-crt-heap-l1-1-0.dll"45:Tcf7,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\MSVCP140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\ucrtbase.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"46:Tbd5,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\system32\mscoree.dll.local" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe.config" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\ladddad\" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.INI" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe.Local\" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LummaC2.exe:Zone.Identifier" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe:Zone.Identifier" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039E6FB048B2A7511B7095958332A7300CC42E66142B4C815F18CD02B6F1B69.EXE.CONFIG" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\LADDDAD" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039E6FB048B2A7511B7095958332A7300CC42E66142B4C815F18CD02B6F1B69.INI" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\7039E6FB048B2A7511B7095958332A7300CC42E66142B4C815F18CD02B6F1B69.EXE.LOCAL" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LummaC2.exe:ZONE.IDENTIFIER" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe:ZONE.IDENTIFIER" "Set-up.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Set-up.exe.Local\"47:T787,"LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "437820" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "43e8d0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "43e8c8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "439838" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4488a8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "43e980" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "LummaC2.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4488a8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}48:Te2a,Observed string: "SCP requires a known file size for upload" (Indicator: "scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Failed to free libssh2 scp subsystem: %d %s" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to allocate a command buffer for SCP session" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "scp -%sf" (Indicator: "scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block requesting SCP startup" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block waiting for SCP response" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Failed reading SCP response" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid data in SCP response" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unterminated response from SCP server" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, too short" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mtime" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mtime.usec" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, too short or malformed" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block waiting to send SCP ACK" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, malformed mode" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, invalid mode" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid response from SCP server, invalid size" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block sending SCP ACK" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "scp -%st" (Indicator: "scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SCP failure" (Indicator: "scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block sending time data for SCP file" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to send time data for SCP file" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid SCP ACK response" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block send core file data for SCP file" (Indicator: " scp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp49:Tf47,Found reference to API "WARNING: no socket in pollset, transfer may stall!" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Could not connect to server" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "SSL connect error" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Invalid socket argument" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Unix socket path too long: '%s'" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Timeout waiting for socket becoming writable" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Error while waiting for socket becoming writable" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "SSH CONNECT phase done" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Couldn't bind to interface '%s' with errno %d: %s" (Indicator: " bind "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Couldn't bind to '%s' with errno %d: %s" (Indicator: " bind "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "%s socket %d connected: [%s:%d] -> [%s:%d]" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "%s connect -> %d, connected=%d" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Failed to connect to %s port %u after %lld ms: %s" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "%s connect timeout after %lldms, move on!" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "query connect reply: %dms" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "[%s] protocol connect phase DONE" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "[%s] ftp_state_use_port(), socket bound to port %d" (Indicator: " socket "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Error %d sending MQTT CONNECT request" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "SOCKS5 connect to %s:%d (locally resolved)" (Indicator: " connect "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")4a:T1e24,Found URL "http://crl.rootca1.amazontrust.com/rootca1.crlamazon1amazon" - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://o1.amazontrust.com0:.http://crt.roottrust.com/rootca1.cerizona1scottsdale1%0" - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://ocsp.rootca1.amazontrust.com0:.http://crt.rootca1.amazontrust.com/rootca1.cer0?80604.http://crl.rootca1.amazontrust.com/rootca1.crl00j0." - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cermicrosoft" - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://ocsp.rootg2.amazontrust.com08,http://crt.rootg2.amazontrust.com/rootg2.cer0=60402,http://crl.rootg2.amazontrust.com/rootg2.crl0argon2iargon2dargon2dcmacgmacgmachmackmac128kmac256siphashnamenamenamenamenamenamenamenamenamenamenamenamenamenamenamenamenamenamename1.2.840.113549.1.5.12microsoft" - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://ocsp.rootca1.amaom0:.http://crt.rootca1.amazontrusta1.cer0?80604.http://crl.rootca1.amcom/rootca1.crl0jz6$_d-$u\0.o8lt0%gk$o6goj_%p>]4" - Source: "00000000-00003732.00000000.80180.0047A000.00000004.mdmp") Found URL "http://home.fortth14ht.top/ntrmovgoaovbjpksulkp13failed" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://localhost:%d/jsonget" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://httpbin.org/ipbefore" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found URL "http://]4" - Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900r.lajjjphtepscheendp" - Source: "00000000-00004116.00000001.81687.00435000.00000004.mdmp")4b:T442,Found string "Downgrades to HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "installing subfilter for HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "%s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "CONNECT %s:%s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")4c:T517,Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "CLIENT libcurl 8.10.1" (Indicator: "libcurl"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")4d:T7c0,Found string "SSL peer certificate or SSH remote key was not OK" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Error in the SSH layer" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Failure establishing ssh session: %d, %s" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Using SSH public key file '%s'" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Using SSH private key file '%s'" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Initialized SSH public key authentication" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Set "%s" as SSH hostkey type" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Denied establishing ssh session: sha256 fingerprint not available" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Denied establishing ssh session: mismatch sha256 fingerprint. Remote %s is not equal to %s" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Denied establishing ssh session: mismatch md5 fingerprint. Remote %s is not equal to %s" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Denied establishing ssh session: md5 fingerprint not available" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Failure initialising ssh session" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Failed to enable compression for ssh session" (Indicator: " ssh "; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")4e:Tda9,Observed string: "SFTP" (Indicator: "sftp") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Failure initializing sftp session: %s" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unknown SFTP command" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Attempt to get SFTP stats failed: %s" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Attempt to set SFTP stats failed: %s" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Failed to stop libssh2 sftp subsystem" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Bad message from SFTP server" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Not connected to SFTP server" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Connection to SFTP server lost" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Operation not supported by SFTP server" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "sftp" (Indicator: "sftp") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Would block to request SFTP subsystem" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to request SFTP subsystem" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to allocate a new SFTP structure" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Timeout waiting for response from SFTP subsystem" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SFTP packet too large" (Indicator: "sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Invalid SFTP packet size" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to allocate SFTP packet" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Error waiting for SFTP packet" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to allocate datablock for SFTP packet" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Unable to allocate new SFTP handle structure" (Indicator: " sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SFTP READ error" (Indicator: "sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SFTP Protocol badness" (Indicator: "sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SFTP Protocol badness: unrecognised read request response" (Indicator: "sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "SFTP Protocol Error" (Indicator: "sftp ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp4f:T67a,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetDC" (Indicator: "GetDC"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp")50:Teac,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005848)51:T1d9e,Found string "AES-128-CFB" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-192-CFB" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-128-CBC" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-256-CBC" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-256-XTS" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-wrap" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-wrap" (Indicator: "aes192"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-256-ECB" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes128-GCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes128-GCM" (Indicator: "aes128"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-128-gcm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-256-CFB" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-GCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-GCM" (Indicator: "aes256"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-256-gcm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-192-OFB" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "CAST5-CBC" (Indicator: "cast5"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes128-CCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes128-CCM" (Indicator: "aes128"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-128-ccm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-CCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-CCM" (Indicator: "aes256"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-256-ccm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-wrap" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes256-wrap" (Indicator: "aes256"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-GCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-GCM" (Indicator: "aes192"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-192-gcm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-192-CBC" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-CCM" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "id-aes192-CCM" (Indicator: "aes192"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "aes-192-ccm" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "AES-128-XTS" (Indicator: "aes"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000000.80180.0173B000.00000002.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp")52:T918,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "880736,1952,3121,,CreateToolhelp32Snapshot,kernel32.dll,"252:06:21.680",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot failed." (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")53:T5f0,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")54:Tdd7,Found string "password len %d and %d" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Combined password: '%s'" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "No password part in the URL" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Bad password" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Initialized password authentication" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Excessive password length for proxy auth" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "failed setting SRP password" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "could not parse PKCS12 file, check password, OpenSSL error %s" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to create curve25519 shared secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to create ECDH shared secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Private key unpack failed (correct password?)" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to allocate memory for userauth-password request" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Would block writing password request" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to send userauth-password request" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Waiting for password response" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Authentication failed (username/password)" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to allocate memory for userauth password change request" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Unable to send userauth password-change request" (Indicator: "password"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "tls13_generate_secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "derive_secret_key_and_iv" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "srp_generate_server_master_secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "srp_generate_client_master_secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "ossl_qrl_enc_level_set_provide_secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "ssl3_generate_master_secret" (Indicator: "secret"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp")55:T74e,"FTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4503575" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.003D0000.00000004.mdmp "WARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.003D0000.00000004.mdmp "FTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.003D0000.00000004.mdmp "WARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7D9BDE7-2C35-4F7E-AEBE-9F3028451087}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.003D0000.00000004.mdmp "WARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.003D0000.00000004.mdmp "IWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.0047A000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.0047A000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp56:Tde1,Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Could not resolve hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Bad hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Too long hostname (maximum is %d)" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "WS: auto-respond to PING with a PONG" (Indicator: "ping"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Hostname in DNS cache does not have needed family, zapped" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "aws-sigv4: service too long in hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "aws-sigv4: region too long in hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Hostname '%s' was found" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SOCKS4: too long hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "user + domain + hostname too big" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "SSL: certificate subject name '%s' does not match target hostname '%s'" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "no hostname or service specified" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "hostname mismatch" (Indicator: "hostname"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "Attempt 1 failed: Could not resolve hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "Attempt 2 failed: Could not resolve hostname" (Indicator: "hostname"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp")57:Tcf9,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\Set-up.exe" (Indicator: "\Device\"; Source: "00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "\Device\Afd" (Indicator: "\Device\"; Source: "00000000-00003732.00000000.80180.0173B000.00000002.mdmp") Found string "??\C:\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "??\C:\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "indows\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "indows\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string ":\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string ":\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "\Device\{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "ystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "ystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00003732.00000001.81546.003D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005848.00000001.80422.003F0000.00000004.mdmp")58:Tc2e,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "CopySid" (Indicator: "CopySid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "AddAce" (Indicator: "AddAce"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69")59:T5c7,Observed string: "shutdown and remove SSL, start" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown and remove SSL, done -> %d" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "Shutdown" (Indicator: "shutdown") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown ongoing" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown finished" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown not received, but closed" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown sent, want receive" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown send blocked" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp Observed string: "shutdown while in init" (Indicator: "shutdown ") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp5a:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A970CF2.bin]5b:T9eb,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "LummaC2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "")5c:T457,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"5d:T609,"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00005848) "7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe" called "Process32NextW with parameter System" (UID: 00000000-00005848) "Set-up.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter System" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00003732) "Set-up.exe" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00003732)5e:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791839579099,"unified_at":"2026-10-12T21:12:59.099Z","metadata":{"hashes":{"sha256":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","sha1":"19cfa391040bae58c5d623f5515e1505996fe646","md5":"5b8011576b37d84db9122786cded9f55","sha512":"5eb25ca3129aa9ec0352864d8717355230bc9bbcb0a0c271197c2a4f6c72ef16c092772317440461e1d24d77fe3cafd5d1ab191d9e65690b18f8240fbd279021","ssdeep":"98304:hOz2MJHt7ylFablAuWSvn0n/5b0GC08A6PlATT9si+oc2pWwehjcuv03usdbQgST:SbxN+Qvn0nBb0N0pg2NZowcckAuKkVwL","ssdeep_chunks":["98304:hOz2MJH","98304:Oz2MJHt","98304:z2MJHt7","98304:2MJHt7y","98304:MJHt7yl","98304:JHt7ylF","98304:Ht7ylFa","98304:t7ylFab","98304:7ylFabl","98304:ylFablA","98304:lFablAu","98304:FablAuW","98304:ablAuWS","98304:blAuWSv","98304:lAuWSvn","98304:AuWSvn0","98304:uWSvn0n","98304:WSvn0n/","98304:Svn0n/5","98304:vn0n/5b","98304:n0n/5b0","98304:0n/5b0G","98304:n/5b0GC","98304:/5b0GC0","98304:5b0GC08","98304:b0GC08A","98304:0GC08A6","98304:GC08A6P","98304:C08A6Pl","98304:08A6PlA","98304:8A6PlAT","98304:A6PlATT","98304:6PlATT9","98304:PlATT9s","98304:lATT9si","98304:ATT9si+","98304:TT9si+o","98304:T9si+oc","98304:9si+oc2","98304:si+oc2p","98304:i+oc2pW","98304:+oc2pWw","98304:oc2pWwe","98304:c2pWweh","98304:2pWwehj","98304:pWwehjc","98304:Wwehjcu","98304:wehjcuv","98304:ehjcuv0","98304:hjcuv03","98304:jcuv03u","98304:cuv03us","98304:uv03usd","98304:v03usdb","98304:03usdbQ","98304:3usdbQg","98304:usdbQgS","98304:sdbQgST","196608:hOz2MJH","196608:Oz2MJHt","196608:z2MJHt7","196608:2MJHt7y","196608:MJHt7yl","196608:JHt7ylF","196608:Ht7ylFa","196608:t7ylFab","196608:7ylFabl","196608:ylFablA","196608:lFablAu","196608:FablAuW","196608:ablAuWS","196608:blAuWSv","196608:lAuWSvn","196608:AuWSvn0","196608:uWSvn0n","196608:WSvn0n/","196608:Svn0n/5","196608:vn0n/5b","196608:n0n/5b0","196608:0n/5b0G","196608:n/5b0GC","196608:/5b0GC0","196608:5b0GC08","196608:b0GC08A","196608:0GC08A6","196608:GC08A6P","196608:C08A6Pl","196608:08A6PlA","196608:8A6PlAT","196608:A6PlATT","196608:6PlATT9","196608:PlATT9s","196608:lATT9si","196608:ATT9si+","196608:TT9si+o","196608:T9si+oc","196608:9si+oc2","196608:si+oc2p","196608:i+oc2pW","196608:+oc2pWw","196608:oc2pWwe","196608:c2pWweh","196608:2pWwehj","196608:pWwehjc","196608:Wwehjcu","196608:wehjcuv","196608:ehjcuv0","196608:hjcuv03","196608:jcuv03u","196608:cuv03us","196608:uv03usd","196608:v03usdb","196608:03usdbQ","196608:3usdbQg","196608:usdbQgS","196608:sdbQgST","98304:SbxN+Qv","98304:bxN+Qvn","98304:xN+Qvn0","98304:N+Qvn0n","98304:+Qvn0nB","98304:Qvn0nBb","98304:vn0nBb0","98304:n0nBb0N","98304:0nBb0N0","98304:nBb0N0p","98304:Bb0N0pg","98304:b0N0pg2","98304:0N0pg2N","98304:N0pg2NZ","98304:0pg2NZo","98304:pg2NZow","98304:g2NZowc","98304:2NZowcc","98304:NZowcck","98304:ZowcckA","98304:owcckAu","98304:wcckAuK","98304:cckAuKk","98304:ckAuKkV","98304:kAuKkVw","98304:AuKkVwL"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"5b8011576b37d84db9122786cded9f55.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6196224,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1735308029000,"last_seen":1788273994000,"last_multi_scan":1788273994000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":188,"suspicious_count":15,"malicious_count":6,"total":209},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.RisePro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.571947","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.571947 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Agent.g!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdebc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.FWDO-6725","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XKO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.ShortLoader.Win32.22","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual environment using sandbox registry"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Able to detect virtual machine (string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to transfer files using SCP"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform CAST-128/CAST-256 encryption"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"?v6%.mq\", Heuristic match: \"6c.pe\", Heuristic match: \"~d.mw\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2.\" (Indicator: \"RC2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$27","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" queried SystemProcessInformation at 00000000-00005848-00000105-14061947 [PID: 5848]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00003732-00000105-1800191 [PID: 3732]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00003732-00000105-1800649 [PID: 3732]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00003732-00000105-1802465 [PID: 3732]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00003732-00000105-1843350 [PID: 3732]\n \"Set-up.exe\" queried SystemProcessInformation at 00000000-00003732-00000105-1857038 [PID: 3732]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"?error CryptAcquireContextA 0x%08lx\" (Indicator: \"CryptAcquireContextA\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found api reference \"error CryptGenRandom 0x%08lx\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CAST-128/CAST-256 encryption","description":"Found string \"cast128-cbc\" (Indicator: \"CAST128\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":1,"id":"string-599","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.0041B000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98436","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains ability to perform CAST-128/CAST-256 encryption\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"%WINDIR%\\System32\\VBox*.dll\" (Source: \"00000000-00003732-00000C2D-2933680066\")\n Found string \"\\Windows\\System32\\VBox*.dll\" (Source: \"00000000-00003732.00000000.80180.003D0000.00000004.mdmp\")\n Found string \"??\\C:\\Windows\\System32\\VBox<.dll\" (Source: \"00000000-00003732.00000000.80180.003D0000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBox*.dll\" (Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005848-00000C2C-241774655\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005848-00000C2C-241774655\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"LummaC2.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6A970CF2.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"system\\controlset001\\services\\vboxsf\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"YSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00003732.00000000.80180.0047A000.00000004.mdmp\")\n Found string \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005848-00000C2C-245273773\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005848-00000C2C-245274639\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005848-00000C2C-251010995\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004116-00000C2C-278454597\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005848)\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005848)\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005848)\n \"LummaC2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004116)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"IsWow64Process\" with parameter \"5848\" - (UID: 00000000-00005848)\n \"Set-up.exe\" called \"IsWow64Process\" with parameter \"3732\" - (UID: 00000000-00003732)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Set-up.exe\" called \"EnumWindows\" with parameter \"2286240\" - (UID: 00000000-00003732)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GetWindowTextA\" (UID: 00000000-00005848)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Warning\" - (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"CiceroUIWndFrame\" - (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Start\" - (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Network Flyout\" - (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Task Switching\" - (UID: 00000000-00003732)\n \"Set-up.exe\" called \"GetWindowTextA\" with parameter \"Start menu\" - (UID: 00000000-00003732)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005848)\n \"Set-up.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003732)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"LummaC2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-978568\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-23618822\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-23897703\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-24238842\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-24598147\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-25326446\n \"Set-up.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003732-0000010C-26029338","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"LummaC2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Set-up.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Set-up.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$31","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"LummaC2.exe\")\n file/memory contains long string(File: \"DISMHOST.EXE.6A970CF2.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\LummaC2.exe\"\" - (UID: 00000000-00005848)\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Set-up.exe\"\" - (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.0.42.46:443\"\n \"23.60.175.16:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")\n Found reference to API \"4277062,2456,3143,,CreateProcessW,kernel32.dll,\"252:33:40.059\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005848-00000574-14071053\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005848-00000574-14071212\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005848-00000574-14076187\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$35","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n Process 7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process Set-up.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\My_mutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A970CF2.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"LummaC2.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6A970CF2.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\openssh-ssh-agent","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"k.pst\" (Indicator: \".pst\") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76C90000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62BC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Set-up.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74A50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63820000\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63FD0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75AD0000\n \"LummaC2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75AD0000\n \"Set-up.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75AD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020733669@ADVAPI32.dll\"\n \"0e000f00e4733669@ADVAPI32.dll\"\n \"0e000f0050743669@ADVAPI32.dll\"\n \"11001200d47d3669@ADVAPI32.dll\"\n \"110012007c7e3669@ADVAPI32.dll\"\n \"12001300cc7e3669@ADVAPI32.dll\"\n \"12001300387f3669@ADVAPI32.dll\"\n \"14001500e4b73669@ADVAPI32.dll\"\n \"1400150000b83669@ADVAPI32.dll\"\n \"140015001cb83669@ADVAPI32.dll\"\n \"1700180038b83669@ADVAPI32.dll\"\n \"0d000e0054b83669@ADVAPI32.dll\"\n \"1100120064b83669@ADVAPI32.dll\"\n \"110012007cb83669@ADVAPI32.dll\"\n \"0f001000ecb93669@ADVAPI32.dll\"\n \"1400150038ba3669@ADVAPI32.dll\"\n \"1400150054ba3669@ADVAPI32.dll\"\n \"0c000d00a8ba3669@ADVAPI32.dll\"\n \"0c000d00b8ba3669@ADVAPI32.dll\"\n \"0e000f00c8ba3669@ADVAPI32.dll\"\n \"0e000f00dcba3669@ADVAPI32.dll\"\n \"0b000c00f0ba3669@ADVAPI32.dll\"\n \"180019008cbd3669@RPCRT4.dll\"\n \"13001400bcbd3669@RPCRT4.dll\"\n \"14001500d4bd3669@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6A970CF2.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an executable section named \"\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an executable section named \"muzridtf\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an executable section named \"yeswpvds\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an executable section named \".taggant\"\n \"LummaC2.exe\" has an executable section named \".text\"\n \"DISMHOST.EXE.6A970CF2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \"\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \".rsrc\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \".idata\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \"muzridtf\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \"yeswpvds\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an writable section named \".taggant\"\n \"LummaC2.exe\" has an writable section named \".data\"\n \"DISMHOST.EXE.6A970CF2.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x43d600\" greater than 0x100000\n Raw size of \"muzridtf\" is \"0x1a6800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x6d4000\" greater than 0x100000\n Virtual size of \"\" is \"0x2aa000\" greater than 0x100000\n Virtual size of \"muzridtf\" is \"0x1a8000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"LummaC2.exe\" (UID: 00000000-00004116) was launched with new environment variables: \"XBH_FNT=\"655360\", USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"LummaC2.exe\" (UID: 00000000-00004116) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"censeractersj.click\"\n \"home.fortth14ht.top\"\n \"httpbin.org\"\n \"steamcommunity.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp, 00000000-00005848.00000002.82275.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$3f","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"LummaC2.exe\" (UID: 00000000-00004116)\n Spawned process \"Set-up.exe\" (UID: 00000000-00003732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"LummaC2.exe\" (UID: 00000000-00004116)\n Spawned process \"Set-up.exe\" (UID: 00000000-00003732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Amazon RSA 2048 M01, O=Amazon, C=US\" (SHA1: BE:92:90:DB:BE:70:82:16:AE:8B:6B:F2:FB:27:0A:9E:28:30:85:04; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Amazon Root CA 1, O=Amazon, C=US\" (SHA1: 2A:D9:74:A7:75:F7:3C:BD:BB:D8:F5:AC:3A:49:25:5F:A8:FB:1F:8C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Starfield Services Root Certificate Authority - G2, O=\"Starfield Technologies\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"LummaC2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A970CF2.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LummaC2.exe\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Set-up.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" connecting to \"\\ThemeApiPort\"\n \"Set-up.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00005848]\n \"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: N/A]\n \"DISMHOST.EXE.6A970CF2.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Able to identify virtual environment using sandbox registry\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\lummac2.exe\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\set-up.exe\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" writes file \"%temp%\\lummac2.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found string \"ping 0, Gen\" (Indicator: \"ping \"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$47","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004116-00000C2C-278868936\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004116-00000C2C-278869326\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp\n Observed string: \"curl user interface\" (Indicator: \"curl \") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp\n Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"$48","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"imap.c\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"pop3.c\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"smtp.c\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]\n Observed email domain:\"~mx.enscale\" [Source: 00000000-00003732.00000000.80180.0173B000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 0149f47eabf9a20d0893e2a44e5a6323\n Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"??\\C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00003732.00000001.81546.003D0000.00000004.mdmp\")\n Found string \":\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00003732.00000001.81546.003D0000.00000004.mdmp\")\n Found string \"\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00003732.00000001.81546.003D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"52.0.42.46\" on port \"443\"\n HTTPS traffic to \"23.60.175.16\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"LummaC2.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: LummaC2.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"sftp.c\" (Indicator: \"sftp.\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004116.00000001.81687.0041B000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004116.00000001.81687.0041B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"LummaC2.exe\")\n Found string \"GetClipboardData\" (File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\"\n Found registry query API: \"RegOpenKeyExW\" in file \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" tries to directly access volume data \"C:\"\n \"Set-up.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"LummaC2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Set-up.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"after MemoryGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005848.00000001.80422.003F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")\n Found reference to API \"calling getsockname()\" (Indicator: \"getsockname\"; Source: \"00000000-00003732.00000000.80180.0173B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$54","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"Set-up.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"file/memory contains long string(File: \"LummaC2.exe\")\n Found string \"SHEmptyRecycleBinW\" (File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$59","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004116.00000000.80116.003D0000.00000004.mdmp, 00000000-00004116.00000001.81687.00D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"LummaC2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$5a","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" opened \"\\Device\\KsecDD\"\n \"Set-up.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,services.exe,winlogon.exe,wininit.exe,csrss.exe\" (Source: \"00000000-00003732.00000000.80180.003D0000.00000004.mdmp, 00000000-00003732.00000001.81546.003D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00005848]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" was detected as \"Morphine v1.2 (DLL)\"\n \"DISMHOST.EXE.6A970CF2.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has section name with entropy \"7.9763842320678275\"\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has section name muzridtf with entropy \"7.9544310264435145\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"LummaC2.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\LummaC2.exe]- [targetUID: 00000000-00005848]\n \"DISMHOST.EXE.6A970CF2.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" wrote 37376 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LummaC2.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010400 ...\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" wrote 35464 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Set-up.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 52.0.42.46 on port 443 is sent without HTTP header\n TCP traffic to 23.60.175.16 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"a010885\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10010888\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Set-up.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"e7010d53\"\n \"cx\": \"1513\"\n \"cy\": \"1024\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"Set-up.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$5d","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" claimed CRC 6236373 while the actual is CRC 6200631","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineW\n GetSystemDirectoryW\n CreateProcessW\n GetLogicalDrives\n GetClipboardData\n RegCloseKey\n SetSecurityDescriptorDacl\n RegOpenKeyExW\n OutputDebugStringA\n Sleep\n UnhandledExceptionFilter\n MapViewOfFile\n FindResourceExW\n GetTickCount\n OutputDebugStringW\n CreateFileW\n GetModuleHandleExW\n GetModuleFileNameW\n GetVersionExW\n TerminateProcess\n GetModuleHandleW\n LoadLibraryExW\n GetFileAttributesW\n CreateFileMappingW\n GetModuleHandleA\n LoadLibraryW\n GetVersionExA\n GetStartupInfoA\n CreateThread\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"intel_graph":{"map":{"Domain:censeractersj.click":{"type":"Domain","value":"censeractersj.click"},"Domain:home.fortth14ht.top":{"type":"Domain","value":"home.fortth14ht.top"},"Domain:httpbin.org":{"type":"Domain","value":"httpbin.org"},"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69":{"type":"File","value":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69"},"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db":{"type":"File","value":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},"File:e0c4f2efef05e07bdc30f56cfe43708b1c98d7370f5c6610f0dcb3633a3884fc":{"type":"File","value":"e0c4f2efef05e07bdc30f56cfe43708b1c98d7370f5c6610f0dcb3633a3884fc"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Ip:23.60.175.16":{"type":"Ip","value":"23.60.175.16"},"Ip:52.0.42.46":{"type":"Ip","value":"52.0.42.46"}},"chains":[{"id":"sandbox_network","root":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","edges":[{"edge_kind":"contacted_ip","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Ip:52.0.42.46"},{"edge_kind":"contacted_ip","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Ip:23.60.175.16"},{"edge_kind":"contacted_domain","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Domain:censeractersj.click"},{"edge_kind":"contacted_domain","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Domain:home.fortth14ht.top"},{"edge_kind":"contacted_domain","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Domain:httpbin.org"},{"edge_kind":"resolves_to","from_key":"Domain:httpbin.org","to_key":"Ip:52.0.42.46"},{"edge_kind":"contacted_domain","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:23.60.175.16"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","edges":[{"edge_kind":"extracted","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"File:c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db"},{"edge_kind":"extracted","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","to_key":"File:e0c4f2efef05e07bdc30f56cfe43708b1c98d7370f5c6610f0dcb3633a3884fc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a96e5480a04d6c0070f04bc","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","analysis_start_time":"2026-09-01T14:46:35+00:00","indicators_count":{"informative":188,"suspicious":51,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.0.42.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"address":"23.60.175.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"dns_resolutions":[{"domain":"censeractersj.click","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"domain":"home.fortth14ht.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"domain":"httpbin.org","address":"52.0.42.46","ttl":1,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"domain":"steamcommunity.com","address":"23.60.175.16","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}],"processes":[{"pid":5848,"ppid":0,"name":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe","command_line":"","sha256":"7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69","normalized_path":"C:\\7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69.exe","uid":"00000000-00005848","icon":"$5e"},{"pid":4116,"ppid":5848,"name":"LummaC2.exe","command_line":"","sha256":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","normalized_path":"%TEMP%\\LummaC2.exe","parent_uid":"00000000-00005848","uid":"00000000-00004116"},{"pid":3732,"ppid":5848,"name":"Set-up.exe","command_line":"","sha256":"73aa5ee19f0ea048dcff2f44d6fd5ac41c13e2d7e61371459e756836f72cad43","normalized_path":"%TEMP%\\Set-up.exe","parent_uid":"00000000-00005848","uid":"00000000-00003732"}],"all_imported_dlls":["WSHTCPIP.DLL","IPHLPAPI.DLL","nsi.dll","ucrtbase_clr0400.dll","credssp.dll","bcrypt.dll","dhcpcsvc6.dll","gdi32.dll","oleaut32.dll","api-ms-win-crt-utility-l1-1-0.dll","version.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","advapi32.dll","ucrtbase.dll","shell32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","propsys.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","usp10.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-downlevel-user32-l1-1-0.dll","crypt32.dll","wshqos.dll","GdiPlus.dll","KernelBase.dll","imm32.dll","vcruntime140_clr0400.dll","winhttp.dll","WindowsCodecs.dll","ole32.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","psapi.dll","ntmarta.dll","apphelp.dll","setupapi.dll","msasn1.dll","api-ms-win-crt-time-l1-1-0.dll","msctf.dll","comctl32.dll","winnsi.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","winmm.dll","clr.dll","mswsock.dll","rasadhlp.dll","dhcpcsvc.dll","kernel32.dll","user32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.Core.ni.dll","mscorrc.dll","lpk.dll","vcruntime140.dll","api-ms-win-crt-string-l1-1-0.dll","uxtheme.dll","api-ms-win-downlevel-version-l1-1-0.dll","wininet.dll","api-ms-win-crt-private-l1-1-0.dll","ntdll.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","clbcatq.dll","Wldap32.dll","profapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","msvcrt.dll","api-ms-win-crt-runtime-l1-1-0.dll","mscorlib.ni.dll","cryptbase.dll","sspicli.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","webio.dll","cryptsp.dll","rpcrt4.dll","shlwapi.dll","ws2_32.dll","clrjit.dll","normaliz.dll","cfgmgr32.dll","devobj.dll","secur32.dll","api-ms-win-core-file-l1-2-0.dll","mscoreei.dll","shdocvw.dll","wship6.dll","dnsapi.dll","tzres.dll","fltLib.dll","sechost.dll","VxSSL32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","iertutil.dll","FWPUCLNT.DLL","schannel.dll","rsaenh.dll","msvcp140.dll","api-ms-win-core-localization-l1-2-0.dll","mscoree.dll","urlmon.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"LummaC2.exe","sha256":"c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"DISMHOST.EXE.6A970CF2.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"dism.log","sha256":"e0c4f2efef05e07bdc30f56cfe43708b1c98d7370f5c6610f0dcb3633a3884fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"files_written":[{"path":"%TEMP%\\LummaC2.exe","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"path":"%TEMP%\\Set-up.exe","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\My_mutex","sources":[{"report_type":"sandbox","report_id":"6a96e5480a04d6c0070f04bc"}]}]}},"report_ids":{"sandbox_job_ids":["6a96e5480a04d6c0070f04bc"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 7039e6fb048b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7039e6fb048b…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 7039e6fb048b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7039e6fb048b…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7039e6fb048b2a7511b7095958332a7300cc42e66142b4c815f18cd02b6f1b69"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 7039e6fb048b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7039e6fb048b…. Malware family: Zusy.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]