__top__ - Lumion.pro.v12.0-zmco.exe--------

: The file frequently alters the Windows hosts file to block the system from connecting to legitimate software verification and update servers.

This part of the filename might indicate a specific build or variant of the software, possibly related to a crack or a specific activation method, based on the context. However, it's crucial to approach such files with caution, as they might pose risks to your computer's security. Lumion.pro.v12.0-zmco.exe--------

rule LumionPro_ZMCO meta: description = "Detects suspicious Lumion.pro.v12.0‑zmco.exe binaries" author = "ChatGPT" reference = "https://github.com/Yara-Rules/rules" strings: $s1 = "Lumion.pro.v12.0-zmco.exe" $url = /[a-z0-9]8\.c2-[a-z0-9]4\.dnslog\.cn/ $api = "WinHttpOpen" condition: any of ($s1, $url, $api) and uint16(0) == 0x5A4D // PE header "MZ" : The file frequently alters the Windows hosts