26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T521,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GameHack.KD potentially unsafe application Sample 3ef16856d31a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3ef16856d31a…. Malware family: Win64/GameHack.KD potentially unsafe application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","keywords":["Malicious","Win64/GameHack.KD potentially unsafe application","malware analysis","sandbox report","threat intelligence","3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010"],"about":{"@type":"SoftwareApplication","name":"operabrowser - Copy.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/GameHack.KD potentially unsafe application","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T70c,Found string "#(loc.file_uncompression_progress_bar_header)" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found string "#(loc.file_uncompression_progress_status)" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found string "File uncompression:" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "Preparing for file uncompression." (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "#(loc.file_uncompression_success)" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "#(loc.preparing_file_uncompression)" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "#(loc.ids_uncompression_error_message)" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "Uncompression failed with error code" (Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "Decompression completed with code:" (Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found string "Decompression successfully completed with code:" (Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found string "Decompression of payload failed: %s" (Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")28:T485,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "operabrowser - Copy.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "operabrowser - Copy.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")29:T64d,"vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\_805393_ (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\Graphics (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1049 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\3082 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1031 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1036 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1040 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\2052 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1028 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1042 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1041 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1033 (UID: 00000000-00002360) "vcredist_x64.exe" called "RemoveDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d (UID: 00000000-00002360)2a:Tba6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "operabrowser - Copy.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "operabrowser - Copy.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")2b:T562,Found reference to API "NtOpenProcessToken Failed" (Indicator: "OpenProcessToken"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "operabrowser - Copy.exe") Found reference to API "NtOpenProcessToken Failed" (Indicator: "OpenProcessToken"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")2c:T717,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "operabrowser - Copy.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "::LoadLibrary(%s) failed with error %d" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")2d:Tedf,Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1033; Source: "00000000-00002360-00000C3E-2488554578") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1041; Source: "00000000-00002360-00000C3E-2508432366") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1042; Source: "00000000-00002360-00000C3E-2529569964") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1028; Source: "00000000-00002360-00000C3E-2554435812") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\2052; Source: "00000000-00002360-00000C3E-2574281056") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1040; Source: "00000000-00002360-00000C3E-2600984330") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1036; Source: "00000000-00002360-00000C3E-2620856166") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1031; Source: "00000000-00002360-00000C3E-2640518068") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\3082; Source: "00000000-00002360-00000C3E-2662855854") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1049; Source: "00000000-00002360-00000C3E-2684564734") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\Graphics; Source: "00000000-00002360-00000C3E-2709316758") Found string - .\.\.\.\msp_kb2565063.msp; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1028; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\Setup.exe; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\header.bmp; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\UiInfo.xml; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\Strings.xml; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1033; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\SetupUi.dll; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1041; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\SetupUi.xsd; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\1042; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\sqmapi.dll; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\DHtmlHeader.html; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string - c:\5c5053157117bfd8f7a456447d\.\.\.\DisplayIcon.ico; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp")2e:Ta71,"operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836363285 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836369000 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836570424 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836576662 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836783396 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2836789665 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2840873082 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2840881985 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2845170853 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2845177179 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2864081943 [PID: 4516] "operabrowser-Copy.exe" queried SystemProcessInformation at 00000000-00004516-00000C15-2864088655 [PID: 4516] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2845783846 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2845790819 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846002789 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846009074 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846309233 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846317054 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846555992 [PID: 2360] "vcredist_x64.exe" queried SystemProcessInformation at 00000000-00002360-00000C15-2846562883 [PID: 2360] "Setup.exe" queried SystemProcessInformation at 00000000-00002664-00000C15-2847806803 [PID: 2664] "Setup.exe" queried SystemProcessInformation at 00000000-00002664-00000C15-2847813653 [PID: 2664] "Setup.exe" queried SystemProcessInformation at 00000000-00002664-00000C15-2848011216 [PID: 2664] "Setup.exe" queried SystemProcessInformation at 00000000-00002664-00000C15-2848017819 [PID: 2664] "Setup.exe" queried SystemProcessInformation at 00000000-00002664-00000C15-2848241542 [PID: 2664]2f:Td0f,Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptHashPublicKeyInfo" (Indicator: "CryptHashPublicKeyInfo"; File: "operabrowser - Copy.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "operabrowser - Copy.exe") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "operabrowser - Copy.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "operabrowser - Copy.exe") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "operabrowser - Copy.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "operabrowser - Copy.exe") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "operabrowser - Copy.exe") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; File: "operabrowser - Copy.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "operabrowser - Copy.exe") Found api reference "CryptMsgGetAndVerifySigner" (Indicator: "CryptMsgGetAndVerifySigner"; File: "operabrowser - Copy.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "operabrowser - Copy.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found api reference "CryptMsgGetAndVerifySigner" (Indicator: "CryptMsgGetAndVerifySigner"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found api reference "CryptHashPublicKeyInfo" (Indicator: "CryptHashPublicKeyInfo"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")30:Ta52,Assembly shows XOR instruction xor byte ptr [esi+00h] bl in Stream UID: 00000000-00002360-16646-15-01006616 Assembly shows XOR instruction xor byte ptr [eax+25h] bh in Stream UID: 00000000-00002360-16646-15-01006616 Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 00000000-00002360-16646-15-01006616 Assembly shows XOR instruction xor dword ptr [bx+si] eax in Stream UID: 00000000-00002360-16646-15-01006616 Assembly shows XOR instruction xor byte ptr [ebx+76h] 30h in Stream UID: 00000000-00002360-16646-17-01006596 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00002360-16646-140-0100628E Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002360-16646-140-0100628E Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00002360-16646-140-0100628E Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00002360-16646-140-0100628E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-28-00DC2F6A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-28-00DC2F6A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-32-00DC4B70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-32-00DC4B70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-37-00DC45BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-37-00DC45BE Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00002664-18069-141-00DC3FA6 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002664-18069-141-00DC3FA6 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00002664-18069-141-00DC3FA6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-152-00DC5787 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-152-00DC5787 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-154-00DC68F1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-154-00DC68F1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-162-00DC6B28 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-162-00DC6B28 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-18069-164-00DC5AD2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-18069-164-00DC5AD231:T461,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI32:T5a83,Found XOR loop in file "vcredist_x64.exe" at offset 116401; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 232382; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 278137; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 279594; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 302006; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 326693; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 346056; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 416107; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 441280; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 546585; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 610089; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 640803; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 672435; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 865509; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 968586; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1038758; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1110944; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1246873; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1345313; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1352490; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1365470; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1490149; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1634415; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1871622; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 1895546; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2158266; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2389414; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2470544; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2519750; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2530644; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2589785; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2594991; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2629661; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2678875; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2726489; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2841133; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2867779; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2966582; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2984848; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 2998342; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3265714; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3268432; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3324501; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3368030; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3510394; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3567605; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3568006; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3639741; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3727414; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3773746; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3801774; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3880963; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3907775; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3942513; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3996715; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 3996762; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4046387; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4118921; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4196235; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4209068; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4240899; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4326428; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4368236; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4395467; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4407899; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4511632; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4728648; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4750559; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4753565; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4827180; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4892756; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4935688; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4937137; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 4972129; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 5005300; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 5190000; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 5221725; code bytes = 30d0 Found XOR loop in file "vcredist_x64.exe" at offset 62774; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 101140; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 190092; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 203634; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 210240; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 313644; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 360538; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 419019; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 450351; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 469639; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 774662; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 826544; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 867671; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 886274; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1108522; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1115895; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1206398; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1313010; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1388838; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1433578; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1548419; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1614160; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1624466; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1630345; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1631071; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1756330; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1794742; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1796678; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1801498; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1849401; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1860977; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1908980; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 1971354; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2017794; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2030136; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2044740; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2089839; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2175445; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2210467; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2345572; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2364856; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2625424; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2635637; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2701866; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2708895; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2806738; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2856338; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2899033; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2965080; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2969768; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2978297; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2984999; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 2991201; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3004460; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3110293; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3215876; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3266647; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3283111; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3316383; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3351057; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3439809; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3676348; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3698720; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3872608; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3873941; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3925929; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 3981210; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4104586; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4147524; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4164109; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4167227; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4174924; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4213878; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4388958; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4403372; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4498410; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4525118; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4824673; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 4954194; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 5020195; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 5200650; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 5213973; code bytes = 33c1 Found XOR loop in file "vcredist_x64.exe" at offset 94894; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 95956; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 345557; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 407310; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 480026; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 664083; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 666377; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 755168; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 852384; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1017912; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1043599; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1151044; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1221552; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1237371; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1522648; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1576997; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1587857; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1679949; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1754837; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1767289; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1791182; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1843615; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1870738; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1945813; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 1979353; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2056055; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2196063; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2227918; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2268117; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2283697; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2324553; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2392234; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2454498; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2455734; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2474219; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2496752; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2571051; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2573456; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2636026; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2649638; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2678922; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2739212; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2742003; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2746577; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2827477; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2829497; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2846056; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2903710; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 2949024; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3027272; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3029429; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3096822; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3188718; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3285658; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3303513; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3310450; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3434425; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3760964; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3794919; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3827668; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3887100; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3908739; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 3924518; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4161214; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4233143; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4258334; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4339411; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4362744; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4383413; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4444003; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4551624; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4667886; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4673895; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4674629; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4798724; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4880201; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4901625; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4948379; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 4967765; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 5060693; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 5160814; code bytes = 8030 Found XOR loop in file "vcredist_x64.exe" at offset 5172907; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 1640; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 173253; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 701724; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 752291; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 754335; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 757039; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 759477; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 760973; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 761943; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 766597; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 768747; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 770351; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 775425; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 783357; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 784765; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 792309; code bytes = 30d0 Found XOR loop in file "SetupEngine.dll" at offset 549584; code bytes = 33c1 Found XOR loop in file "SetupEngine.dll" at offset 550233; code bytes = 33c1 Found XOR loop in file "SetupEngine.dll" at offset 774375; code bytes = 33c1 Found XOR loop in file "SetupEngine.dll" at offset 284102; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 662900; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 752252; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 754298; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 756190; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 757854; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 764792; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 777054; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 785456; code bytes = 8030 Found XOR loop in file "SetupEngine.dll" at offset 804281; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 268073; code bytes = 30d0 Found XOR loop in file "SetupUi.dll" at offset 269463; code bytes = 30d0 Found XOR loop in file "SetupUi.dll" at offset 281027; code bytes = 30d0 Found XOR loop in file "SetupUi.dll" at offset 202641; code bytes = 33c1 Found XOR loop in file "SetupUi.dll" at offset 203290; code bytes = 33c1 Found XOR loop in file "SetupUi.dll" at offset 83967; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 268036; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 269454; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 271240; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 279228; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 280390; code bytes = 8030 Found XOR loop in file "SetupUi.dll" at offset 291257; code bytes = 8030 Found XOR loop in file "Setup.exe" at offset 74169; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 14265; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 13753; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 12729; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 3237; code bytes = 30d0 Found XOR loop in file "SetupResources.dll" at offset 4823; code bytes = 30d0 Found XOR loop in file "SetupResources.dll" at offset 6539; code bytes = 30d0 Found XOR loop in file "SetupResources.dll" at offset 11193; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 10681; code bytes = 8030 Found XOR loop in file "SetupResources.dll" at offset 9657; code bytes = 803033:T97d,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "operabrowser - Copy.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "operabrowser - Copy.exe") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "operabrowser - Copy.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "operabrowser - Copy.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "operabrowser - Copy.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx failed" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx failed" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")34:T895,Found system information discovery API: "ExpandEnvironmentStringsA" in file "00000000-00002360.00000000.280407.01002000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in file "operabrowser - Copy.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "operabrowser - Copy.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "operabrowser - Copy.exe" Found system information discovery API: "GetMonitorInfoW" in file "operabrowser - Copy.exe" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in file "operabrowser - Copy.exe" Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00002360.00000000.280407.01002000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp"35:T5c1,file/memory contains long string with (Indicator: "sendmessage"; File: "SetupUi.dll") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "operabrowser - Copy.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "operabrowser - Copy.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "operabrowser - Copy.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "operabrowser - Copy.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")36:T4eb,"Setup.exe" called "GetWindowTextW" (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "Network Flyout" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "Extracting Files" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\dumpcap.exe" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\mitmproxy\bin\_internal\mitmproxy_windows\windows-redirector.exe" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\tshark.exe" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "%WINDIR%\system32\cmd.exe" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "DnDControlTitle" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "VMSwitchUserControlTitle" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "vmtoolsdControlWndTitle" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "WUIconWindow" - (UID: 00000000-00002664) "Setup.exe" called "GetWindowTextW" with parameter "MS_WebcheckMonitor" - (UID: 00000000-00002664)37:Ta02,"operabrowser-Copy.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000004705fa7f000090604d000000000028ed140000000000060000000000000031e49b2ffa7f00000000000000000000000000000000000000eb140000000000000000000000000050ea1400000000001014ac2ffa7f000000000000000000009013ac2ffa7f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060be9c2ffa7f0000080200000000000010134c0000000000d0ea14000000000040bd4d000000000040bd4d000000000000134c0000000000ff6d4d00000000002000000000000000300b4e0000000000f3859b2ffa7f0000300b4e0000000000d8ea14000000000000000000 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938ec2cfa7f000080000000000000000000000000000000f0224e000000000010339e2ffa7f000000000000000000000000502efa7f0000e0eb1400000000001041e92cfa7f000090634d0000000000a0eb140000000000000000000000000000000000000000000100000000000000b840e92cfa7f00007e0000000000000001000000000000000000502efa7f00003b4d1b2dfa7f0000000000000000000058f01400000000000000000000000000d02a622efa7f000010b3c82efa7f0000e8f8e82cfa7f000010b3c82efa7f0000d02a622efa7f00000d000000fa7f00000d00000000000000a0f6b82efa7f0000f5875d2efa7f0000d02a622e (UID: 00000000-00004516) "operabrowser-Copy.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004516)38:T62c,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "operabrowser - Copy.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")39:T755,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "operabrowser - Copy.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "operabrowser - Copy.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "operabrowser - Copy.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "operabrowser - Copy.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "14,6572,109,,GetWindowTextW,user32.dll,"01:13:03.390",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found reference to API "1507014,6572,109,,GetWindowTextW,user32.dll,"01:13:03.421",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp")3a:T8d2,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "operabrowser - Copy.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "operabrowser - Copy.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "operabrowser - Copy.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "operabrowser - Copy.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "operabrowser - Copy.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")3b:T4ab,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "operabrowser - Copy.exe") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "operabrowser - Copy.exe") Found reference to API "OpenSCManager failed with error: %u" (Indicator: "OpenSCManager"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "QueryServiceStatus failed with error: %u" (Indicator: "QueryServiceStatus"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")3c:T40b,file/memory contains long string with (Indicator: "MoveFileW"; File: "SetupUi.dll") Found string "MoveFileExA" (Indicator: "MoveFileExA"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found string "MoveFileA" (Indicator: "MoveFileA"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "operabrowser - Copy.exe") Found string "MoveFileW" (Indicator: "MoveFileW"; File: "operabrowser - Copy.exe") Found string "MoveFileExA" (Indicator: "MoveFileExA"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found string "MoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")3d:T62c,"operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "operabrowser-Copy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "operabrowser-Copy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "operabrowser-Copy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "operabrowser-Copy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "operabrowser-Copy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "operabrowser-Copy.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")3e:T414,"vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\_805393_ (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter 633a (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\. (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\. (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\. (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1033 (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1041 (UID: 00000000-00002360) "vcredist_x64.exe" called "CreateDirectoryA" with parameter c:\5c5053157117bfd8f7a456447d\.\.\.\1042 (UID: 00000000-00002360)3f:Tc00,"operabrowser-Copy.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004516) "operabrowser-Copy.exe" called "LoadLibrary" with a parameter MSVCR100.dll (UID: 00000000-00004516) "operabrowser-Copy.exe" called "LoadLibrary" with a parameter Urlmon.dll (UID: 00000000-00004516) "operabrowser-Copy.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004516) "vcredist_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\clusapi.dll (UID: 00000000-00002360) "vcredist_x64.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002360) "vcredist_x64.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002360) "Setup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\VERSION.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSI.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter SetupUi.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter c:\5c5053157117bfd8f7a456447d\1033\SetupResources.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter RICHED20.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\TSAPPCMP.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NETAPI32.DLL (UID: 00000000-00002664) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHELL32.DLL (UID: 00000000-00002664)40:T2d80,"operabrowser-Copy.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter URLDownloadToFileA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter _wstat64i32 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00004516) "operabrowser-Copy.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004516) "vcredist_x64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter OpenCluster (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter CloseCluster (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter GetNodeClusterState (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter GetClusterQuorumResource (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002360) "vcredist_x64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002360) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CreateClassFactory (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter MsiSetExternalUIRecord (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter SrpOpenTrackInstall (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter SrpCloseTrackInstall (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002664) "Setup.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002664)41:T679,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "operabrowser - Copy.exe") Found reference to API "399422,5272,3142,,CreateProcessA,kernel32.dll,"01:12:58.500",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "Launching CreateProcess with command line =" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "Error launching CreateProcess with command line =" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "CreateProcess returned error =" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "In PreCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "PostCreateProcess succeeded" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "Launching CreateProcess to Decompress:" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")42:T4dc,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "operabrowser - Copy.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "operabrowser - Copy.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "CreateFilesInUser" (Indicator: "CreateFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")43:T5c7,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "operabrowser - Copy.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "operabrowser - Copy.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "operabrowser - Copy.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "operabrowser - Copy.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "operabrowser - Copy.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")44:T4c0,Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "operabrowser - Copy.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "operabrowser - Copy.exe") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "Failed to move temp file to destination location. MoveFileEx call failed with 0x%x" (Indicator: "MoveFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")45:T480,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")46:T42a,"GE_INFO [Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\]" (Indicator: "ge_info [property(s): startupfolder = c:\programdata\microsoft\windows\start menu\programs\startup\]") in Source: 00000000-00002664.00000001.281287.00CA2000.00000004.mdmp, "Returning IDOK. INSTALLMESSAGE_INFO [Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\]" (Indicator: "returning idok. installmessage_info [property(s): startupfolder = c:\programdata\microsoft\windows\start menu\programs\startup\]") in Source: 00000000-00002664.00000001.281287.00CA2000.00000004.mdmp, "ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "programdata%\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp47:T14fc,"For more information, visit http://support.microsoft.com/kb/2544655.KB2544655.ARP.DisplayNameHotfix for [LocProductName] (KB2544655)KB2544655.ARP.DisplayVersionKB2544655.ARP.HelpLinkhttp://support.microsoft.com/kb/2544655KB2544655.ARP.NoModifyKB2544655.ARP.NoRepairKB2544655.ARP.ParentDisplayNameKB2544655.ARP.ParentKeyNameKB2544655.ARP.PublisherKB2544655.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2544655KB2544655.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2544655.PatchCode] /qb+ REBOOTPROMPT=""KB2544655.ARP.URLInfoAboutKB2544655.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655KB2544655.SE.InstalledByKB2544655.SE.InstalledDateKB2544655.SE.InstallerNameKB2544655.SE.InstallerVersionKB2544655.SE.PackageNameKB2544655.SE.PackageVersionKB2544655.SE.PublisherKB2544655.SE.PublishingGroupKB2544655.SE.ReleaseTypeKB2549743.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2549743.KB2549743.ARP.DisplayNameHotfix for [LocProductName] (KB2549743)KB2549743.ARP.DisplayVersionKB2549743.ARP.HelpLinkhttp://support.microsoft.com/kb/2549743KB2549743.ARP.NoModifyKB2549743.ARP.NoRepairKB2549743.ARP.ParentDisplayNameKB2549743.ARP.ParentKeyNameKB2549743.ARP.PublisherKB2549743.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2549743KB2549743.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2549743.PatchCode] /qb+ REBOOTPROMPT=""KB2549743.ARP.URLInfoAboutKB2549743.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743KB2549743.SE.InstalledByKB2549743.SE.InstalledDateKB2549743.SE.InstallerNameKB2549743.SE.InstallerVersionKB2549743.SE.PackageNameKB2549743.SE.PackageVersionKB2549743.SE.PublisherKB2549743.SE.PublishingGroupKB2549743.SE.ReleaseTypeKB2565063.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp 00000000-00002360.00000001.281295.00610000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\Bld" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\KB2565063" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "System\CurrentControlSet\Services\Eventlog\Application\VSSetup" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\PCHealth\ErrorReporting\DW\Installed" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\VisualStudio\Setup" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Windows" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\DevDiv" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "HKLM\Software\Microsoft\Internet Explorer\Registration\DigitalProductID" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "\SOFTWARE\Microsoft\DevDiv\vc\Servicing\10.0" in Source: 00000000-00002664.00000001.281287.00CA2000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004516.00000000.279828.004C0000.00000004.mdmp 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "\Software\C4" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004516.00000001.281739.04A10000.00000004.mdmp "e\Software\C" in Source: 00000000-00004516.00000001.281739.04A10000.00000004.mdmp48:T928,Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4516:304:WilStaging_02" Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4516:120:WilError_03" Process operabrowser-Copy.exe created mutex with name "SM0:4516:304:WilStaging_02" Process operabrowser-Copy.exe created mutex with name "Local\SM0:4516:304:WilStaging_02" Process operabrowser-Copy.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process operabrowser-Copy.exe created mutex with name "Local\SM0:4516:120:WilError_03" Process operabrowser-Copy.exe created mutex with name "SM0:4516:120:WilError_03" Process operabrowser-Copy.exe created mutex with name "Local\ZonesCacheCounterMutex" Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4516:304:WilStaging_02" Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4516:120:WilError_03" Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process operabrowser-Copy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process vcredist_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2360:168:WilStaging_02" Process vcredist_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2360:168:WilStaging_02" Process vcredist_x64.exe created mutex with name "SM0:2360:168:WilStaging_02" Process vcredist_x64.exe created mutex with name "Local\SM0:2360:168:WilStaging_02" Process Setup.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2664:168:WilStaging_02" Process Setup.exe created mutex with name "SM0:2664:64:WilError_03" Process Setup.exe created mutex with name "DBWinMutex" Process Setup.exe created mutex with name "Local\SM0:2664:168:WilStaging_02" Process Setup.exe created mutex with name "SM0:2664:168:WilStaging_02" Process Setup.exe created mutex with name "Local\SM0:2664:64:WilError_03" Process Setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2664:168:WilStaging_02" Process Setup.exe created mutex with name "\BaseNamedObjects\VC_Redist_SetupMutex"49:T8df,Antivirus vendors marked dropped file "vcredist_x64.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"), Antivirus vendors marked dropped file "msp_kb2565063.msp" as clean (type is "Composite Document File V2 Document Little Endian Os: Windows Version 6.0 Code page: 1252 Title: KB2565063 Subject: Hotfix for Microsoft Visual Studio 2010 - KB2565063 Author: Microsoft Comments: KB2565063 Template: {1D8E6291-B0D5-35EC-8441-6616F567A0F7} Last Saved By: :SP1.1;:#SP1.1 Revision Number: {C67045D4-F4DE-3AB5-B2DB-E3F5DAC14D9C} Create Time/Date: Wed Jun 29 04:18:40 2011 Last Saved Time/Date: Wed Jun 29 04:18:40 2011 Number of Words: 5 Name of Creating Application: Windows Installer XML (3.5.0626.3) Security: 4"), Antivirus vendors marked dropped file "SetupEngine.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "SetupUi.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "vc_red.msi" as clean (type is "Composite Document File V2 Document Little Endian Os: Windows Version 6.0 MSI Installer Code page: 1252 Title: Installation Database Subject: Visual C++ 2010 x64 Redistributable Author: Microsoft Corporation Keywords: Installer Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219. Template: x64;0 Revision Number: {80902F2D-E1EF-43CA-B366-74496197E004} Create Time/Date: Sun Feb 20 06:51:54 2011 Last Saved Time/Date: Sun Feb 20 06:51:54 2011 Number of Pages: 200 Name of Creating Application: Windows Installer XML (3.5.0626.3) Security: 2 Number of Words: 2"), Antivirus vendors marked dropped file "Setup.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"), Antivirus vendors marked dropped file "SetupResources.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"), Antivirus vendors marked dropped file "eula.rtf" as clean (type is "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"), Antivirus vendors marked dropped file "vcredist_x64_1_.exe" as clean (type is "Unknown")4a:T1788,Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows Phone OS 7.5; Trident/4.0; IEMobile/8.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/8.0; Touch; rv:11.0; IEMobile/11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; Win64; x64; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Win64; x64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Win64; x64; Trident/5.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Win64; x64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; Win64; x64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.2; Win64; x64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Mobile Safari/537.36 Edge/18.9200" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/3.1; XBLWP7; ZuneWP7)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp")4b:T5584,"etection_RegKeyKB2524860.ARP.Add{50FF4FC4-8A81-30E9-82E8-B367404BDB61}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2524860.ClassificationKB2524860.ARP.ReleaseTypeKB2524860.ARP.NoRemove{A5645A17-F16F-3C02-BCBA-2C1FDC85FE92}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2524860.AllowRemoval <> 1KB2524860.ARP.Remove{3739A1A5-3193-3B16-B3C5-930D7AE296CE}KB2524860.ARP.DefaultKB2524860.SE{32EA311A-8976-36D6-947C-311E931B290B}KB2524860.ClassificationKB2524860.SE.ThisVersionInstalledKB2544655.ARP.Add{3DAA6F7B-14F6-32AB-9249-B44328834345}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2544655.ClassificationKB2544655.ARP.ReleaseTypeKB2544655.ARP.NoRemove{2C40BD86-136E-3BCA-8C07-781AD88D3C36}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2544655.AllowRemoval <> 1KB2544655.ARP.Remove{5A4E0BDC-147A-33DF-BEAE-8DF47410A6A6}KB2544655.ARP.DefaultKB2544655.SE{558DC561-C3BC-3ACE-981F-F84A00FE60CB}KB2544655.ClassificationKB2544655.SE.ThisVersionInstalledKB2549743.ARP.Add{DF23A105-6C24-3498-A45F-2CD6E095E704}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2549743.ClassificationKB2549743.ARP.ReleaseTypeKB2549743.ARP.NoRemove{BB4809CB-D398-3CAF-AFE8-E7057A0B5D28}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2549743.AllowRemoval <> 1KB2549743.ARP.Remove{D38F303E-A172-34AB-B075-914CA95CEA9F}KB2549743.ARP.DefaultKB2549743.SE{A7E32782-B545-3FE3-9BEB-38596903F68D}KB2549743.ClassificationKB2549743.SE.ThisVersionInstalledKB2565063.ARP.Add{C90119E6-77A5-34AA-8439-45985B338D9C}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2565063.ClassificationKB2565063.ARP.ReleaseTypeKB2565063.ARP.NoRemove{CA5E332A-86F5-334E-BBB1-D55FB2F62A17}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2565063.AllowRemoval <> 1KB2565063.ARP.Remove{02829BCC-8937-3AC6-939C-9010C2CFB462}KB2565063.ARP.DefaultKB2565063.SE{6AE4C171-E334-3475-A173-D125D816C7D3}KB2565063.ClassificationKB2565063.SE.ThisVersionInstalledFT_VCRedist_x64_KB2565063_DetectionVC_REDIST_KB2565063_DETECTIONKB2524860Servicing_KeyKB2544655KB2549743KB2565063{D214F6E3-7C3A-3B2A-B71B-253773DE3AFD}0{DD7EB585-1162-3935-B6DE-94450F1050A8}{80F7625D-9344-331B-A735-BAA4433AF7AB}{DFABC444-C96E-3F6E-9C40-07BB25606ADD}{4CA2A394-58E4-3D5D-B344-F1EFAD95B671}{EEE3A576-7DA0-36DA-A146-29B1B62347CC}VC_RED_enu_amd64_net_SETUP{80A6A3DC-0C7C-3418-BC86-F92E9D111B6B}VCRedist_amd64_enu{63D54400-C942-305F-8961-C9940EC1EEA9}F_CENTRAL_atl100_x6410.0.40219.325F_CENTRAL_mfc100_x64F_CENTRAL_mfc100chs_x64F_CENTRAL_mfc100cht_x64F_CENTRAL_mfc100deu_x64F_CENTRAL_mfc100enu_x64F_CENTRAL_mfc100esn_x64F_CENTRAL_mfc100fra_x64F_CENTRAL_mfc100ita_x64F_CENTRAL_mfc100jpn_x64F_CENTRAL_mfc100kor_x64F_CENTRAL_mfc100rus_x64F_CENTRAL_mfc100u_x64F_CENTRAL_mfcm100_x64F_CENTRAL_mfcm100u_x64F_CENTRAL_msvcp100_x64F_CENTRAL_msvcr100_x64F_CENTRAL_vcomp100_x64HotfixProductVersionLow2635792709RTM_ProductVersion10.0.40219.01SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\KB2565063Present#1SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2524860ReleaseTypeNoRemoveSOFTWARE\Microsoft\Updates\[ProductName]\SP1\KB2524860ThisVersionInstalledYSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655SOFTWARE\Microsoft\Updates\[ProductName]\KB2544655SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743SOFTWARE\Microsoft\Updates\[ProductName]\KB2549743SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2565063SOFTWARE\Microsoft\Updates\[ProductName]\SP1\KB2565063R_x64_Redist_Detection_RegKey2v10.0.40219.325R_x64_Redist_Detection_RegKey6#325Servicing_Key_ProductEdition_RegKey_640219.325Servicing_Key_ProductLanguage_RegKey_6Servicing_Key_ProductLanguageChip_RegKey_6Servicing_Key_ProductLanguageChip_RegKey_8KB2524860.ARP.CommentsCommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2524860.KB2524860.ARP.DisplayNameDisplayNameHotfix for [LocProductName] (KB2524860)KB2524860.ARP.DisplayVersionDisplayVersion1KB2524860.ARP.HelpLinkHelpLinkhttp://support.microsoft.com/kb/2524860KB2524860.ARP.NoModifyNoModifyKB2524860.ARP.NoRepairNoRepairKB2524860.ARP.ParentDisplayNameParentDisplayName[LocProductName]KB2524860.ARP.ParentKeyNameParentKeyName[ProductName]KB2524860.ARP.PublisherPublisher[Manufacturer]KB2524860.ARP.RegistryLocationRegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\SP1\KB2524860KB2524860.ARP.UninstallStringUninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2524860.PatchCode] /qb+ REBOOTPROMPT=""KB2524860.ARP.URLInfoAboutURLInfoAbouthttp://support.microsoft.comKB2524860.SE.ARPLinkARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2524860KB2524860.SE.InstalledByInstalledBy{[LogonUserPrefix]}[LogonUser]KB2524860.SE.InstalledDateInstalledDate[Date]KB2524860.SE.InstallerNameInstallerNameWindows InstallerKB2524860.SE.InstallerVersionInstallerVersion[VersionMsi]KB2524860.SE.PackageNamePackageNameKB2524860.SE.PackageVersionPackageVersionKB2524860.SE.PublisherKB2524860.SE.PublishingGroupPublishingGroupDeveloper DivisionKB2524860.SE.ReleaseTypeKB2544655.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2544655.KB2544655.ARP.DisplayNameHotfix for [LocProductName] (KB2544655)KB2544655.ARP.DisplayVersionKB2544655.ARP.HelpLinkhttp://support.microsoft.com/kb/2544655KB2544655.ARP.NoModifyKB2544655.ARP.NoRepairKB2544655.ARP.ParentDisplayNameKB2544655.ARP.ParentKeyNameKB2544655.ARP.PublisherKB2544655.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2544655KB2544655.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2544655.PatchCode] /qb+ REBOOTPROMPT=""KB2544655.ARP.URLInfoAboutKB2544655.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655KB2544655.SE.InstalledByKB2544655.SE.InstalledDateKB2544655.SE.InstallerNameKB2544655.SE.InstallerVersionKB2544655.SE.PackageNameKB2544655.SE.PackageVersionKB2544655.SE.PublisherKB2544655.SE.PublishingGroupKB2544655.SE.ReleaseTypeKB2549743.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2549743.KB2549743.ARP.DisplayNameHotfix for [LocProductName] (KB2549743)KB2549743.ARP.DisplayVersionKB2549743.ARP.HelpLinkhttp://support.microsoft.com/kb/2549743KB2549743.ARP.NoModifyKB2549743.ARP.NoRepairKB2549743.ARP.ParentDisplayNameKB2549743.ARP.ParentKeyNameKB2549743.ARP.PublisherKB2549743.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2549743KB2549743.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2549743.PatchCode] /qb+ REBOOTPROMPT=""KB2549743.ARP.URLInfoAboutKB2549743.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743KB2549743.SE.InstalledByKB2549743.SE.InstalledDateKB2549743.SE.InstallerNameKB2549743.SE.InstallerVersionKB2549743.SE.PackageNameKB2549743.SE.PackageVersionKB2549743.SE.PublisherKB2549743.SE.PublishingGroupKB2549743.SE.ReleaseTypeKB2565063.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2565063.KB2565063.ARP.DisplayNameHotfix for [LocProductName] (KB2565063)KB2565063.ARP.DisplayVersionKB2565063.ARP.HelpLinkhttp://support.microsoft.com/kb/2565063KB2565063.ARP.NoModifyKB2565063.ARP.NoRepairKB2565063.ARP.ParentDisplayNameKB2565063.ARP.ParentKeyNameKB2565063.ARP.PublisherKB2565063.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\SP1\KB2565063KB2565063.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2565063.PatchCode] /qb+ REBOOTPROMPT=""KB2565063.ARP.URLInfoAboutKB2565063.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2565063KB2565063.SE.InstalledByKB2565063.SE.InstalledDateKB2565063.SE.InstallerNameKB2565063.SE.InstallerVersionKB2565063.SE.PackageNameKB2565063.SE.PackageVersionKB2565063.SE.PublisherKB2565063.SE.PublishingGroupKB2565063.SE.ReleaseTypeKB2524860.ARP.RemoveRegistry-KB2544655.ARP.RemoveRegistryKB2549743.ARP.RemoveRegistryKB2565063.ARP.RemoveRegistry" in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp "etection_RegKeyKB2524860.ARP.Add{50FF4FC4-8A81-30E9-82E8-B367404BDB61}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2524860.ClassificationKB2524860.ARP.ReleaseTypeKB2524860.ARP.NoRemove{A5645A17-F16F-3C02-BCBA-2C1FDC85FE92}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2524860.AllowRemoval <> 1KB2524860.ARP.Remove{3739A1A5-3193-3B16-B3C5-930D7AE296CE}KB2524860.ARP.DefaultKB2524860.SE{32EA311A-8976-36D6-947C-311E931B290B}KB2524860.ClassificationKB2524860.SE.ThisVersionInstalledKB2544655.ARP.Add{3DAA6F7B-14F6-32AB-9249-B44328834345}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2544655.ClassificationKB2544655.ARP.ReleaseTypeKB2544655.ARP.NoRemove{2C40BD86-136E-3BCA-8C07-781AD88D3C36}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2544655.AllowRemoval <> 1KB2544655.ARP.Remove{5A4E0BDC-147A-33DF-BEAE-8DF47410A6A6}KB2544655.ARP.DefaultKB2544655.SE{558DC561-C3BC-3ACE-981F-F84A00FE60CB}KB2544655.ClassificationKB2544655.SE.ThisVersionInstalledKB2549743.ARP.Add{DF23A105-6C24-3498-A45F-2CD6E095E704}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2549743.ClassificationKB2549743.ARP.ReleaseTypeKB2549743.ARP.NoRemove{BB4809CB-D398-3CAF-AFE8-E7057A0B5D28}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2549743.AllowRemoval <> 1KB2549743.ARP.Remove{D38F303E-A172-34AB-B075-914CA95CEA9F}KB2549743.ARP.DefaultKB2549743.SE{A7E32782-B545-3FE3-9BEB-38596903F68D}KB2549743.ClassificationKB2549743.SE.ThisVersionInstalledKB2565063.ARP.Add{C90119E6-77A5-34AA-8439-45985B338D9C}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2565063.ClassificationKB2565063.ARP.ReleaseTypeKB2565063.ARP.NoRemove{CA5E332A-86F5-334E-BBB1-D55FB2F62A17}(VersionNT <= 500 OR (VersionNT = 501 AND ServicePackLevel < 2) OR (VersionNT = 502 AND ServicePackLevel < 1) OR ARPSYSTEMCOMPONENT=1) AND KB2565063.AllowRemoval <> 1KB2565063.ARP.Remove{02829BCC-8937-3AC6-939C-9010C2CFB462}KB2565063.ARP.DefaultKB2565063.SE{6AE4C171-E334-3475-A173-D125D816C7D3}KB2565063.ClassificationKB2565063.SE.ThisVersionInstalledFT_VCRedist_x64_KB2565063_DetectionVC_REDIST_KB2565063_DETECTIONKB2524860Servicing_KeyKB2544655KB2549743KB2565063{D214F6E3-7C3A-3B2A-B71B-253773DE3AFD}0{DD7EB585-1162-3935-B6DE-94450F1050A8}{80F7625D-9344-331B-A735-BAA4433AF7AB}{DFABC444-C96E-3F6E-9C40-07BB25606ADD}{4CA2A394-58E4-3D5D-B344-F1EFAD95B671}{EEE3A576-7DA0-36DA-A146-29B1B62347CC}VC_RED_enu_amd64_net_SETUP{80A6A3DC-0C7C-3418-BC86-F92E9D111B6B}VCRedist_amd64_enu{63D54400-C942-305F-8961-C9940EC1EEA9}F_CENTRAL_atl100_x6410.0.40219.325F_CENTRAL_mfc100_x64F_CENTRAL_mfc100chs_x64F_CENTRAL_mfc100cht_x64F_CENTRAL_mfc100deu_x64F_CENTRAL_mfc100enu_x64F_CENTRAL_mfc100esn_x64F_CENTRAL_mfc100fra_x64F_CENTRAL_mfc100ita_x64F_CENTRAL_mfc100jpn_x64F_CENTRAL_mfc100kor_x64F_CENTRAL_mfc100rus_x64F_CENTRAL_mfc100u_x64F_CENTRAL_mfcm100_x64F_CENTRAL_mfcm100u_x64F_CENTRAL_msvcp100_x64F_CENTRAL_msvcr100_x64F_CENTRAL_vcomp100_x64HotfixProductVersionLow2635792709RTM_ProductVersion10.0.40219.01SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\KB2565063Present#1SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2524860ReleaseTypeNoRemoveSOFTWARE\Microsoft\Updates\[ProductName]\SP1\KB2524860ThisVersionInstalledYSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655SOFTWARE\Microsoft\Updates\[ProductName]\KB2544655SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743SOFTWARE\Microsoft\Updates\[ProductName]\KB2549743SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2565063SOFTWARE\Microsoft\Updates\[ProductName]\SP1\KB2565063R_x64_Redist_Detection_RegKey2v10.0.40219.325R_x64_Redist_Detection_RegKey6#325Servicing_Key_ProductEdition_RegKey_640219.325Servicing_Key_ProductLanguage_RegKey_6Servicing_Key_ProductLanguageChip_RegKey_6Servicing_Key_ProductLanguageChip_RegKey_8KB2524860.ARP.CommentsCommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2524860.KB2524860.ARP.DisplayNameDisplayNameHotfix for [LocProductName] (KB2524860)KB2524860.ARP.DisplayVersionDisplayVersion1KB2524860.ARP.HelpLinkHelpLinkhttp://support.microsoft.com/kb/2524860KB2524860.ARP.NoModifyNoModifyKB2524860.ARP.NoRepairNoRepairKB2524860.ARP.ParentDisplayNameParentDisplayName[LocProductName]KB2524860.ARP.ParentKeyNameParentKeyName[ProductName]KB2524860.ARP.PublisherPublisher[Manufacturer]KB2524860.ARP.RegistryLocationRegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\SP1\KB2524860KB2524860.ARP.UninstallStringUninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2524860.PatchCode] /qb+ REBOOTPROMPT=""KB2524860.ARP.URLInfoAboutURLInfoAbouthttp://support.microsoft.comKB2524860.SE.ARPLinkARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2524860KB2524860.SE.InstalledByInstalledBy{[LogonUserPrefix]}[LogonUser]KB2524860.SE.InstalledDateInstalledDate[Date]KB2524860.SE.InstallerNameInstallerNameWindows InstallerKB2524860.SE.InstallerVersionInstallerVersion[VersionMsi]KB2524860.SE.PackageNamePackageNameKB2524860.SE.PackageVersionPackageVersionKB2524860.SE.PublisherKB2524860.SE.PublishingGroupPublishingGroupDeveloper DivisionKB2524860.SE.ReleaseTypeKB2544655.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2544655.KB2544655.ARP.DisplayNameHotfix for [LocProductName] (KB2544655)KB2544655.ARP.DisplayVersionKB2544655.ARP.HelpLinkhttp://support.microsoft.com/kb/2544655KB2544655.ARP.NoModifyKB2544655.ARP.NoRepairKB2544655.ARP.ParentDisplayNameKB2544655.ARP.ParentKeyNameKB2544655.ARP.PublisherKB2544655.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2544655KB2544655.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2544655.PatchCode] /qb+ REBOOTPROMPT=""KB2544655.ARP.URLInfoAboutKB2544655.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655KB2544655.SE.InstalledByKB2544655.SE.InstalledDateKB2544655.SE.InstallerNameKB2544655.SE.InstallerVersionKB2544655.SE.PackageNameKB2544655.SE.PackageVersionKB2544655.SE.PublisherKB2544655.SE.PublishingGroupKB2544655.SE.ReleaseTypeKB2549743.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2549743.KB2549743.ARP.DisplayNameHotfix for [LocProductName] (KB2549743)KB2549743.ARP.DisplayVersionKB2549743.ARP.HelpLinkhttp://support.microsoft.com/kb/2549743KB2549743.ARP.NoModifyKB2549743.ARP.NoRepairKB2549743.ARP.ParentDisplayNameKB2549743.ARP.ParentKeyNameKB2549743.ARP.PublisherKB2549743.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2549743KB2549743.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2549743.PatchCode] /qb+ REBOOTPROMPT=""KB2549743.ARP.URLInfoAboutKB2549743.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743KB2549743.SE.InstalledByKB2549743.SE.InstalledDateKB2549743.SE.InstallerNameKB2549743.SE.InstallerVersionKB2549743.SE.PackageNameKB2549743.SE.PackageVersionKB2549743.SE.PublisherKB2549743.SE.PublishingGroupKB2549743.SE.ReleaseTypeKB2565063.ARP.CommentsThis hotfix is for [LocProductName]." in Source: 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2565063.KB2565063.ARP.DisplayNameHotfix for [LocProductName] (KB2565063)KB2565063.ARP.DisplayVersionKB2565063.ARP.HelpLinkhttp://support.microsoft.com/kb/2565063KB2565063.ARP.NoModifyKB2565063.ARP.NoRepairKB2565063.ARP.ParentDisplayNameKB2565063.ARP.ParentKeyNameKB2565063.ARP.PublisherKB2565063.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\SP1\KB2565063KB2565063.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2565063.PatchCode] /qb+ REBOOTPROMPT=""KB2565063.ARP.URLInfoAboutKB2565063.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2565063KB2565063.SE.InstalledByKB2565063.SE.InstalledDateKB2565063.SE.InstallerNameKB2565063.SE.InstallerVersionKB2565063.SE.PackageNameKB2565063.SE.PackageVersionKB2565063.SE.PublisherKB2565063.SE.PublishingGroupKB2565063.SE.ReleaseTypeKB2524860.ARP.RemoveRegistry-KB2544655.ARP.RemoveRegistryKB2549743.ARP.RemoveRegistryKB2565063.ARP.RemoveRegistry" in Source: 00000000-00002360.00000001.281295.00610000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\Bld" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "HKLM\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64\KB2565063" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x64" in Source: 00000000-00002664.00000000.280541.00C10000.00000004.mdmp "HKLM\Software\Microsoft\Internet Explorer\Registration\DigitalProductID" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "System\CurrentControlSet\Services\Eventlog\Application\VSSetup" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\PCHealth\ErrorReporting\DW\Installed" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\VisualStudio\Setup" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Windows" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "Software\Microsoft\DevDiv" in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp "\SOFTWARE\Microsoft\DevDiv\vc\Servicing\10.0" in Source: 00000000-00002664.00000001.281287.00CA2000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002664.00000001.281287.736F1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004516.00000000.279828.004C0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "\Software\C4" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004516.00000001.281739.004C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004516.00000001.281739.04A10000.00000004.mdmp "e\Software\C" in Source: 00000000-00004516.00000001.281739.04A10000.00000004.mdmp4c:T1f33,"operabrowser-Copy.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa05470000 "operabrowser-Copy.exe" loaded module "SHELL32.DLL" at base 7ffa2e500000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa2a3e0000 "operabrowser-Copy.exe" loaded module "RPCRT4.DLL" at base 7ffa2d7a0000 "operabrowser-Copy.exe" loaded module "KERNEL32.DLL" at base 7ffa2eee0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 3ab0000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffa2ed10000 "operabrowser-Copy.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffa2dd00000 "operabrowser-Copy.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffa2dd00000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffa2e450000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffa2f7b0000 "operabrowser-Copy.exe" loaded module "URLMON.DLL" at base 7ffa1e400000 "operabrowser-Copy.exe" loaded module "USER32.DLL" at base 7ffa2dd00000 "operabrowser-Copy.exe" loaded module "SSPICLI.DLL" at base 7ffa2c050000 "operabrowser-Copy.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ffa0f8f0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffa0f8f0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa2c270000 "operabrowser-Copy.exe" loaded module "WINHTTP.DLL" at base 7ffa26470000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa24600000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa25420000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffa2bc70000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffa2a320000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffa2d520000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa2bd70000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffa1e6f0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa2d000000 "operabrowser-Copy.exe" loaded module "CRYPTNET.DLL" at base 7ffa1e6f0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffa2adb0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffa26a90000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffa18df0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffa1e400000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffa2d170000 "operabrowser-Copy.exe" loaded module "VIRTDISK.DLL" at base 7ffa18590000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffa2ac70000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffa137c0000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffa25e50000 "operabrowser-Copy.exe" loaded module "NTDLL.DLL" at base 7ffa2f990000 "operabrowser-Copy.exe" loaded module "KERNELBASE" at base 7ffa2d170000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffa2a240000 "operabrowser-Copy.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffa18be0000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa2d170000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa2d170000 "operabrowser-Copy.exe" loaded module "KERNEL32" at base 7ffa2eee0000 "operabrowser-Copy.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ffa2d170000 "operabrowser-Copy.exe" loaded module "MSVCR100.DLL" at base 67190000 "vcredist_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74560000 "vcredist_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748a0000 "vcredist_x64.exe" loaded module "COMCTL32.DLL" at base 74700000 "vcredist_x64.exe" loaded module "KERNEL32.DLL" at base 768f0000 "vcredist_x64.exe" loaded module "RPCRT4.DLL" at base 757b0000 "vcredist_x64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75a80000 "vcredist_x64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75a80000 "vcredist_x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75a80000 "vcredist_x64.exe" loaded module "KERNEL32" at base 768f0000 "vcredist_x64.exe" loaded module "%WINDIR%\SYSTEM32\CLUSAPI.DLL" at base 742e0000 "vcredist_x64.exe" loaded module "CSCAPI.DLL" at base 742b0000 "vcredist_x64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 743a0000 "vcredist_x64.exe" loaded module "ADVAPI32.DLL" at base 750e0000 "vcredist_x64.exe" loaded module "FECLIENT.DLL" at base 74350000 "vcredist_x64.exe" loaded module "NTDLL.DLL" at base 773a0000 "vcredist_x64.exe" loaded module "KERNELBASE" at base 75a80000 "vcredist_x64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 747a0000 "Setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74560000 "Setup.exe" loaded module "KERNEL32.DLL" at base 768f0000 "Setup.exe" loaded module "RPCRT4.DLL" at base 757b0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 748a0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 72dc0000 "Setup.exe" loaded module "COMCTL32.DLL" at base 74e20000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\KERNEL32.DLL" at base 768f0000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\VERSION.DLL" at base 75090000 "Setup.exe" loaded module "SETUPUI.DLL" at base 72ed0000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 72ce0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 72b80000 "Setup.exe" loaded module "C:\5C5053157117BFD8F7A456447D\1033\SETUPRESOURCES.DLL" at base 2bd0000 "Setup.exe" loaded module "RICHED20.DLL" at base 72e50000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 72ca0000 "Setup.exe" loaded module "PSAPI.DLL" at base 75a70000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 743a0000 "Setup.exe" loaded module "WINTRUST.DLL" at base 77170000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76ad0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75160000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72db0000 "Setup.exe" loaded module "OLE32.DLL" at base 75610000 "Setup.exe" loaded module "ADVAPI32.DLL" at base 750e0000 "Setup.exe" loaded module "CRYPT32.DLL" at base 76ad0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76e50000 "Setup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 770e0000 "Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 766e0000 "Setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 766e0000 "Setup.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 750e0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75610000 "Setup.exe" loaded module "SRPAPI.DLL" at base 72a20000 "Setup.exe" loaded module "NTDLL.DLL" at base 773a0000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\SHLWAPI.DLL" at base 75760000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\ADVAPI32.DLL" at base 750e0000 "Setup.exe" loaded module "COMCTL32" at base 74e20000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\OLE32.DLL" at base 75610000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\NETAPI32.DLL" at base 72a00000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\MSI.DLL" at base 73810000 "Setup.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 760400004d:T1314,"operabrowser-Copy.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "operabrowser-Copy.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "operabrowser-Copy.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "operabrowser-Copy.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "operabrowser-Copy.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "operabrowser-Copy.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "operabrowser-Copy.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "operabrowser-Copy.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "operabrowser-Copy.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "operabrowser-Copy.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "operabrowser-Copy.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "operabrowser-Copy.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "operabrowser-Copy.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "operabrowser-Copy.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "operabrowser-Copy.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "operabrowser-Copy.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "operabrowser-Copy.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "operabrowser-Copy.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Setup.exe" touched "XML DOM Document 3.0" (Path: "HKCU\WOW6432NODE\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}") "Setup.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\TREATAS") "Setup.exe" touched "XML Schema Cache 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A07-F192-11D4-A65F-0040963251E5}\TREATAS") "Setup.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\TREATAS") "Setup.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS")4e:Tab4,"operabrowser - Copy.exe" file has an entrypoint instructions - "push rdi,push rsi,push rbx,push rcx,push rdx,push r8,lea rax, [rip + 0x34f],mov rsi, qword ptr [rax],add rsi, rax,sub rax, rax,mov rdi, rsi,lodsw ax, word ptr [rsi],shl eax, 0xc,mov rcx, rax,push rax,lodsd eax, dword ptr [rsi],sub ecx, eax,add rsi, rcx,mov ecx, eax,push rdi,mov r8d, ecx,dec ecx,mov al, byte ptr [rcx + rdi + 6],mov byte ptr [rcx + rsi], al,jne 0x1400080f2,mov rcx, rdi,mov rdx, rsi,call 0x1400081ca,pop rsi,pop rdx,sub edx, 0x1000,sub ecx, ecx,cmp ecx, edx,jae 0x140008160,mov ebx, ecx,lodsb al, byte ptr [rsi],inc ecx,cmp al, 0xff,jne 0x14000812c,mov al, byte ptr [rsi],and al, 0xfd,cmp al, 0x15,jne 0x140008112," "SetupEngine.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1007b409,call 0x1007e928,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1007b2fe,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,pop ebp,jmp 0x1007c1ae,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x100ae210],jne 0x1007b43b,repz ret ,jmp 0x1007e9c8,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,push esi,mov esi, dword ptr [0x10001630],push edi,push dword ptr [0x100b96c8],call esi," "SetupUi.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100287b9,call 0x1002adc3,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100286ae,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,pop ebp,jmp 0x10028e46,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x1003f0a0],jne 0x100287eb,repz ret ,jmp 0x1002ae63,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,push esi,mov esi, dword ptr [0x10001400],push edi,push dword ptr [0x10044188],call esi," "Setup.exe" file has an entrypoint instructions - "call 0x403fa4,jmp 0x402a24,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x408050],jne 0x402baf,repz ret ,jmp 0x404044,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x402bf5,cmp dword ptr [eax + 0x10], 3,jne 0x402bf5,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x402bf0,cmp eax, 0x19930521,je 0x402bf0,cmp eax, 0x19930522,je 0x402bf0,cmp eax, 0x1994000,jne 0x402bf5,call 0x40414f,xor eax, eax,pop ebp," "SetupResources.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,"4f:T5b8,Process "vcredist_x64.exe" (UID: 00000000-00002360) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", USERDNSDOMAIN="K287xq91Nl0b24v", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "vcredist_x64.exe" (UID: 00000000-00002360) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "Setup.exe" (UID: 00000000-00002664) was launched with new environment variables: "_SFX_CAB_EXE_PATH="c:\5c5053157117bfd8f7a456447d", _SFX_CAB_EXE_PARAMETERS="/passive /norestart", _SFX_CAB_EXE_PACKAGE="C:\vcredist_x64.exe", PROCESSOR_ARCHITEW6432="AMD64", _SFX_CAB_SHUTDOWN_REQUEST="c:\5c5053157117bfd8f7a456447d\$shtdwn$.req"" Process "Setup.exe" (UID: 00000000-00002664) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msiexec.exe" (UID: 00000000-00007764) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, USERNAME, ProgramFiles, LOCALAPPDATA, USERDOMAIN, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "msiexec.exe" (UID: 00000000-00007764) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, _SFX_CAB_EXE_PATH, _SFX_CAB_EXE_PARAMETERS, _SFX_CAB_EXE_PACKAGE, USERDNSDOMAIN, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, HOMEPATH, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, OneDrive, _SFX_CAB_SHUTDOWN_REQUEST, HOMEDRIVE"50:T47a,Observed system executable string:"%WINDIR%\system32\clusapi.dll" [Source: 00000000-00002360-00000C2B-2846276981] Observed system executable string:"%WINDIR%\SysWOW64\KERNEL32.DLL" [Source: 00000000-00002664-00000C2B-2849997381] Observed system executable string:"%WINDIR%\SysWOW64\VERSION.DLL" [Source: 00000000-00002664-00000C2B-2850070910] Observed system executable string:"%WINDIR%\system32\MSI.dll" [Source: 00000000-00002664-00000C2B-2850113943] Observed system executable string:"%WINDIR%\SysWOW64\TSAPPCMP.DLL" [Source: 00000000-00002664-00000C2B-2857684074] Observed system executable string:"%WINDIR%\SysWOW64\SHLWAPI.DLL" [Source: 00000000-00002664-00000C2B-2857797531] Observed system executable string:"%WINDIR%\SysWOW64\ADVAPI32.DLL" [Source: 00000000-00002664-00000C2B-2857872803] Observed system executable string:"%WINDIR%\SysWOW64\OLE32.DLL" [Source: 00000000-00002664-00000C2B-2858033274] Observed system executable string:"%WINDIR%\SysWOW64\NETAPI32.DLL" [Source: 00000000-00002664-00000C2B-2858115158] Observed system executable string:"%WINDIR%\SysWOW64\SHELL32.DLL" [Source: 00000000-00002664-00000C2B-2863119677]51:T484,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "operabrowser - Copy.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "::LoadLibrary(%s) failed with error %d" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")52:T3922,"vcredist_x64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- Location: [C:\vcredist_x64.exe]- [targetUID: 00000000-00004516] "msp_kb2565063.msp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.0 Code page: 1252 Title: KB2565063 Subject: Hotfix for Microsoft Visual Studio 2010 - KB2565063 Author: Microsoft Comments: KB2565063 Template: {1D8E6291-B0D5-35EC-8441-6616F567A0F7} Last Saved By: :SP1.1;:#SP1.1 Revision Number: {C67045D4-F4DE-3AB5-B2DB-E3F5DAC14D9C} Create Time/Date: Wed Jun 29 04:18:40 2011 Last Saved Time/Date: Wed Jun 29 04:18:40 2011 Number of Words: 5 Name of Creating Application: Windows Installer XML (3.5.0626.3) Security: 4"- Location: [C:\5c5053157117bfd8f7a456447d\msp_kb2565063.msp]- [targetUID: 00000000-00002360] "SetupEngine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupEngine.dll]- [targetUID: 00000000-00002360] "Microsoft Visual C_ 2010 x64 Redistributable Setup_20261030_180836634-MSI_vc_red.msi.txt" has type "Unknown"- [targetUID: N/A] "SetupUi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupUi.dll]- [targetUID: 00000000-00002360] "vc_red.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.0 MSI Installer Code page: 1252 Title: Installation Database Subject: Visual C++ 2010 x64 Redistributable Author: Microsoft Corporation Keywords: Installer Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219. Template: x64;0 Revision Number: {80902F2D-E1EF-43CA-B366-74496197E004} Create Time/Date: Sun Feb 20 06:51:54 2011 Last Saved Time/Date: Sun Feb 20 06:51:54 2011 Number of Pages: 200 Name of Creating Application: Windows Installer XML (3.5.0626.3) Security: 2 Number of Words: 2"- Location: [C:\5c5053157117bfd8f7a456447d\vc_red.msi]- [targetUID: 00000000-00002360] "Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\Setup.exe]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1031\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1036\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\3082\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1049\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1040\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1033\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1041\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1042\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1028\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\2052\SetupResources.dll]- [targetUID: 00000000-00002360] "vc_red.cab" has type "Microsoft Cabinet archive data many 4872031 bytes 19 files at 0x44 last modified Feb 19 2011 22:51:56 +A "F_CENTRAL_atl100_x64" last modified Feb 19 2011 22:51:56 +A "F_CENTRAL_mfc100_x64" flags 0x4 number 1 extra bytes 20 in head 444 datablocks 0x1503 compression"- Location: [C:\5c5053157117bfd8f7a456447d\vc_red.cab]- [targetUID: 00000000-00002360] "watermark.bmp" has type "PC bitmap Windows 3.x format 164 x 628 x 24 image size 308978 resolution 2834 x 2834 px/m cbSize 309032 bits offset 54"- Location: [C:\5c5053157117bfd8f7a456447d\watermark.bmp]- [targetUID: 00000000-00002360] "Microsoft Visual C_ 2010 x64 Redistributable Setup_20261030_180836634.html" has type "Unknown"- [targetUID: N/A] "DisplayIcon.ico" has type "MS Windows icon resource - 13 icons 16x16 16 colors 4 bits/pixel 16x16 8 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\DisplayIcon.ico]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (615) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1031\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (619) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1036\LocalizedData.xml]- [targetUID: 00000000-00002360] "SplashScreen.bmp" has type "PC bitmap Windows 3.x format 200 x 200 x 8 image size 40000 resolution 3779 x 3779 px/m cbSize 41078 bits offset 1078"- Location: [C:\5c5053157117bfd8f7a456447d\SplashScreen.bmp]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (616) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\3082\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (634) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1049\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (601) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1040\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (565) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1033\LocalizedData.xml]- [targetUID: 00000000-00002360] "Setup.ico" has type "MS Windows icon resource - 12 icons 16x16 16 colors 4 bits/pixel 16x16 8 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Setup.ico]- [targetUID: 00000000-00002360] "UiInfo.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\UiInfo.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (440) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1041\LocalizedData.xml]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1042\eula.rtf]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (439) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1042\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (390) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\2052\LocalizedData.xml]- [targetUID: 00000000-00002360] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (388) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\1028\LocalizedData.xml]- [targetUID: 00000000-00002360] "SetupUi.xsd" has type "XML 1.0 document ASCII text with very long lines (335) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\SetupUi.xsd]- [targetUID: 00000000-00002360] "Setup_20261030_180834962.html" has type "HTML document Unicode text UTF-16 little-endian text with very long lines (323) with CRLF line terminators"- Location: [%TEMP%\Setup_20261030_180834962.html]- [targetUID: 00000000-00002664] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1049\eula.rtf]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1041\eula.rtf]- [targetUID: 00000000-00002360] "ParameterInfo.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (314) with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\ParameterInfo.xml]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1028\eula.rtf]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\2052\eula.rtf]- [targetUID: 00000000-00002360] "DHtmlHeader.html" has type "HTML document Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\DHtmlHeader.html]- [targetUID: 00000000-00002360] "Strings.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\5c5053157117bfd8f7a456447d\Strings.xml]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1031\eula.rtf]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\3082\eula.rtf]- [targetUID: 00000000-00002360] "stop.ico" has type "MS Windows icon resource - 6 icons 32x32 16 colors 4 bits/pixel 16x16 16 colors 4 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\stop.ico]- [targetUID: 00000000-00002360] "warn.ico" has type "MS Windows icon resource - 6 icons 32x32 16 colors 4 bits/pixel 16x16 16 colors 4 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\warn.ico]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1040\eula.rtf]- [targetUID: 00000000-00002360] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1036\eula.rtf]- [targetUID: 00000000-00002360] "HFIDEAB.tmp.html" has type "data"- Location: [%TEMP%\HFIDEAB.tmp.html]- [targetUID: 00000000-00002664] "eula.rtf" has type "Rich Text Format data version 1 ANSI code page 1252 default language ID 1033"- Location: [C:\5c5053157117bfd8f7a456447d\1033\eula.rtf]- [targetUID: 00000000-00002360] "header.bmp" has type "PC bitmap Windows 3.x format 49 x 49 x 24 image size 7254 resolution 2834 x 2834 px/m cbSize 7308 bits offset 54"- Location: [C:\5c5053157117bfd8f7a456447d\header.bmp]- [targetUID: 00000000-00002360] "SysReqNotMet.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\SysReqNotMet.ico]- [targetUID: 00000000-00002360] "Print.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Print.ico]- [targetUID: 00000000-00002360] "SysReqMet.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\SysReqMet.ico]- [targetUID: 00000000-00002360] "Save.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Save.ico]- [targetUID: 00000000-00002360] "Rotate2.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate2.ico]- [targetUID: 00000000-00002360] "Rotate6.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate6.ico]- [targetUID: 00000000-00002360] "Rotate8.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate8.ico]- [targetUID: 00000000-00002360] "Rotate5.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate5.ico]- [targetUID: 00000000-00002360] "Rotate7.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate7.ico]- [targetUID: 00000000-00002360] "Rotate1.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate1.ico]- [targetUID: 00000000-00002360] "Rotate3.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate3.ico]- [targetUID: 00000000-00002360] "Rotate4.ico" has type "MS Windows icon resource - 1 icon 16x16 24 bits/pixel"- Location: [C:\5c5053157117bfd8f7a456447d\Graphics\Rotate4.ico]- [targetUID: 00000000-00002360] "_shtdwn_.req" has type "Unknown"- [targetUID: N/A] "05B9405734A3667848206D6F14B66DB1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\05B9405734A3667848206D6F14B66DB1]- [targetUID: 00000000-00004516] "05B9405734A3667848206D6F14B66DB1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\05B9405734A3667848206D6F14B66DB1]- [targetUID: 00000000-00004516] "HFID3EA.tmp.html" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\HFID3EA.tmp.html]- [targetUID: 00000000-00002664] "vcredist_x64_1_.exe" has type "Unknown"- [targetUID: N/A]53:Tae0,"LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (615) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1031\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (619) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1036\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (616) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\3082\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (634) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1049\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (601) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1040\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (565) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1033\LocalizedData.xml] "UiInfo.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\UiInfo.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (440) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1041\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (439) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1042\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (390) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\2052\LocalizedData.xml] "LocalizedData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (388) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\1028\LocalizedData.xml] "SetupUi.xsd" has type "XML 1.0 document ASCII text with very long lines (335) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\SetupUi.xsd] "ParameterInfo.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (314) with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\ParameterInfo.xml] "Strings.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators" - Location: [C:\5c5053157117bfd8f7a456447d\Strings.xml]54:Tb81,"operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")55:T910,"SetupEngine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupEngine.dll]- [targetUID: 00000000-00002360] "SetupUi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupUi.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1031\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1036\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\3082\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1049\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1040\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1033\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1041\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1042\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1028\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\2052\SetupResources.dll]- [targetUID: 00000000-00002360]56:T1023,"operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")57:T4a9,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API)58:T40e,"operabrowser-Copy.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "operabrowser-Copy.exe" trying to touch file "C:\operabrowser-Copy.exe" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "operabrowser-Copy.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "operabrowser-Copy.exe" trying to touch file "C:\WINHTTP.dll" "operabrowser-Copy.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WINHTTP.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\winhttp.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "operabrowser-Copy.exe" trying to touch file "C:\Windows\System32\sechost.dll"59:T7bb,"operabrowser-Copy.exe" trying to access non-existent file "C:\WINHTTP.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\FLTLIB.DLL" "operabrowser-Copy.exe" trying to access non-existent file "C:\MSVCP140.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "operabrowser-Copy.exe" trying to access non-existent file "C:\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\system\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\system32\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\WINDOWS\System32\OpenSSH\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\nvm\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\Program Files\nodejs\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\MSVCR100.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\TextShaping.dll" "operabrowser-Copy.exe" trying to access non-existent file "C:\CRYPTBASE.DLL"5a:T6c0,"operabrowser-Copy.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "operabrowser-Copy.exe" trying to access non-existent file "\Device\RasAcd" "operabrowser-Copy.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05B9405734A3667848206D6F14B66DB1" "operabrowser-Copy.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "operabrowser-Copy.exe" trying to access non-existent file "C:\Users\etb4mi8\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG" "operabrowser-Copy.exe" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "operabrowser-Copy.exe" trying to access non-existent file "C:\vcredist_x64.exe:Zone.Identifier" "vcredist_x64.exe" trying to access non-existent file "C:\vcredist_x64.exe.Local\" "vcredist_x64.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "vcredist_x64.exe" trying to access non-existent file "C:\5c5053157117bfd8f7a456447d\ParameterInfo.xml" "vcredist_x64.exe" trying to access non-existent file "C:\5c5053157117bfd8f7a456447d\UiInfo.xml" "Setup.exe" trying to access non-existent file "c:\5c5053157117bfd8f7a456447d\1033\DHTMLHeader.html" "Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Setup.exe" trying to access non-existent file "c:\5c5053157117bfd8f7a456447d\Setup.exe.Local\" "Setup.exe" trying to access non-existent file "C:\Windows\SystemResources\msi.dll.mun"5b:T15be,Pattern match: "crl.microsoft.com/pki/crl/products/codesigpca.crl0ma0?0=1http://www.microsoft.com/pki/certs/codesigpca.crt09xoo6`{fqwashington1redmond1microsoft" Pattern match: "crl.microsoft.com/pki/crl/products/cspca.crl0h" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "www.microsoft.com/exporting}}{\fldrslt{\ul\cf1" Pattern match: "www.microsoft.com/japan/exporting}}{\fldrslt{\ul\cf1" Pattern match: "http://www.microsoft.com/exporting" Pattern match: "download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exe" Pattern match: "www.microsoft.com" Pattern match: "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exe" Heuristic match: ";.jse;.wsf;.ws" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://support.microsoft.com/kb/2524860.kb2524860.arp.displaynamedisplaynamehotfix" Pattern match: "http://support.microsoft.com/kb/2544655.kb2544655.arp.displaynamehotfix" Pattern match: "http://support.microsoft.com/kb/2549743.kb2549743.arp.displaynamehotfix" Pattern match: "http://support.microsoft.com/kb/2565063.kb2565063.arp.displaynamehotfix" Pattern match: "www.microsoft.com/msipatchsequenc@h" Pattern match: "http://www.microsoft.com/pki/certs/cspca.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/tspca.crl0h" Pattern match: "http://www.microsoft.com/pki/certs/tspca.crt0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=146008" Pattern match: "http://go.microsoft.com/fwlink/?linkid=168641&clcid=0x409" Pattern match: "http://support.microsoft.com/?kbid=893803" Pattern match: "http://www.microsoft.com/msi/patch_applicability.xsd" Pattern match: "http://schemas.microsoft.com/setup/2008/01/im" Pattern match: "http://www.update.microsoft.com/" Pattern match: "http://schemas.microsoft.com/setupui/2008/01/imui" Pattern match: "http://sqm.microsoft.com/sqm/vstudio/sqmserver.dll" Pattern match: "http://www.microsoft.com" Heuristic match: "xe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0p" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0" Pattern match: "crl.microsoft.com/pki/crl/pro" Heuristic match: "ft.com" Pattern match: "http://www.microso" Pattern match: "oft.com/pki/crl/products/tspca.crl0h" Heuristic match: "12671.dscd.akamaiedge.net" Heuristic match: "yugothl.th" Heuristic match: "icrosoft.com" Heuristic match: "ttps://login.live.com" Heuristic match: "e13678.dscb.akamaiedge.net" Pattern match: "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl" Pattern match: "www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Heuristic match: "rosoft.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"5c:T5126,Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0dlywh\%" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://www.microsoft.com0[qjv20210511202945.369z0washington1redmond1microsoft" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0p'.1owashington1redmond1microsoft" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2524860.kb2524860.arp.displaynamedisplaynamehotfix" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2524860kb2524860.arp.nomodifynomodifykb2524860.arp.norepairnorepairkb2524860.arp.parentdisplaynameparentdisplayname[locproductname]kb2524860.arp.parentkeynameparentkeyname[productname]kb2524860.arp.publisherpublisher[manufacturer]kb2524860.arp.registrylocationregistrylocationhkey_local_machine\software\microsoft\updates\[productname]\sp1\kb2524860kb2524860.arp.uninstallstringuninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.comkb2524860.se.arplinkarplinkhkey_local_machine\software\microsoft\windows\currentversion\uninstall\[productcode].kb2524860kb2524860.se.installedbyinstalledby" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2544655.kb2544655.arp.displaynamehotfix" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2544655kb2544655.arp.nomodifykb2544655.arp.norepairkb2544655.arp.parentdisplaynamekb2544655.arp.parentkeynamekb2544655.arp.publisherkb2544655.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\kb2544655kb2544655.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2549743.kb2549743.arp.displaynamehotfix" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2549743kb2549743.arp.nomodifykb2549743.arp.norepairkb2549743.arp.parentdisplaynamekb2549743.arp.parentkeynamekb2549743.arp.publisherkb2549743.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\kb2549743kb2549743.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2565063.kb2565063.arp.displaynamehotfix" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2565063kb2565063.arp.nomodifykb2565063.arp.norepairkb2565063.arp.parentdisplaynamekb2565063.arp.parentkeynamekb2565063.arp.publisherkb2565063.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\sp1\kb2565063kb2565063.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://www.microsoft.com/msipatchsequenc@h?;@h??weldj>@h??weldj;epatchfamilyproductcodesequenceattributesarp.current10.0.40219.325qfe.detection.kb2565063sp_prosp_lpsp_vcarppf_vcredist_x64_detectionpf_vc_vs_libraries_core_x64_detectionpf_vc_vs_libraries_extended_x64_detectionpf_vcredist_servicing_key_productchiplanguagepf_vcredist_servicing_key_producteditionpf_vcredist_servicing_key_productlanguagepf_atl_central_x64pf_crt_central_x64pf_debugcrt_central_x64pf_mfc_central_x64pf_debugmfc_central_x64pf_mfcloc_central_x64pf_openmp_debug_central_x64pf_openmp_central_x64y0w020!0" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0ga7<^u!caf6" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://microsoft.com08sanfnki&b" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@enwashington1redmond1microsoft" - Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0dlywh\%" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://www.microsoft.com0[qjv20210511202945.369z0washington1redmond1microsoft" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0p'.1owashington1redmond1microsoft" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2524860.kb2524860.arp.displaynamedisplaynamehotfix" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2524860kb2524860.arp.nomodifynomodifykb2524860.arp.norepairnorepairkb2524860.arp.parentdisplaynameparentdisplayname[locproductname]kb2524860.arp.parentkeynameparentkeyname[productname]kb2524860.arp.publisherpublisher[manufacturer]kb2524860.arp.registrylocationregistrylocationhkey_local_machine\software\microsoft\updates\[productname]\sp1\kb2524860kb2524860.arp.uninstallstringuninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.comkb2524860.se.arplinkarplinkhkey_local_machine\software\microsoft\windows\currentversion\uninstall\[productcode].kb2524860kb2524860.se.installedbyinstalledby" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2544655.kb2544655.arp.displaynamehotfix" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2544655kb2544655.arp.nomodifykb2544655.arp.norepairkb2544655.arp.parentdisplaynamekb2544655.arp.parentkeynamekb2544655.arp.publisherkb2544655.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\kb2544655kb2544655.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2549743.kb2549743.arp.displaynamehotfix" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2549743kb2549743.arp.nomodifykb2549743.arp.norepairkb2549743.arp.parentdisplaynamekb2549743.arp.parentkeynamekb2549743.arp.publisherkb2549743.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\kb2549743kb2549743.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2565063.kb2565063.arp.displaynamehotfix" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/2565063kb2565063.arp.nomodifykb2565063.arp.norepairkb2565063.arp.parentdisplaynamekb2565063.arp.parentkeynamekb2565063.arp.publisherkb2565063.arp.registrylocationhkey_local_machine\software\microsoft\updates\[productname]\sp1\kb2565063kb2565063.arp.uninstallstring[systemfolder]msiexec.exe" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://www.microsoft.com/msipatchsequenc@h?;@h??weldj>@h??weldj;epatchfamilyproductcodesequenceattributesarp.current10.0.40219.325qfe.detection.kb2565063sp_prosp_lpsp_vcarppf_vcredist_x64_detectionpf_vc_vs_libraries_core_x64_detectionpf_vc_vs_libraries_extended_x64_detectionpf_vcredist_servicing_key_productchiplanguagepf_vcredist_servicing_key_producteditionpf_vcredist_servicing_key_productlanguagepf_atl_central_x64pf_crt_central_x64pf_debugcrt_central_x64pf_mfc_central_x64pf_debugmfc_central_x64pf_mfcloc_central_x64pf_openmp_debug_central_x64pf_openmp_central_x64y0w020!0" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0ga7<^u!caf6" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://microsoft.com08sanfnki&b" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@enwashington1redmond1microsoft" - Source: "00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=146008" - Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=168641&clcid=0x409" - Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found URL "http://support.microsoft.com/?kbid=893803" - Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found URL "http://www.microsoft.com/msi/patch_applicability.xsd" - Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found URL "http://sqm.microsoft.com/sqm/vstudio/sqmserver.dllassignmenttypemsiproductversionversionstring" - Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found URL "http://www.microsoft.comunable" - Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=146008" - Source: "00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=168641&clcid=0x409" - Source: "00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found URL "http://support.microsoft.com/?kbid=893803" - Source: "00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=146008" - Source: "00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=168641&clcid=0x409" - Source: "00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found URL "http://www.update.microsoft.com/" - Source: "00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found URL "http://oca.microsoft.com/" - Source: "00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8joc/" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@eng" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0ga7<^u!caf6" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt" - Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found URL "http://www.microsoki/certs/cspca.crt0ga7<^u!cafion1!0microsoft" - Source: "00000000-00002664.00000001.281287.00F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@enwashington1redmond1microsoft" - Source: "00000000-00002664.00000001.281287.00F40000.00000004.mdmp") Found URL "http://microsoft.com08sanfnki&b" - Source: "00000000-00002664.00000001.281287.00F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exenox\!47o!ntdll.dll" - Source: "00000000-00004516.00000000.279828.40001000.00000040.mdmp") Found URL "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crlile:///c:/users/etb4mi8/appdata/local/microsoft/windows/inetcache/ie/6ldiekeg/vcredist_x64[1].exes" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crlisallowedcert_autoupdate_1subcamicrosoftisallowedcert_autoupdate_1subcarogram[.shellclassinfolocalizedresourcename@%systemroot%\system32\shell32.dll,-21779infotip@%systemroot%\system32\shell32.dll,-12688iconresource%systemroot%\system32\imageres.dll,-113iconfile%systemroot%\system32\shell32.dlliconindex-236:\vcredist_x64.exe//www.microsoft.commitmproxy-487007270818109937193375387014449110337186509494.crl\system32\wuaueng.dll,-400lemainthreadwndclasssctfime" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0p'.1owashington1redmond1microsoft" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0giae$kkby" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0giaeadddp" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0dlywh\%" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com0[qjv20210511202945.369z0washington1redmond1microsoft" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0giae120531151137z0/^g(o-cejy" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp")5d:T4b4,Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string "+ncalrpc:[OLE40F0B1990297F8AB020EEFF364D9]" (Indicator: "ncalrpc"; Source: "00000000-00002664.00000001.281287.00C8A000.00000004.mdmp") Found string "+ncalrpc:[OLE0BDFF3C8A5BBB71C86A93417C18C]" (Indicator: "ncalrpc"; Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found string "+ncalrpc:[OLE570F05251B396690A8D5C56A0E9D]" (Indicator: "ncalrpc"; Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found string "+ncalrpc:[OLE6FA0A56D0CD4037C40E80F07B76E]" (Indicator: "ncalrpc"; Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found string "+ncalrpc:[OLEA0CEED71BB8ECBE32229C668622B]" (Indicator: "ncalrpc"; Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp")5e:T7fe,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "operabrowser - Copy.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")5f:T8a7,file/memory contains long string with (Indicator: "aes"; File: "eula.rtf") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002664.00000001.281287.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C8A000.00000004.mdmp, 00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002664.00000001.281287.00CA2000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp, 00000000-00004516.00000001.281739.04A10000.00000004.mdmp") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004516.00000001.281739.004C0000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05010000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05010000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05010000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05010000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05060000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05060000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05060000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004516.00000001.281739.05060000.00000002.mdmp")60:T470,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "operabrowser - Copy.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "operabrowser - Copy.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")61:Tf23,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "operabrowser - Copy.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "operabrowser - Copy.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "operabrowser - Copy.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "operabrowser - Copy.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "operabrowser - Copy.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "operabrowser - Copy.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "operabrowser - Copy.exe") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "operabrowser - Copy.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "operabrowser - Copy.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "operabrowser - Copy.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "operabrowser - Copy.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "Failed to get a temp file name. GetTempFileName call failed with 0x%x" (Indicator: "GetTempFileName"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")62:T962,"For more information, visit http://support.microsoft.com/kb/2544655.KB2544655.ARP.DisplayNameHotfix for [LocProductName] (KB2544655)KB2544655.ARP.DisplayVersionKB2544655.ARP.HelpLinkhttp://support.microsoft.com/kb/2544655KB2544655.ARP.NoModifyKB2544655.ARP.NoRepairKB2544655.ARP.ParentDisplayNameKB2544655.ARP.ParentKeyNameKB2544655.ARP.PublisherKB2544655.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2544655KB2544655.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2544655.PatchCode] /qb+ REBOOTPROMPT=""KB2544655.ARP.URLInfoAboutKB2544655.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2544655KB2544655.SE.InstalledByKB2544655.SE.InstalledDateKB2544655.SE.InstallerNameKB2544655.SE.InstallerVersionKB2544655.SE.PackageNameKB2544655.SE.PackageVersionKB2544655.SE.PublisherKB2544655.SE.PublishingGroupKB2544655.SE.ReleaseTypeKB2549743.ARP.CommentsThis hotfix is for [LocProductName]." (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp 00000000-00002360.00000001.281295.00610000.00000004.mdmp "For more information, visit http://support.microsoft.com/kb/2549743.KB2549743.ARP.DisplayNameHotfix for [LocProductName] (KB2549743)KB2549743.ARP.DisplayVersionKB2549743.ARP.HelpLinkhttp://support.microsoft.com/kb/2549743KB2549743.ARP.NoModifyKB2549743.ARP.NoRepairKB2549743.ARP.ParentDisplayNameKB2549743.ARP.ParentKeyNameKB2549743.ARP.PublisherKB2549743.ARP.RegistryLocationHKEY_LOCAL_MACHINE\Software\Microsoft\Updates\[ProductName]\KB2549743KB2549743.ARP.UninstallString[SystemFolder]msiexec.exe /package [ProductCode] /uninstall [KB2549743.PatchCode] /qb+ REBOOTPROMPT=""KB2549743.ARP.URLInfoAboutKB2549743.SE.ARPLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode].KB2549743KB2549743.SE.InstalledByKB2549743.SE.InstalledDateKB2549743.SE.InstallerNameKB2549743.SE.InstallerVersionKB2549743.SE.PackageNameKB2549743.SE.PackageVersionKB2549743.SE.PublisherKB2549743.SE.PublishingGroupKB2549743.SE.ReleaseTypeKB2565063.ARP.CommentsThis hotfix is for [LocProductName]." (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002360.00000000.280407.00610000.00000004.mdmp 00000000-00002360.00000001.281295.00610000.00000004.mdmp63:Tecf,Found string "\Device\HarddiskVolume3\5c5053157117bfd8f7a456447d\Setup.exe" (Indicator: "\Device\"; Source: "00000000-00002360-00000BC0-2847197684") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000000.280407.00850000.00000004.mdmp, 00000000-00002360.00000000.280407.00CF0000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00850000.00000004.mdmp, 00000000-00002360.00000001.281295.00CF0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000000.280407.00850000.00000004.mdmp, 00000000-00002360.00000000.280407.00CF0000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00850000.00000004.mdmp, 00000000-00002360.00000001.281295.00CF0000.00000004.mdmp") Found string "ws\System32\Drivers\DriverDB" (Indicator: "\drivers\"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string "ws\System32\Drivers\DriverDB" (Indicator: "system32\drivers"; Source: "00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000000.280541.00D80000.00000004.mdmp, 00000000-00002664.00000000.280541.00F40000.00000004.mdmp, 00000000-00002664.00000000.280541.033A0000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00D80000.00000004.mdmp, 00000000-00002664.00000001.281287.00F40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000000.280541.00D80000.00000004.mdmp, 00000000-00002664.00000000.280541.00F40000.00000004.mdmp, 00000000-00002664.00000000.280541.033A0000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00D80000.00000004.mdmp, 00000000-00002664.00000001.281287.00F40000.00000004.mdmp") Found string "\Device\HarddiskVolume3\5c5053157117bfd8f7a456447d\SetupEngine.dll" (Indicator: "\Device\"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\explorer.exe" (Indicator: "\Device\"; Source: "00000000-00002664.00000000.280541.00C10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004516.00000000.279828.004C0000.00000004.mdmp, 00000000-00004516.00000000.279828.008B0000.00000004.mdmp, 00000000-00004516.00000001.281739.004C0000.00000004.mdmp, 00000000-00004516.00000001.281739.008B0000.00000004.mdmp, 00000000-00004516.00000001.281739.05530000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004516.00000000.279828.004C0000.00000004.mdmp, 00000000-00004516.00000000.279828.008B0000.00000004.mdmp, 00000000-00004516.00000001.281739.004C0000.00000004.mdmp, 00000000-00004516.00000001.281739.008B0000.00000004.mdmp, 00000000-00004516.00000001.281739.05530000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004516.00000001.281739.04A10000.00000004.mdmp")64:T409,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "operabrowser - Copy.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp") Found reference to API "oNotDeleteFileAfterUpload" (Indicator: "DeleteFile"; Source: "00000000-00002664.00000001.281287.736F1000.00000020.mdmp")65:Tcbd,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "operabrowser - Copy.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "operabrowser - Copy.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "operabrowser - Copy.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "operabrowser - Copy.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "operabrowser - Copy.exe") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "operabrowser - Copy.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "operabrowser - Copy.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "operabrowser - Copy.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "operabrowser - Copy.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "operabrowser - Copy.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "operabrowser - Copy.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp")66:T5da,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp")67:Tec8,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: SetupEngine.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: SetupEngine.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: SetupEngine.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: SetupEngine.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: SetupEngine.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: SetupEngine.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: SetupEngine.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: SetupEngine.dll] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: SetupEngine.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: SetupEngine.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: SetupEngine.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: SetupEngine.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: SetupEngine.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: SetupEngine.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: SetupEngine.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: SetupEngine.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: SetupEngine.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: SetupEngine.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: SetupUi.dll]68:T7e7,"operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "operabrowser-Copy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")69:T19df,"operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "operabrowser-Copy.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\VSSETUP"; Key: "EVENTMESSAGEFILE"; Value: "c:\5c5053157117bfd8f7a456447d\DW\DW20.exe") "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\VSSETUP"; Key: "TYPESSUPPORTED"; Value: "0700000000") "Setup.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "A91900000000000004000400010019020200000000B31C0200F76A010152B6010212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023900060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000")6a:T92b,Found reference to API "InitiateSystemShutdownExA" (Indicator: "InitiateSystemShutdown"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdown() Failed with error 0x%lx" (Indicator: "InitiateSystemShutdown"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "ShutdownSystem: Failed" (Indicator: "ShutdownSystem"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdownA" (Indicator: "InitiateSystemShutdown"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; File: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdownW" (Indicator: "InitiateSystemShutdown"; File: "operabrowser - Copy.exe") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; File: "operabrowser - Copy.exe") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "operabrowser - Copy.exe") Found reference to API "ShutdownSystem: Failed" (Indicator: "ShutdownSystem"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdown() Failed with error 0x%lx" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdownExA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdownA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00002360.00000000.280407.01002000.00000020.mdmp") Found reference to API "InitiateSystemShutdownW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002664.00000000.280541.73AD1000.00000020.mdmp")6b:Ta5d,"vcredist_x64.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- Location: [C:\vcredist_x64.exe]- [targetUID: 00000000-00004516] "SetupEngine.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupEngine.dll]- [targetUID: 00000000-00002360] "SetupUi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\SetupUi.dll]- [targetUID: 00000000-00002360] "Setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [C:\5c5053157117bfd8f7a456447d\Setup.exe]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1031\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1036\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\3082\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1049\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1040\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1033\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1041\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1042\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\1028\SetupResources.dll]- [targetUID: 00000000-00002360] "SetupResources.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 2 sections"- Location: [C:\5c5053157117bfd8f7a456447d\2052\SetupResources.dll]- [targetUID: 00000000-00002360]6c:T18b9,"operabrowser-Copy.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\vcredist_x64[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "operabrowser-Copy.exe" wrote 49152 bytes starting with PE header signature to file "C:\vcredist_x64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 16574 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\Setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 3958 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\SetupEngine.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 14878 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\SetupUi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 17190 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\sqmapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 9437 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1033\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 11653 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1041\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 3604 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1042\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 13656 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1028\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 13656 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\2052\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 17752 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1040\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 18264 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1036\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 18264 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1031\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 18264 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\3082\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vcredist_x64.exe" wrote 15918 bytes starting with PE header signature to file "C:\5c5053157117bfd8f7a456447d\1049\SetupResources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6d:T9a4,"operabrowser-Copy.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\vcredist_x64[1].exe" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\msp_kb2565063.msp" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\vc_red.msi" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\vc_red.cab" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\UiInfo.xml" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\ParameterInfo.xml" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\warn.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\stop.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\SysReqNotMet.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\SysReqMet.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Setup.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Save.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate8.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate7.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate6.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate5.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate4.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate3.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate2.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Rotate1.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\Graphics\Print.ico" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\1049\eula.rtf" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\1049\LocalizedData.xml" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\1049\SetupResources.dll" with delete access "vcredist_x64.exe" opened "C:\5c5053157117bfd8f7a456447d\3082\eula.rtf" with delete access1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793409055835,"unified_at":"2026-10-31T01:10:55.835Z","metadata":{"hashes":{"sha256":"3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","sha1":"da0296b83d795519f98eb0da91cb8c56594ae665","md5":"c1346f6f0f44b1a8f74969665ae5fc2c","sha512":"2f38938caafad4d89780c54c2f42e93609ef55c8730c85c3dd9a59689b431fdd3d17e155e59a027b69071619be6ff4a8e01fa2e4264c157bcab2f23628bbcb79","ssdeep":"192:gOwDqVVNa0LNHmQxIvAHz4NHaZ4cJ3huGZBSIoKNIoaHBVudKuyvkFxAZPpM8U:gOTFQgT4MhcI5gBVudZypBpM8U","ssdeep_chunks":["192:gOwDqVV","192:OwDqVVN","192:wDqVVNa","192:DqVVNa0","192:qVVNa0L","192:VVNa0LN","192:VNa0LNH","192:Na0LNHm","192:a0LNHmQ","192:0LNHmQx","192:LNHmQxI","192:NHmQxIv","192:HmQxIvA","192:mQxIvAH","192:QxIvAHz","192:xIvAHz4","192:IvAHz4N","192:vAHz4NH","192:AHz4NHa","192:Hz4NHaZ","192:z4NHaZ4","192:4NHaZ4c","192:NHaZ4cJ","192:HaZ4cJ3","192:aZ4cJ3h","192:Z4cJ3hu","192:4cJ3huG","192:cJ3huGZ","192:J3huGZB","192:3huGZBS","192:huGZBSI","192:uGZBSIo","192:GZBSIoK","192:ZBSIoKN","192:BSIoKNI","192:SIoKNIo","192:IoKNIoa","192:oKNIoaH","192:KNIoaHB","192:NIoaHBV","192:IoaHBVu","192:oaHBVud","192:aHBVudK","192:HBVudKu","192:BVudKuy","192:VudKuyv","192:udKuyvk","192:dKuyvkF","192:KuyvkFx","192:uyvkFxA","192:yvkFxAZ","192:vkFxAZP","192:kFxAZPp","192:FxAZPpM","192:xAZPpM8","192:AZPpM8U","384:gOwDqVV","384:OwDqVVN","384:wDqVVNa","384:DqVVNa0","384:qVVNa0L","384:VVNa0LN","384:VNa0LNH","384:Na0LNHm","384:a0LNHmQ","384:0LNHmQx","384:LNHmQxI","384:NHmQxIv","384:HmQxIvA","384:mQxIvAH","384:QxIvAHz","384:xIvAHz4","384:IvAHz4N","384:vAHz4NH","384:AHz4NHa","384:Hz4NHaZ","384:z4NHaZ4","384:4NHaZ4c","384:NHaZ4cJ","384:HaZ4cJ3","384:aZ4cJ3h","384:Z4cJ3hu","384:4cJ3huG","384:cJ3huGZ","384:J3huGZB","384:3huGZBS","384:huGZBSI","384:uGZBSIo","384:GZBSIoK","384:ZBSIoKN","384:BSIoKNI","384:SIoKNIo","384:IoKNIoa","384:oKNIoaH","384:KNIoaHB","384:NIoaHBV","384:IoaHBVu","384:oaHBVud","384:aHBVudK","384:HBVudKu","384:BVudKuy","384:VudKuyv","384:udKuyvk","384:dKuyvkF","384:KuyvkFx","384:uyvkFxA","384:yvkFxAZ","384:vkFxAZP","384:kFxAZPp","384:FxAZPpM","384:xAZPpM8","384:AZPpM8U","192:gOTFQgT","192:OTFQgT4","192:TFQgT4M","192:FQgT4Mh","192:QgT4Mhc","192:gT4MhcI","192:T4MhcI5","192:4MhcI5g","192:MhcI5gB","192:hcI5gBV","192:cI5gBVu","192:I5gBVud","192:5gBVudZ","192:gBVudZy","192:BVudZyp","192:VudZypB","192:udZypBp","192:dZypBpM","192:ZypBpM8","192:ypBpM8U"],"imphash":"26e023e42a374262738979df52e25acc"},"file_info":{"file_name":"operabrowser - Copy.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":13824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793408876000,"last_seen":1793408876000,"last_multi_scan":1793408876000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":247,"suspicious_count":13,"malicious_count":6,"total":266},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Gamehack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GameHack.KD potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.030120E3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/GameHack.KD potentially unsafe application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls APIs for obtaining the local machine's name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with low confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$27","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Setup.exe\" called \"FindResourceW\" with parameter \"26\" - (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindResourceW\" with parameter \"13\" - (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Setup.exe\" called \"LoadResource with parameter {'hModule': '1937833984', 'hResInfo': '1940383992'}\" (UID: 00000000-00002664)\n \"Setup.exe\" called \"LoadResource with parameter {'hModule': '45940736', 'hResInfo': '45949608'}\" (UID: 00000000-00002664)\n \"Setup.exe\" called \"LoadResource with parameter {'hModule': '45940736', 'hResInfo': '45949576'}\" (UID: 00000000-00002664)\n \"Setup.exe\" called \"LoadResource with parameter {'hModule': '46268418', 'hResInfo': '46335504'}\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$29","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"ChangeServiceConfig\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"OpenService failed with error: %u\" (Indicator: \"OpenService\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002664.00000001.281287.00CA2000.00000004.mdmp\")\n Found reference to \"TLS_AES_256_GCM_SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")\n Found reference to \"HKDF\" (Indicator: \"HKDF\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"operabrowser-Copy.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"operabrowser-Copy.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"vcredist_x64.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"vcredist_x64.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Setup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Setup.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"operabrowser-Copy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FOLDERDESCRIPTIONS\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\")\n \"operabrowser-Copy.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FOLDERDESCRIPTIONS\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\")\n \"operabrowser-Copy.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FOLDERDESCRIPTIONS\\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\\PROPERTYBAG\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"Setup.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\HFID3EA.tmp.html\" to \"%TEMP%\\Setup_20261030_180834962.html\"\n \"Setup.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Setup_20261030_180834962.html\" to \"%TEMP%\\Microsoft Visual C++ 2010 x64 Redistributable Setup_20261030_180836634.html\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"vcredist_x64.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"operabrowser - Copy.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002360-16646-11-010062FF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002664-18069-30-00DC2BA5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002664-18069-37-00DC45BE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptHashPublicKeyInfo\" (Indicator: \"CryptHashPublicKeyInfo\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CryptDecodeObject\" (Indicator: \"CryptDecodeObject\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"operabrowser - Copy.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002664.00000000.280541.00C10000.00000004.mdmp, 00000000-00002664.00000001.281287.00C10000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004516.00000000.279828.004C0000.00000004.mdmp, 00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002664.00000001.281287.00CA2000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004516.00000001.281739.04A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.61766","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"Property(S): UserNameRegEntryName = UserName\" (Source: \"00000000-00002664.00000001.281287.00CA2000.00000004.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"SetupUi.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Setup.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"operabrowser - Copy.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002360.00000000.280407.00610000.00000004.mdmp, 00000000-00002360.00000001.281295.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (File: \"operabrowser - Copy.exe\")\n Found string \"QueryServiceStatus\" (File: \"operabrowser - Copy.exe\")\n Found string \"QueryServiceStatus failed with error: %u\" (Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found string \"QueryServiceConfig\" (Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"operabrowser-Copy.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004516)\n \"vcredist_x64.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002360)\n \"Setup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"operabrowser-Copy.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004516)\n \"operabrowser-Copy.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"operabrowser-Copy.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004516)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs for obtaining the local machine's name","description":"Observed import api \"GetComputerObjectName\" which can \"Obtains the computer name of the local device\" [Source: SetupEngine.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-198","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: SetupEngine.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"operabrowser-Copy.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004516)\n \"Setup.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"operabrowser-Copy.exe\" called \"EnumWindows\" with parameter \"83948496\" - (UID: 00000000-00004516)\n \"Setup.exe\" called \"EnumWindows\" with parameter \"9433364\" - (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$36","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"operabrowser-Copy.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Setup.exe\" called \"OpenMutexW\" with parameter \"Global\\VC_Redist_SetupMutex\" - (UID: 00000000-00002664)\n \"Setup.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"vcredist_x64.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000eb3e77000000000000000000000000f3cb000128fe0d002000000008fe0d00f8a33c770000610000000000587b620018fe0d0057ba3e77587b62002000000030fe0d001970610017706100157061005cfe0d002a44000117706100d8240001070000000000008080eb9076000000000170610000000000709e60ff04706100 (UID: 00000000-00002360)\n \"Setup.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000079d0000009d00426e6c7400000000feffffffa88ec30000000000000000006cea8f000200000010000000c0019d00000000000200000000009d0001000000080000000000c100a40c9d00e2f46974a00c9d0078ea8f00feba3e77080000000000000008000000e1dd8452bcec8f00da91eb720000c1000800000001000000 (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Setup.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Setup.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Setup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: SetupEngine.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: SetupUi.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002360-16646-113-010028D9\n GetTickCount@KERNEL32.DLL at 00000000-00002360-16646-140-0100628E\n GetTickCount@KERNEL32.DLL at 00000000-00002664-18069-141-00DC3FA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002360-16646-31-010046B9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00002360-16646-114-01002B13","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002360-16646-140-0100628E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002664-18069-141-00DC3FA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00000000-00002360-16646-111-01004F6B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002360-16646-140-0100628E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002664-18069-141-00DC3FA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00002360-16646-120-010027CB\n GetVersion@KERNEL32.DLL at 00000000-00002664-18069-69-00DC29C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00002360-16646-111-01004F6B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"operabrowser - Copy.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00002360-16646-19-01005E92\n NtOpenProcessToken@NTDLL.DLL at 00000000-00002360-16646-26-0100358B\n NtOpenProcessToken@NTDLL.DLL at 00000000-00002360-16646-27-010034F4\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002360-16646-116-01003D02","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-000002A4h], 04h\" and \"jbe 01003BA3h\" at 00000000-00002360-16646-21-01003972\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 06h\" and \"jnc 00DC29EEh\" at 00000000-00002664-18069-69-00DC29C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: SETUPUI.DLL\n C:\\5C5053157117BFD8F7A456447D\\1033\\SETUPRESOURCES.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"operabrowser-Copy.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"operabrowser-Copy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"operabrowser-Copy.exe\" queried token user identity (UID: 00000000-00004516)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007764-00000C17-2859042916\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00007764-00000C17-2859654270","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\VCREDIST_X64.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.EXE\")\n \"Setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"operabrowser - Copy.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"SetupUi.dll\")\n file/memory contains long string(File: \"Setup.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"Setup.exe\" called \"CopyFileW\" to copy c:\\5c5053157117bfd8f7a456447d\\DHTMLHeader.html to new location %TEMP%\\HFID3EA.tmp.html (UID: 00000000-00002664)\n \"Setup.exe\" called \"CopyFileW\" to copy c:\\5c5053157117bfd8f7a456447d\\DHTMLHeader.html to new location %TEMP%\\HFIDEAB.tmp.html (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"operabrowser-Copy.exe\" called \"CreateProcessW\" with parameter \"\"C:\\vcredist_x64.exe\" /passive /norestart\" - (UID: 00000000-00004516)\n \"vcredist_x64.exe\" called \"CreateProcessA\" with parameter \"c:\\5c5053157117bfd8f7a456447d\\Setup.exe /passive /norestart\" - (UID: 00000000-00002360)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"Setup.exe\" called \"MoveFileW\" with parameter %TEMP%\\HFID3EA.tmp.html & %TEMP%\\Setup_20261030_180834962.html (UID: 00000000-00002664)\n \"Setup.exe\" called \"MoveFileW\" with parameter %TEMP%\\Setup_20261030_180834962.html & %TEMP%\\Microsoft Visual C++ 2010 x64 Redistributable Setup_20261030_180836634.html (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"sfxcab.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00002360-16646-19-01005E92\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002360-16646-21-01003972\n Sleep@KERNEL32.DLL at 00000000-00002360-16646-31-010046B9\n Sleep@KERNEL32.DLL at 00000000-00002360-16646-136-01002E55\n Sleep@KERNEL32.DLL at 00000000-00002664-18069-46-00DC4F38\n Sleep@KERNEL32.DLL at 00000000-00002664-18069-50-00DC4F82\n Sleep@KERNEL32.DLL at 00000000-00002664-18069-54-00DC4FD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002360-16646-21-01003972\n LoadLibraryA@KERNEL32.DLL at 00000000-00002360-16646-47-0100360C\n LoadLibraryA@KERNEL32.DLL at 00000000-00002360-16646-112-010045EB\n LoadLibraryA@KERNEL32.DLL at 00000000-00002360-16646-115-010029C2\n LoadLibraryW@KERNEL32.DLL at 00000000-00002664-18069-32-00DC4B70\n LoadLibraryW@KERNEL32.DLL at 00000000-00002664-18069-102-00DC2930","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004516.00000001.281739.04A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"SetupEngine.dll\" contains export function called \"MakePImpl\" at ordinal 3\n \"SetupEngine.dll\" contains export function called \"Run\" at ordinal 4\n \"SetupEngine.dll\" contains export function called \"_DecodePointerInternal@4\" at ordinal 1\n \"SetupEngine.dll\" contains export function called \"_EncodePointerInternal@4\" at ordinal 2\n \"SetupUi.dll\" contains export function called \"CreateClassFactory\" at ordinal 1\n \"SetupUi.dll\" contains export function called \"_DecodePointerInternal@4\" at ordinal 2\n \"SetupUi.dll\" contains export function called \"_EncodePointerInternal@4\" at ordinal 3\n \"Setup.exe\" contains export function called \"_DecodePointerInternal@4\" at ordinal 1\n \"Setup.exe\" contains export function called \"_EncodePointerInternal@4\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$46","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: SetupEngine.dll)\n Found MoveFileW in import section (Source: SetupUi.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$48","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$49","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"operabrowser-Copy.exe\" failed to load missing module \"MSVCR100.dll\" - [base:0; Status:c0000135]\n \"Setup.exe\" failed to load missing module \"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"SetupEngine.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"SetupUi.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Setup.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"SetupResources.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"p@tzres.dll\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72E50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"operabrowser-Copy.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2D520000\n \"operabrowser-Copy.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2C690000\n \"vcredist_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75160000\n \"vcredist_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74330000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74330000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75160000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2D520000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2C690000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 00A30000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"operabrowser-Copy.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2D7A0000\n \"vcredist_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 757B0000\n \"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 757B0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2D7A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020423e2dfa7f0000@ntdll.dll\"\n \"220023000000000040423e2dfa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"operabrowser - Copy.exe\" was detected as \"MPRESS\" and name: \"Packer\"\n \"operabrowser - Copy.exe\" was detected as \"EP:MPRESS\" and name: \"Packer\"\n \"SetupEngine.dll\" was detected as \"MPRESS\" and name: \"Packer\"\n \"SetupEngine.dll\" was detected as \"EP:MPRESS\" and name: \"Packer\"\n \"SetupUi.dll\" was detected as \"MPRESS\" and name: \"Packer\"\n \"SetupUi.dll\" was detected as \"EP:MPRESS\" and name: \"Packer\"\n \"Setup.exe\" was detected as \"MPRESS\" and name: \"Packer\"\n \"Setup.exe\" was detected as \"EP:MPRESS\" and name: \"Packer\"\n \"SetupResources.dll\" was detected as \"MPRESS\" and name: \"Packer\"\n \"SetupResources.dll\" was detected as \"EP:MPRESS\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"SetupEngine.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"SetupUi.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Setup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"SetupResources.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"operabrowser - Copy.exe\" has an executable section named \".CEIKLD1\"\n \"operabrowser - Copy.exe\" has an executable section named \".CYVJCP2\"\n \"SetupEngine.dll\" has an executable section named \".text\"\n \"SetupUi.dll\" has an executable section named \".text\"\n \"Setup.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"operabrowser - Copy.exe\" has an writable section named \".CEIKLD1\"\n \"operabrowser - Copy.exe\" has an writable section named \".CYVJCP2\"\n \"SetupEngine.dll\" has an writable section named \".data\"\n \"SetupUi.dll\" has an writable section named \".data\"\n \"Setup.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"operabrowser - Copy.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00002664-00000455-11516744808]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"operabrowser-Copy.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"Setup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"operabrowser-Copy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"operabrowser-Copy.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"operabrowser-Copy.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"vcredist_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vcredist_x64.exe\" with commandline \"/passive /norestart\" (UID: 00000000-00002360)\n Spawned process \"Setup.exe\" with commandline \"/passive /norestart\" (UID: 00000000-00002664)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00007764)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"vcredist_x64.exe\" with commandline \"/passive /norestart\" (UID: 00000000-00002360)\n Spawned process \"Setup.exe\" with commandline \"/passive /norestart\" (UID: 00000000-00002664)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00007764)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1049\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\3082\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1031\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1036\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1040\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\2052\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1028\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1042\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1041\\eula.rtf (UID: 00000000-00002360)\n \"vcredist_x64.exe\" opens a file C:\\5c5053157117bfd8f7a456447d\\1033\\eula.rtf (UID: 00000000-00002360)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"SetupEngine.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"SetupUi.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"SetupResources.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\HFID3EA.tmp.html\"\n \"Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Setup_20261030_180834962.html\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00004516.00000001.281739.05010000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00004516.00000001.281739.05060000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"operabrowser-Copy.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"vcredist_x64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Setup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$52","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$53","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$55","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"operabrowser-Copy.exe\" queries basic process information of the \"C:\\operabrowser-Copy.exe\" (UID: 4516)\n \"operabrowser-Copy.exe\" queries basic process information of the \"C:\\vcredist_x64.exe\" (UID: 4516)\n \"vcredist_x64.exe\" queries basic process information of the \"C:\\vcredist_x64.exe\" (UID: 2360)\n \"vcredist_x64.exe\" queries basic process information of the \"C:\\5c5053157117bfd8f7a456447d\\Setup.exe\" (UID: 2360)\n \"Setup.exe\" queries basic process information of the \"C:\\5c5053157117bfd8f7a456447d\\Setup.exe\" (UID: 2664)\n \"Setup.exe\" queries basic process information of the \"C:\\Windows\\explorer.exe\" (UID: 2664)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"operabrowser-Copy.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"operabrowser-Copy.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\05b9405734a3667848206d6f14b66db1\"\n \"operabrowser-Copy.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\vcredist_x64[1].exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$57","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"operabrowser-Copy.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"operabrowser-Copy.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"operabrowser-Copy.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"operabrowser-Copy.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\vcredist_x64[1].exe\"\n \"operabrowser-Copy.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"operabrowser-Copy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"operabrowser-Copy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"operabrowser-Copy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"operabrowser-Copy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\vcredist_x64[1].exe\"\n \"operabrowser-Copy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"operabrowser-Copy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\05b9405734a3667848206d6f14b66db1\"\n \"operabrowser-Copy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\05b9405734a3667848206d6f14b66db1\"\n \"operabrowser-Copy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\6ldiekeg\\vcredist_x64[1].exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"operabrowser-Copy.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"4a42530\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"operabrowser-Copy.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4a42530\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"To Directory:JSetup was unable to shutdown system.\" (Indicator: \" shutdown \"; Source: \"00000000-00002360.00000001.281295.0101E000.00000002.mdmp\")\n Found reference to API \"Please shutdown your system manually.\\Unable to find a volume for file extraction.\" (Indicator: \" shutdown \"; Source: \"00000000-00002360.00000001.281295.0101E000.00000002.mdmp\")\n Found reference to API \"Failed to connect setup watcher. Error code = %d\" (Indicator: \" connect \"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"2.5.29.1\"\n \"6.3.0015.0\"\n \"0.0.0.0\"\n \"2.5.29.10\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n \"2.5.29.3\"\n \"192.168.0.2\"\n \"2.5.29.20\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004516.00000001.281739.04A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00002360-00000CCE-2846445864\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://download.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00004516.00000001.281739.004C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: SetupEngine.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: SetupUi.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"operabrowser - Copy.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"operabrowser - Copy.exe\"\n Found registry query API: \"RegOpenKeyTransactedW\" in \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 73E80000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"Setup.exe\" called \"FindFirstFileW\" with parameter c:\\5c5053157117bfd8f7a456447d\\???? (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1028 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1031 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1033 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1036 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1040 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1041 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1042 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 1049 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 2052 (UID: 00000000-00002664)\n \"Setup.exe\" called \"FindNextFileW\" with parameter 3082 (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"operabrowser-Copy.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"vcredist_x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"vcredist_x64.exe\" called \"GetDriveTypeA\" with parameter c:\\ (UID: 00000000-00002360)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Setup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$62","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"operabrowser - Copy.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Setup.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: SetupEngine.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: SetupEngine.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: SetupUi.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$63","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown Initiated in Self Extractor\" (Indicator: \"shutdown \") in Source: 16646-21-01003972\n Observed string: \"Shutdown Initiated in Self Extractor\" (Indicator: \"shutdown \") in Source: 00000000-00002360.00000000.280407.01002000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002360.00000000.280407.01002000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002664.00000000.280541.72ED1000.00000020.mdmp, 00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.00DC1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"operabrowser-Copy.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Setup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\VSSETUP\")\n \"Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\VSSETUP\"; Key: \"EVENTMESSAGEFILE\"; Value: \"c:\\5c5053157117bfd8f7a456447d\\DW\\DW20.exe\")\n \"Setup.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\VSSETUP\"; Key: \"TYPESSUPPORTED\"; Value: \"0700000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$67","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"operabrowser-Copy.exe\" opened \"\\Device\\KsecDD\"\n \"vcredist_x64.exe\" opened \"\\Device\\KsecDD\"\n \"Setup.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$68","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$69","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"operabrowser - Copy.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002664.00000000.280541.73AD1000.00000020.mdmp, 00000000-00002664.00000001.281287.736F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004516.00000001.281739.04A10000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"05B9405734A3667848206D6F14B66DB1 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"05B9405734A3667848206D6F14B66DB1\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\05B9405734A3667848206D6F14B66DB1]- [targetUID: 00000000-00004516]\n Dropped file: \"05B9405734A3667848206D6F14B66DB1\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\05B9405734A3667848206D6F14B66DB1]- [targetUID: 00000000-00004516]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"watermark.bmp\" has type \"PC bitmap Windows 3.x format 164 x 628 x 24 image size 308978 resolution 2834 x 2834 px/m cbSize 309032 bits offset 54\" and extension \"bmp\"\n \"SplashScreen.bmp\" has type \"PC bitmap Windows 3.x format 200 x 200 x 8 image size 40000 resolution 3779 x 3779 px/m cbSize 41078 bits offset 1078\" and extension \"bmp\"\n \"header.bmp\" has type \"PC bitmap Windows 3.x format 49 x 49 x 24 image size 7254 resolution 2834 x 2834 px/m cbSize 7308 bits offset 54\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"SetupEngine.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"SetupUi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"Setup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"SetupResources.dll\" was detected as \"Microsoft Visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"vcredist_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"operabrowser - Copy.exe\" has section name .CEIKLD1 with entropy \"7.730160019530461\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/26 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"operabrowser-Copy.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6b","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6c","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"SetupResources.dll\"\n YARA signature for invalid Base of code of PE file \"SetupResources.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"operabrowser-Copy.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"operabrowser-Copy.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"SetupUi.dll\" claimed CRC 862880 while the actual is CRC 314087\n \"Setup.exe\" claimed CRC 314087 while the actual is CRC 101349\n \"SetupResources.dll\" claimed CRC 101349 while the actual is CRC 32636\n \"SetupResources.dll\" claimed CRC 32636 while the actual is CRC 33732\n \"SetupResources.dll\" claimed CRC 33732 while the actual is CRC 54430\n \"SetupResources.dll\" claimed CRC 54430 while the actual is CRC 63917\n \"SetupResources.dll\" claimed CRC 63917 while the actual is CRC 22061\n \"SetupResources.dll\" claimed CRC 22061 while the actual is CRC 35119\n \"SetupResources.dll\" claimed CRC 35119 while the actual is CRC 28209\n \"SetupResources.dll\" claimed CRC 28209 while the actual is CRC 54747\n \"SetupResources.dll\" claimed CRC 54747 while the actual is CRC 22641\n \"SetupResources.dll\" claimed CRC 22641 while the actual is CRC 73694","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtShutdownSystem@NTDLL.DLL at 00000000-00002360-16646-21-01003972\n NtOpenProcessToken@NTDLL.DLL at 00000000-00002360-16646-26-0100358B\n NtOpenProcessToken@NTDLL.DLL at 00000000-00002360-16646-27-010034F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"operabrowser - Copy.exe\" has an entrypoint in section \".CYVJCP2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetProcAddress\n OpenProcessToken\n RegOpenKeyExW\n RegCloseKey\n StartServiceW\n ChangeServiceConfigW\n RegCreateKeyExW\n SetSecurityDescriptorDacl\n TerminateProcess\n GetVersionExW\n GetFileAttributesW\n CopyFileW\n CreateToolhelp32Snapshot\n Sleep\n GetCommandLineA\n DisconnectNamedPipe\n IsDebuggerPresent\n FindResourceExW\n CreateFileW\n GetTickCount\n OutputDebugStringW\n CreateProcessW\n OpenFileMappingW\n Process32NextW\n Process32FirstW\n CreateThread\n CreateFileMappingW\n GetModuleFileNameW\n FindNextFileW\n MapViewOfFile\n GetModuleFileNameA\n OpenProcess\n GetStartupInfoW\n GetSystemDirectoryW\n GetModuleHandleW\n FindResourceW\n GetFileSize\n LoadLibraryW\n GetFileSizeEx\n GetSystemInfo\n FindFirstFileW\n GetFileAttributesExW\n LockResource\n VirtualAlloc\n GetTempFileNameW\n GetTempPathW\n CreateDirectoryW\n UnhandledExceptionFilter\n WriteFile\n GetCommandLineW\n DeleteFileW\n ConnectNamedPipe\n VirtualProtect\n GetWindowThreadProcessId\n URLDownloadToFileW\n ShellExecuteW\n SetWindowsHookExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"operabrowser-Copy.exe\" called \"CreateProcessW\" with parameter \"\"C:\\vcredist_x64.exe\" /passive /norestart\" - (UID: 00000000-00004516)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"operabrowser-Copy.exe\" wrote 000011C0 bytes to a remote process \"C:\\vcredist_x64.exe\" (Handle: 2636)\n \"operabrowser-Copy.exe\" wrote 00000008 bytes to a remote process \"C:\\vcredist_x64.exe\" (Handle: 2636)\n \"operabrowser-Copy.exe\" wrote 00000004 bytes to a remote process \"C:\\vcredist_x64.exe\" (Handle: 2636)\n \"vcredist_x64.exe\" wrote 000011C0 bytes to a remote process \"C:\\5c5053157117bfd8f7a456447d\\Setup.exe\" (Handle: 792)\n \"vcredist_x64.exe\" wrote 00000008 bytes to a remote process \"C:\\5c5053157117bfd8f7a456447d\\Setup.exe\" (Handle: 792)\n \"vcredist_x64.exe\" wrote 00000004 bytes to a remote process \"C:\\5c5053157117bfd8f7a456447d\\Setup.exe\" (Handle: 792)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"operabrowser-Copy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"intel_graph":{"map":{"File:1c8132747dc33ccdb02345cbe706e65089a88fe32cf040684ca0d72bb9105119":{"type":"File","value":"1c8132747dc33ccdb02345cbe706e65089a88fe32cf040684ca0d72bb9105119"},"File:29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713":{"type":"File","value":"29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713"},"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010":{"type":"File","value":"3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010"},"File:4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0":{"type":"File","value":"4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0"},"File:4cd45cf57644d49b4c8f96e4a0efdc46a5ba196fa4f5a10190f790ccc74bb1bf":{"type":"File","value":"4cd45cf57644d49b4c8f96e4a0efdc46a5ba196fa4f5a10190f790ccc74bb1bf"},"File:531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7":{"type":"File","value":"531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7"},"File:5763364634bdb2097b6df6cde79ac5cce6069acecf27254c589e3cabffe53c2b":{"type":"File","value":"5763364634bdb2097b6df6cde79ac5cce6069acecf27254c589e3cabffe53c2b"},"File:5944de31842aa3b6c058aa5eac78d3df0b69ac3e01ada9df3837a9235cf538fc":{"type":"File","value":"5944de31842aa3b6c058aa5eac78d3df0b69ac3e01ada9df3837a9235cf538fc"},"File:682dba4047a6bb4379fa958b3074232751e8a4f3a4ba5c0c7d86f53bbc86aad6":{"type":"File","value":"682dba4047a6bb4379fa958b3074232751e8a4f3a4ba5c0c7d86f53bbc86aad6"},"File:7a6f12db5a1d58aa41b52299c5ce8b024e9a07683d9f37497f5280f5a2a69d19":{"type":"File","value":"7a6f12db5a1d58aa41b52299c5ce8b024e9a07683d9f37497f5280f5a2a69d19"},"File:8df27201f7ddf2adfd47445bd36ea77eb467b19b4b90ece798c663e3e6535914":{"type":"File","value":"8df27201f7ddf2adfd47445bd36ea77eb467b19b4b90ece798c663e3e6535914"},"File:a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952":{"type":"File","value":"a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952"},"File:b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209":{"type":"File","value":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209"},"File:c363b51dca2596c2804d5c5c22264572fd5c372a810cd93c3f93ad03a502c73b":{"type":"File","value":"c363b51dca2596c2804d5c5c22264572fd5c372a810cd93c3f93ad03a502c73b"}},"chains":[{"id":"sandbox_files","root":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","edges":[{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:682dba4047a6bb4379fa958b3074232751e8a4f3a4ba5c0c7d86f53bbc86aad6"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:7a6f12db5a1d58aa41b52299c5ce8b024e9a07683d9f37497f5280f5a2a69d19"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:4cd45cf57644d49b4c8f96e4a0efdc46a5ba196fa4f5a10190f790ccc74bb1bf"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:5763364634bdb2097b6df6cde79ac5cce6069acecf27254c589e3cabffe53c2b"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:5944de31842aa3b6c058aa5eac78d3df0b69ac3e01ada9df3837a9235cf538fc"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:c363b51dca2596c2804d5c5c22264572fd5c372a810cd93c3f93ad03a502c73b"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:8df27201f7ddf2adfd47445bd36ea77eb467b19b4b90ece798c663e3e6535914"},{"edge_kind":"extracted","from_key":"File:3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","to_key":"File:1c8132747dc33ccdb02345cbe706e65089a88fe32cf040684ca0d72bb9105119"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":35,"imported_dlls_count":132,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":89,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ae53f6b2a22fa23df010947","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"GameHack.KD potentially unsafe application","submit_name":"operabrowser - Copy.exe","analysis_start_time":"2026-10-31T01:07:57+00:00","indicators_count":{"informative":247,"suspicious":73,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}],"processes":[{"pid":4516,"ppid":0,"name":"operabrowser-Copy.exe","command_line":"","sha256":"3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010","normalized_path":"C:\\operabrowser-Copy.exe","uid":"00000000-00004516","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":2360,"ppid":4516,"name":"vcredist_x64.exe","command_line":"/passive /norestart","sha256":"f3b7a76d84d23f91957aa18456a14b4e90609e4ce8194c5653384ed38dada6f3","normalized_path":"C:\\vcredist_x64.exe","parent_uid":"00000000-00004516","uid":"00000000-00002360"},{"pid":2664,"ppid":2360,"name":"Setup.exe","command_line":"/passive /norestart","sha256":"531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7","normalized_path":"c:\\5c5053157117bfd8f7a456447d\\Setup.exe","parent_uid":"00000000-00002360","uid":"00000000-00002664"},{"pid":7764,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00007764","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="}],"all_imported_dlls":["fltLib.dll","netapi32.dll","gdi32full.dll","ole32.dll","virtdisk.dll","ncryptsslp.dll","comctl32.dll","AcGenral.dll","ntdll.dll","gdi32.dll","sspicli.dll","winnsi.dll","psapi.dll","iertutil.dll","schannel.dll","OneCoreUAPCommonProxyStub.dll","SHCore.dll","ncrypt.dll","crypt32.dll","gpapi.dll","BCP47Langs.dll","wow64win.dll","winmm.dll","version.dll","ntmarta.dll","sechost.dll","advapi32.dll","cryptbase.dll","cryptnet.dll","cscapi.dll","msctf.dll","bcrypt.dll","msls31.dll","fusion.dll","vcruntime140_1_clr0400.dll","wkscli.dll","mswsock.dll","cfgmgr32.dll","msacm32.dll","dpapi.dll","wldp.dll","pcacli.dll","comdlg32.dll","cryptsp.dll","OnDemandConnRouteHelper.dll","dhcpcsvc.dll","sqmapi.dll","riched20.dll","kernel32.dll","ws2_32.dll","imm32.dll","webio.dll","win32u.dll","oleaut32.dll","msasn1.dll","edputil.dll","ServicingCommon.dll","msisip.dll","shell32.dll","dnsapi.dll","sfc_os.dll","kernel.appcore.dll","AppResolver.dll","msxml3.dll","RstrtMgr.dll","CoreUIComponents.dll","FWPUCLNT.DLL","cabinet.dll","KernelBase.dll","propsys.dll","feclient.dll","AcLayers.dll","rpcrt4.dll","vcruntime140.dll","urlmon.dll","IPHLPAPI.DLL","wintrust.dll","SetupEngine.dll","clr.dll","msi.dll","VxSSL64.dll","msvcp140.dll","vcruntime140_1.dll","msvcrt.dll","dhcpcsvc6.dll","Windows.StateRepositoryPS.dll","wow64con.dll","uxtheme.dll","mpr.dll","clusapi.dll","ucrtbase_clr0400.dll","winhttp.dll","rsaenh.dll","dwmapi.dll","secur32.dll","SetupUi.dll","windows.storage.dll","profapi.dll","userenv.dll","setupapi.dll","SetupResources.dll","VxSSL32.dll","user32.dll","nsi.dll","ntasn1.dll","msvcr100.dll","wow64.dll","wow64cpu.dll","bcryptprimitives.dll","TextInputFramework.dll","clbcatq.dll","srvcli.dll","rasadhlp.dll","vcruntime140_clr0400.dll","combase.dll","WinTypes.dll","usp10.dll","ucrtbase.dll","shlwapi.dll","TextShaping.dll","netutils.dll","sfc.dll","CoreMessaging.dll","msvcp_win.dll","samcli.dll","coml2.dll","mscoree.dll","apphelp.dll","wininet.dll","wow64base.dll","srpapi.dll","mscoreei.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SetupResources.dll","sha256":"682dba4047a6bb4379fa958b3074232751e8a4f3a4ba5c0c7d86f53bbc86aad6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"eula.rtf","sha256":"7a6f12db5a1d58aa41b52299c5ce8b024e9a07683d9f37497f5280f5a2a69d19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Setup.exe","sha256":"531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SetupEngine.dll","sha256":"a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SetupUi.dll","sha256":"29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"msp_kb2565063.msp","sha256":"4cd45cf57644d49b4c8f96e4a0efdc46a5ba196fa4f5a10190f790ccc74bb1bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"vc_red.msi","sha256":"5763364634bdb2097b6df6cde79ac5cce6069acecf27254c589e3cabffe53c2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"vcredist_x64.exe","sha256":"4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"vcredist_x64_1_.exe","sha256":"4bacaae3d331f1a3223bc2cd022ba31d4bad6fa86aaaa06be36ff051b7bbb3d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"05B9405734A3667848206D6F14B66DB1","sha256":"5944de31842aa3b6c058aa5eac78d3df0b69ac3e01ada9df3837a9235cf538fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"HFID3EA.tmp.html","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"HFIDEAB.tmp.html","sha256":"c363b51dca2596c2804d5c5c22264572fd5c372a810cd93c3f93ad03a502c73b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Setup_20261030_180834962.html","sha256":"8df27201f7ddf2adfd47445bd36ea77eb467b19b4b90ece798c663e3e6535914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"LocalizedData.xml","sha256":"1c8132747dc33ccdb02345cbe706e65089a88fe32cf040684ca0d72bb9105119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\05B9405734A3667848206D6F14B66DB1","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\05B9405734A3667848206D6F14B66DB1","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\vcredist_x64[1].exe","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\vcredist_x64.exe","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\DHtmlHeader.html","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Setup.exe","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\SetupEngine.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\SetupUi.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\SetupUi.xsd","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\watermark.bmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\header.bmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\DisplayIcon.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\UiInfo.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Strings.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\SplashScreen.bmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\ParameterInfo.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1033\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1033\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1033\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1041\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1041\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1041\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1042\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1042\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1042\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1028\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1028\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1028\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\2052\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\2052\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\2052\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1040\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1040\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1040\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1036\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1036\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1036\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1031\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1031\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1031\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\3082\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\3082\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\3082\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1049\\SetupResources.dll","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1049\\LocalizedData.xml","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\1049\\eula.rtf","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Print.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate1.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate2.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate3.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate4.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate5.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate6.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate7.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Rotate8.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Save.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\Setup.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\SysReqMet.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\SysReqNotMet.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\stop.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\Graphics\\warn.ico","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\vc_red.cab","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\vc_red.msi","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\msp_kb2565063.msp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"C:\\5c5053157117bfd8f7a456447d\\$shtdwn$.req","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFID3E9.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFID3EA.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFID3EA.tmp.html","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFID4E5.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\Setup_20261030_180834962.html","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFIDEAA.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFIDEAB.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\HFIDEAB.tmp.html","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\Microsoft Visual C++ 2010 x64 Redistributable Setup_20261030_180836634-MSI_vc_red.msi.txt","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%TEMP%\\Microsoft Visual C++ 2010 x64 Redistributable Setup_20261030_180836634.html","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"path":"%SAMPLEDIR%\\MSI2fdab.tmp","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\VSSETUP\\","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SM0:4516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\SM0:4516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\SM0:4516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SM0:4516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SM0:2360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\SM0:2360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SM0:2664:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"Local\\SM0:2664:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2664:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\VC_Redist_SetupMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2664:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2664:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\MSILOG_6444b0bf1dd68d4txt.ism.der_cv_ISM-436638081_03016202_puteS elbatubirtsideR 46x 0102 ++C lausiV tfosorciM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\SM0:7764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\SM0:7764:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]},{"name":"\\BaseNamedObjects\\Global\\MSILOG_6444b0bf1dd68d4txt.ism.der_cv_ISM-436638081_03016202_puteS elbatubirtsideR 46x 0102 ++C lausiV tfosorciM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6ae53f6b2a22fa23df010947"}]}]}},"report_ids":{"sandbox_job_ids":["6ae53f6b2a22fa23df010947"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/GameHack.KD potentially unsafe application Sample 3ef16856d31a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3ef16856d31a…. Malware family: Win64/GameHack.KD potentially unsafe application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GameHack.KD potentially unsafe application Sample 3ef16856d31a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3ef16856d31a…. Malware family: Win64/GameHack.KD potentially unsafe application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3ef16856d31a2e06029fcea3732f8e18c41da1294e8ecb2da879284ef66c2010"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GameHack.KD potentially unsafe application Sample 3ef16856d31a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3ef16856d31a…. Malware family: Win64/GameHack.KD potentially unsafe application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6e","11",{}]]