21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T421,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 836527ba46b8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 836527ba46b8…. Threat score 100/100. 0/26 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","executable"],"identifier":"836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T6f5,"AliyunWrap.dll" contains export function called "?SendLogToCloud@@YA_NABV?$vector@U?$pair@PA_WPA_W@std@@V?$allocator@U?$pair@PA_WPA_W@std@@@2@@std@@@Z" at ordinal 14 "AliyunWrap.dll" contains export function called "?SendLogToCloud@@YA_NHPAPADPAI01@Z" at ordinal 15 "AliyunWrap.dll" contains export function called "AliyunAddParamToSessionA" at ordinal 1 "AliyunWrap.dll" contains export function called "AliyunAddParamToSessionW" at ordinal 2 "AliyunWrap.dll" contains export function called "AliyunCloseSession" at ordinal 3 "AliyunWrap.dll" contains export function called "AliyunEnableUserInfoCollect" at ordinal 4 "AliyunWrap.dll" contains export function called "AliyunEndCache" at ordinal 5 "AliyunWrap.dll" contains export function called "AliyunGetUserUid" at ordinal 6 "AliyunWrap.dll" contains export function called "AliyunInstallConfigFilePath" at ordinal 7 "AliyunWrap.dll" contains export function called "AliyunInstallInitUid" at ordinal 8 "AliyunWrap.dll" contains export function called "AliyunIsEnableUserInfoCollect" at ordinal 9 "AliyunWrap.dll" contains export function called "AliyunOpenSession" at ordinal 10 "AliyunWrap.dll" contains export function called "AliyunSendInfo" at ordinal 11 "AliyunWrap.dll" contains export function called "AliyunUninstallEnd" at ordinal 12 "AliyunWrap.dll" contains export function called "AliyunUninstallStart" at ordinal 13 "AliyunWrap.dll" contains export function called "add_log_full" at ordinal 16 "AliyunWrap.dll" contains export function called "add_pack_id" at ordinal 17 "AliyunWrap.dll" contains export function called "add_source" at ordinal 18 "AliyunWrap.dll" contains export function called "add_tag" at ordinal 19 "AliyunWrap.dll" contains export function called "add_topic" at ordinal 2023:Ta07,"GetLongPathNameW" (Indicator: "GetLongPathNameW") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "SysFreeString" (Indicator: "SysFreeString") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "SysAllocStringLen" (Indicator: "SysAllocString") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "RegQueryValueExW" (Indicator: "RegQueryValueExW") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "RegOpenKeyExW" (Indicator: "RegOpenKeyExW") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "RegCloseKey" (Indicator: "RegCloseKey") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "LoadStringW" (Indicator: "LoadStringW") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "MessageBoxA" (Indicator: "MessageBoxA") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "VirtualFree" (Indicator: "VirtualFree") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "GetSystemInfo" (Indicator: "GetSystemInfo") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "GetTickCount" (Indicator: "GetTickCount") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "GetVersion" (Indicator: "GetVersion") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "GetCurrentThreadId" (Indicator: "GetCurrentThreadId") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "VirtualQuery" (Indicator: "VirtualQuery") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "WideCharToMultiByte" (Indicator: "WideCharToMultiByte") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "MultiByteToWideChar" (Indicator: "MultiByteToWideChar") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "LoadLibraryExW" (Indicator: "LoadLibraryExW") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin "GetStartupInfoA" (Indicator: "GetStartupInfoA") in Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin24:T554,"Setup.tmp" touched "Computer" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Setup.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "Setup.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}") "Setup.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\PROGID") "Setup.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "Setup.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "AliyunWrapExe.Exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AliyunWrapExe.Exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\INPROCHANDLER") "AliyunWrapExe.Exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\INPROCSERVER32") "AliyunWrapExe.Exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}")25:T103d,"InfoForSetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-QBFH0.tmp\InfoForSetup.exe]- [targetUID: 00000000-00003552] "AliyunWrapExe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-QBFH0.tmp\AliyunWrapExe.exe]- [targetUID: 00000000-00002820] "AliyunWrap.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-QBFH0.tmp\AliyunWrap.dll]- [targetUID: 00000000-00002920] "is-BA92K.tmp" has type "PNG image data 272 x 271 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Korean\images\is-BA92K.tmp]- [targetUID: 00000000-00003552] "is-52O3G.tmp" has type "PNG image data 272 x 271 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-52O3G.tmp]- [targetUID: 00000000-00003552] "is-D99MN.tmp" has type "PNG image data 22 x 25 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Norwegian\images\is-D99MN.tmp]- [targetUID: 00000000-00003552] "is-ILBFP.tmp" has type "Qt Translation file"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\language\is-ILBFP.tmp]- [targetUID: 00000000-00003552] "is-4736J.tmp" has type "Qt Translation file"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\language\is-4736J.tmp]- [targetUID: 00000000-00003552] "is-HEUTG.tmp" has type "PNG image data 49 x 48 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Spanish\images\is-HEUTG.tmp]- [targetUID: 00000000-00003552] "is-NT5QD.tmp" has type "PNG image data 1 x 1 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Chinese\images\is-NT5QD.tmp]- [targetUID: 00000000-00003552] "is-TCSVM.tmp" has type "PNG image data 39 x 30 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\English\images\is-TCSVM.tmp]- [targetUID: 00000000-00003552] "is-F5GAL.tmp" has type "Qt Translation file"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\language\is-F5GAL.tmp]- [targetUID: 00000000-00003552] "is-7JQG5.tmp" has type "PNG image data 15 x 16 4-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-7JQG5.tmp]- [targetUID: 00000000-00003552] "is-1QH4R.tmp" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 Exif Standard: [TIFF image data big-endian direntries=1 orientation=upper-left] baseline precision 8 800x475 frames 3"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Russian\images\is-1QH4R.tmp]- [targetUID: 00000000-00003552] "is-2KO3C.tmp" has type "HTML document UTF-8 Unicode text with CRLF line terminators"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Norwegian\is-2KO3C.tmp]- [targetUID: 00000000-00003552] "is-8U59J.tmp" has type "PNG image data 22 x 25 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Portuguesa\images\is-8U59J.tmp]- [targetUID: 00000000-00003552] "is-EOPQ1.tmp" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Chinese\js\is-EOPQ1.tmp]- [targetUID: 00000000-00003552] "is-9RPCS.tmp" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Korean\js\is-9RPCS.tmp]- [targetUID: 00000000-00003552] "is-I4LAF.tmp" has type "HTML document UTF-8 Unicode text with CRLF line terminators"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Arabic\is-I4LAF.tmp]- [targetUID: 00000000-00003552] "is-MM81J.tmp" has type "PNG image data 39 x 30 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Dutch\images\is-MM81J.tmp]- [targetUID: 00000000-00003552]26:T657,Pattern match: "http://schemas.microsof"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Pattern match: "t.com/SMI/2005/WindowsSettings"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Pattern match: "4.jF/^H"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Heuristic match: "Ox8Iud;.bn"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Heuristic match: "?r]jb.ge"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Heuristic match: "YKd_JK$'X.pr"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Heuristic match: "0Ey0Wy.VN"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline"- [Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin] Heuristic match: "track.easeus.com"- [Source: PCAP] Heuristic match: "easeusinfo.us-east-1.log.aliyuncs.com"- [Source: PCAP] Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"- [Source: is-I4LAF.tmp] Pattern match: "http://www.w3.org/1999/xhtml"- [Source: is-I4LAF.tmp] Pattern match: "down.easeus.com/product/buy_windrw_trial_month_en?addcode=1"- [Source: is-I4LAF.tmp] Pattern match: "down.easeus.com/product/buy_windrw_trial_year_en?addcode=1"- [Source: is-I4LAF.tmp] Pattern match: "down.easeus.com/product/buy_windrw_trial_lifetime_en?addcode=1"- [Source: is-I4LAF.tmp] Pattern match: "jquery.org/license"- [Source: is-QHPV7.tmp]27:T1e5d,"

-1

^$69^.95

-1

^$99^.95

^$149^.95

30
7/24

" (Indicator: "https://") in Source: is-I4LAF.tmp28:Taae,"POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 13:07:46 GMT Content-MD5:4D777513C42EE6C306DA245E50D95A64 Content-Length:231 x-log-bodyrawsize:229 Authorization:LOG LTAIBDHwLKKvsH19:1CFeQMGbaFdkFw9tUFJw0nWPA9s=" with no payload "POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 15:07:12 GMT Content-MD5:2A2C4E878AB90CA9ED06FCBC08ED2070 Content-Length:231 x-log-bodyrawsize:229 Authorization:LOG LTAIBDHwLKKvsH19:WEYrExQ3v8j6BfQVj/GJy3fXd8U=" with no payload "POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 15:08:05 GMT Content-MD5:416BB20CF4C2E13972DC8B96E989E5AA Content-Length:194 x-log-bodyrawsize:192 Authorization:LOG LTAIBDHwLKKvsH19:9hxaiMAuIxA/ZB0fWTiOsdhoGmY=" with no payload "POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 15:09:55 GMT Content-MD5:B1E39987CA27D29EE07ED33F2D8F4059 Content-Length:207 x-log-bodyrawsize:205 Authorization:LOG LTAIBDHwLKKvsH19:yCURirq93eR4mqS0na+cD3T2pkE=" with no payload "POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 15:13:06 GMT Content-MD5:C01617D60BDC78A172B2F8461E31F68A Content-Length:294 x-log-bodyrawsize:293 Authorization:LOG LTAIBDHwLKKvsH19:6LUrZkPAun7N6KkuziwVxrvL44c=" with no payload "POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: */* Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Thu, 16 Jun 2022 15:13:15 GMT Content-MD5:7D99BD2F99240832B286959387FC1016 Content-Length:313 x-log-bodyrawsize:310 Authorization:LOG LTAIBDHwLKKvsH19:BTme2HqNJmz72Bm1CsT+nk8j84Y=" with no payload29:T894,"Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-IKPQU.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-NU8EB.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\language\is-MKG2S.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\language\is-6IV45.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\language\is-ILBFP.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\language\is-G0N6N.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-P6QM7.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-CEITJ.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-B5M4M.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-DL0JE.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-000LB.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-1F3O7.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\is-LK94Q.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-TO1TS.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-47PHP.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-O13FL.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-DN089.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-Q4FJH.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-C01T2.tmp" with delete access "Setup.tmp" opened "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\is-IS132.tmp" with delete access2a:T4a8,"Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "InfoForSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "InfoForSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InfoForSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AliyunWrapExe.Exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")2b:Tc41,"Setup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3222P.tmp\Setup.tmp" (Handle: 292) "Setup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3222P.tmp\Setup.tmp" (Handle: 292) "Setup.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3222P.tmp\Setup.tmp" (Handle: 292) "Setup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3222P.tmp\Setup.tmp" (Handle: 292) "Setup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-3222P.tmp\Setup.tmp" (Handle: 292) "Setup.tmp" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 444) "Setup.tmp" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 444) "Setup.tmp" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 444) "Setup.tmp" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 444) "Setup.tmp" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 444) "Setup.tmp" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 440) "Setup.tmp" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 440) "Setup.tmp" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 440) "Setup.tmp" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 440) "Setup.tmp" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 440) "Setup.tmp" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 492) "Setup.tmp" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 492) "Setup.tmp" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 492) "Setup.tmp" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 492) "Setup.tmp" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\InfoForSetup.exe" (Handle: 492) "InfoForSetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\AliyunWrapExe.exe" (Handle: 308) "InfoForSetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\AliyunWrapExe.exe" (Handle: 308) "InfoForSetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\AliyunWrapExe.exe" (Handle: 308) "InfoForSetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QBFH0.tmp\AliyunWrapExe.exe" (Handle: 308)2c:T496,Spawned process "Setup.exe" (UID: 00000000-00003188) Spawned process "Setup.tmp" with commandline "/SL5="$50226 54475194 192512 C:\Setup.exe"" (UID: 00000000-00003552) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attribute" "{\"Language\":\"en\"}"" (UID: 00000000-00002820) Spawned process "AliyunWrapExe.Exe" (UID: 00000000-00004088) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Setup" "Activity" "Click_Next"" (UID: 00000000-00002920) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Licenseagreement" "Activity" "Click_Accept"" (UID: 00000000-00004080) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectdestinationlocation" "Activity" "Click_Confirm" "Attribute" "{\"Path\":\"%PROGRAMFILES%\EaseUS/EaseUS Data Recovery Wizard\"}"" (UID: 00000000-00004060) Spawned process "InfoForSetup.exe" with commandline "/SendInfo "Window" "Selectadditionaltasks" "Activity" "Click_Install" "Attribute" "{\"Test_id\":\"TR15200-0615\" \"Version\":\"Trial_trial\" \"Num\":\"15.2.0.0\" \"Language\":\"en\"}"" (UID: 00000000-00002384)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAARmRmZmZmAAAAAAAAAAAARmZkRmZmZmZsAAAAAAAABGZmREZGZmZm6P8AAAAAAGZmRERmZmZmZu7/8AAAAAZmZEREZmZmZmZmePAAAAAGZkRERGZmZmZmZmZgAAAABkRERERmZmZmZm7oYAAAAAREREREZmZmZmZu/4AAAAAERERERGZodmZmbohwAAAABERERERmZ3Zmd+7uYAAAAAREREREZmd3d3d+5mAAAAAERERERGZnh3d4iHZgAAAABERERERm7u7maIh2YAAAAAREREREZuiI7mZndmAAAAAGZGZkRG7v/45mZmZgAAAABnbu5kRuj/+OZmZmYAAAAEbu7u5kbuj/7mZmZmAAAGbu7u7u5mbu7uZmZmZABGbu7u7u7uZmZu5mZmZmREZu7u7u7u5mZndmZmZmZkRAAH7u7u52ZmYzZmZmZmZEAAAG7u5meGbud+7miGZmYAAAAO5mZo+IiIiIiP/uYAAAAAAAZu6P///////47uAAAAAAAA7u7uiO7uiO7u7gAAAAAAAO7u7o////ju7u4AAAAAAADu7u7oiIiI7u7uAAAAAAAA7u7u7u7u7u7u7gAAAAAAAO7u7u7u7u7u7u4AAAAAAAAO7u7u7u7u7u7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/gAP//gAAf/wAAB/4AAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAPgAAADAAAAAAAAAAAAAAAA4AAAAfAAAAP4AAAP/AAAD/8AAA//AAAP/wAAD/8AAA//AAAP/4AAH///////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790716216444,"unified_at":"2026-09-29T21:10:16.444Z","metadata":{"hashes":{"sha256":"836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3","sha1":"ccad9adc227a2d6e907caa4584685289b5c7a3a6","md5":"dc47af8d1c9f0ad9bfc6385dbcd2ae27","sha512":"051fe6ec3672340d760d83a3774d0a7d0b9c02db77df58b065e96c6126f339ec87dc9924a0fe78138909d6f882016238959e0e03af4118d14e091ae572fb966f","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":55151552,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1655391791000,"last_seen":1692358718000,"last_multi_scan":1692358718000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":20},"sandbox_signatures":{"informative_count":26,"suspicious_count":18,"malicious_count":7,"total":51},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Observed strings related to Windows privileges"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Observed AdjustTokenPrivileges API string"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EASEUS DATA RECOVERY WIZARD_IS1\")\n \"Setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EASEUS DATA RECOVERY WIZARD_IS1\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.TMP\")\n \"Setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.TMP\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/63 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"track.easeus.com\"\n \"easeusinfo.us-east-1.log.aliyuncs.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.92.47.198:80\"\n \"47.252.97.212:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$22","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"\\Sessions\\1\\BaseNamedObjects\\DRW_Setup\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"DRW_Setup\"\n \"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$DATAFILE.INI\"\n \"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$ALIYUNCONFIG.INI\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$ALIYUNCONFIG.INI\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"AliyunWrap.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$23","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /product/index.php?c=main&a=getstatus&pid=2 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: track.easeus.com\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Observed AdjustTokenPrivileges API string","description":"\"AdjustTokenPrivileges\" observed api string which can \"provides the ability to enable or disable privileges in the specified access token\" (Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin\"","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$24","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Setup.tmp\" (UID: 00000000-00003552) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", __PROCESS_HISTORY=\"C:\\Setup.exe\"\"\n Process \"Setup.tmp\" (UID: 00000000-00003552) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Setup.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Setup.tmp\" with commandline \"/SL5=\"$50226\n54475194\n192512\nC:\\Setup.exe\"\" (UID: 00000000-00003552)\n Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Langsel\" \"Activity\" \"Click_Confirm\" \"Attribu ...\" (UID: 00000000-00002820), Spawned process \"AliyunWrapExe.Exe\" (UID: 00000000-00004088), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Setup\" \"Activity\" \"Click_Next\"\" (UID: 00000000-00002920), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Licenseagreement\" \"Activity\" \"Click_Accept\"\" (UID: 00000000-00004080), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Selectdestinationlocation\" \"Activity\" \"Click ...\" (UID: 00000000-00004060)\n Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Selectadditionaltasks\" \"Activity\" \"Click_Ins ...\" (UID: 00000000-00002384)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Setup.tmp\" with commandline \"/SL5=\"$50226\n54475194\n192512\nC:\\Setup.exe\"\" (UID: 00000000-00003552)\n Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Langsel\" \"Activity\" \"Click_Confirm\" \"Attribu ...\" (UID: 00000000-00002820), Spawned process \"AliyunWrapExe.Exe\" (UID: 00000000-00004088), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Setup\" \"Activity\" \"Click_Next\"\" (UID: 00000000-00002920), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Licenseagreement\" \"Activity\" \"Click_Accept\"\" (UID: 00000000-00004080), Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Selectdestinationlocation\" \"Activity\" \"Click ...\" (UID: 00000000-00004060)\n Spawned process \"InfoForSetup.exe\" with commandline \"/SendInfo \"Window\" \"Selectadditionaltasks\" \"Activity\" \"Click_Ins ...\" (UID: 00000000-00002384)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.1.3.6.1.4.1.311.60.2.1.2=???, OID.1.3.6.1.4.1.311.60.2.1.1=???, SERIALNUMBER=91510107765360104N, C=CN, S=???, L=???, O=\"CHENGDU YIWO Tech Development Co.\n Ltd.\", CN=\"CHENGDU YIWO Tech Development Co.\n Ltd.\"\" (SHA1: AE:78:5F:CE:AA:24:F2:C1:2B:3A:13:F3:A9:B0:22:E6:34:D6:41:39: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=\"DigiCert\n Inc.\", CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C: (1.2.840.113549.1.1.12); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4\" (SHA1: DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4: (1.2.840.113549.1.1.12); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Setup.exe\" connecting to \"\\ThemeApiPort\"\n \"Setup.tmp\" connecting to \"\\ThemeApiPort\"\n \"AliyunWrapExe.Exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Setup.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"Setup.exe\" touched file \"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui\"\n \"Setup.tmp\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"Setup.tmp\" touched file \"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui\"\n \"Setup.tmp\" touched file \"%WINDIR%\\syswow64\\en\\shell32.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"AliyunWrapExe.Exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"System Security","name":"Observed strings related to Windows privileges","description":"\"seshutdownprivilege\" observed seshutdownprivilege privilege string which can \"Shut down the system\" (Source: 836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3.bin\"","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Setup.tmp\" opened \"\\Device\\KsecDD\"\n \"InfoForSetup.exe\" opened \"\\Device\\KsecDD\"\n \"AliyunWrapExe.Exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"InfoForSetup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"AliyunWrapExe.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"AliyunWrap.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"InfoForSetup.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")\n \"InfoForSetup.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")\n \"InfoForSetup.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"AliyunWrapExe.Exe\" (Thread ID: 2640) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"AliyunWrapExe.Exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Setup.tmp\" read file \"%WINDIR%\\win.ini\"\n \"Setup.tmp\" read file \"%TEMP%\\is-QBFH0.tmp\\version.ini\"\n \"InfoForSetup.exe\" read file \"%TEMP%\\is-QBFH0.tmp\\AliyunConfig.ini\"\n \"InfoForSetup.exe\" read file \"%TEMP%\\is-QBFH0.tmp\\DataFile.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"InfoForSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe]- [targetUID: 00000000-00003552]\n \"AliyunWrapExe.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-QBFH0.tmp\\AliyunWrapExe.exe]- [targetUID: 00000000-00002820]\n \"AliyunWrap.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-QBFH0.tmp\\AliyunWrap.dll]- [targetUID: 00000000-00002920]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"15.2.0.0\"\n Potential IP \"15.2.0.0\" found in string \"/SendInfo \"Window\" \"Selectadditionaltasks\" \"Activity\" \"Click_Install\" \"Attribute\" \"{\\\"Test_id\\\":\\\"TR15200-0615\\\"\n\\\"Version\\\":\\\"Trial_trial\\\"\n\\\"Num\\\":\\\"15.2.0.0\\\"\n\\\"Language\\\":\\\"en\\\"}\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 216.92.47.198 on port 80 is sent without HTTP header\n TCP traffic to 47.252.97.212 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"AliyunWrapExe.Exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%TEMP%\\is-QBFH0.tmp\\AliyunWrapExe.Exe\" marked \"%TEMP%\\is-QBFH0.tmp\\tempInfo.web\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"AliyunWrapExe.Exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"AliyunWrapExe.Exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"AliyunWrapExe.Exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"AliyunWrapExe.Exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"AliyunWrapExe.Exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"AliyunWrapExe.Exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"AliyunWrapExe.exe\" claimed CRC 151941 while the actual is CRC 123401\n \"AliyunWrap.dll\" claimed CRC 539258 while the actual is CRC 151941","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount\n VirtualAlloc\n SetSecurityDescriptorDacl\n RegCloseKey\n GetUserNameW\n RegOpenKeyW\n LookupAccountNameW\n GetFileAttributesW\n DeleteFileW\n CreateFileW\n CreateFileA\n URLDownloadToFileW\n CryptEncrypt\n OpenProcessToken\n CreateProcessAsUserW\n GetFileAttributesA\n GetDriveTypeA\n CopyFileW\n CreateThread\n GetSystemDirectoryA\n SleepEx\n CreateToolhelp32Snapshot\n ExitThread\n OpenProcess\n FindFirstFileA\n Process32NextW\n GetCommandLineA\n Process32FirstW\n GetModuleHandleA\n CreateProcessW\n GetModuleFileNameExW\n accept\n WSAStartup\n connect\n closesocket\n send\n listen\n recv\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"InfoForSetup.exe\" wrote bytes \"0efcec7781edeb77ae86ea77c6e0e977effdec772d16eb77c0fce877da8ff3776014ed77478dea77a8e2e9776089ea7700000000ad37ee768b2dee76b641ee7600000000\" to virtual address \"0x74171000\" (part of module \"WSHIP6.DLL\")\n \"InfoForSetup.exe\" wrote bytes \"711162007a3b6100ab8b02007f950200fc8c0200729602006cc805001ecd5e007d265e00\" to virtual address \"0x778D07E4\" (part of module \"USER32.DLL\")\n \"InfoForSetup.exe\" wrote bytes \"c0dfe9771cf9e877ccf8e8770d64ea7700000000c0119e7500000000fc3e9e7500000000e0139e75000000009457417725e0e977c6e0e97700000000bc6a407700000000cf319e750000000093194177000000002c329e7500000000\" to virtual address \"0x76B91000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"InfoForSetup.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"3/90 Antivirus vendors marked dropped file \"InfoForSetup.exe\" as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)\n 1/67 Antivirus vendors marked dropped file \"AliyunWrapExe.exe\" as malicious (classified as \"malicious.995666\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"3/90 Antivirus vendors marked spawned process \"InfoForSetup.exe\" (PID: 2820) as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)\n 1/67 Antivirus vendors marked spawned process \"AliyunWrapExe.Exe\" (PID: 4088) as malicious (classified as \"malicious.995666\" with 1% detection rate)\n 3/90 Antivirus vendors marked spawned process \"InfoForSetup.exe\" (PID: 2920) as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)\n 3/90 Antivirus vendors marked spawned process \"InfoForSetup.exe\" (PID: 4080) as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)\n 3/90 Antivirus vendors marked spawned process \"InfoForSetup.exe\" (PID: 4060) as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)\n 3/90 Antivirus vendors marked spawned process \"InfoForSetup.exe\" (PID: 2384) as malicious (classified as \"Trojan.Waldek\" with 3% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"Setup.tmp\" allocated memory in \"%PROGRAMFILES%\\, \"Setup.tmp\" allocated memory in \"%WINDIR%\\SysWOW64\\msftedit.dll\", \"Setup.tmp\" allocated memory in \"%WINDIR%\\SysWOW64\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\n log-c-lite_0.1.0","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2c","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs files to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":95,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":89,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"62ab46242d4cdd5a56526159","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Setup.exe","analysis_start_time":"2022-06-16T15:03:17+00:00","indicators_count":{"informative":26,"suspicious":29,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.92.47.198","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"address":"47.252.97.212","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"dns_resolutions":[{"domain":"easeusinfo.us-east-1.log.aliyuncs.com","address":"47.252.97.212","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Zhejiang Alibaba Cloud Computing Ltd. (浙江阿里巴巴云计算有限公司)","registrar_name_servers":"NS3.ALIYUN.COM","registrar_creation_date":"2012-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"domain":"track.easeus.com","address":"216.92.47.198","ttl":600,"country":"United States","registrar_name":"HICHINA ZHICHENG TECHNOLOGY LTD.","registrar_organization":"Nexperian Holding Limited","registrar_name_servers":"DNS19.HICHINA.COM","registrar_creation_date":"2004-08-27T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"http_requests":[{"host":"track.easeus.com","host_ip":"216.92.47.198:80","url":"/product/index.php?c=main&a=getstatus&pid=2","method":"GET","header":"GET /product/index.php?c=main&a=getstatus&pid=2 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: track.easeus.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"host":"easeusinfo.us-east-1.log.aliyuncs.com","host_ip":"47.252.97.212:80","url":"/logstores/logstore_windrw_ip/shards/lb","method":"POST","header":"POST /logstores/logstore_windrw_ip/shards/lb HTTP/1.1\nHost:easeusinfo.us-east-1.log.aliyuncs.com\nUser-Agent: log-c-lite_0.1.0\nAccept: */*\nContent-Type:application/x-protobuf\nx-log-apiversion:0.6.0\nx-log-compresstype:lz4\nx-log-signaturemethod:hmac-sha1\nDate:Thu, 16 Jun 2022 13:07:46 GMT\nContent-MD5:4D777513C42EE6C306DA245E50D95A64\nContent-Length:231\nx-log-bodyrawsize:229\nAuthorization:LOG LTAIBDHwLKKvsH19:1CFeQMGbaFdkFw9tUFJw0nWPA9s=","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}],"processes":[{"pid":3188,"ppid":0,"name":"Setup.exe","command_line":"","sha256":"836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3","normalized_path":"C:\\Setup.exe","uid":"00000000-00003188","icon":"$2d"},{"pid":3552,"ppid":3188,"name":"Setup.tmp","command_line":"/SL5=\"$50226,54475194,192512,C:\\Setup.exe\"","sha256":"7ad0f906750160eebeb6b310fe9f72e646a12886b5d6a15d1333b6e231c9a7fc","normalized_path":"%TEMP%\\is-3222P.tmp\\Setup.tmp","parent_uid":"00000000-00003188","uid":"00000000-00003552"},{"pid":2820,"ppid":3552,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Langsel\" \"Activity\" \"Click_Confirm\" \"Attribute\" \"{\\\"Language\\\":\\\"en\\\"}\"","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","normalized_path":"%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe","parent_uid":"00000000-00003552","uid":"00000000-00002820"},{"pid":4088,"ppid":2820,"name":"AliyunWrapExe.Exe","command_line":"","sha256":"4e47e4b8f7a203ee68287ead5504064803a1c2263b57064594ce2095815471e7","normalized_path":"%TEMP%\\is-QBFH0.tmp\\AliyunWrapExe.Exe","parent_uid":"00000000-00002820","uid":"00000000-00004088"},{"pid":2920,"ppid":3552,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Setup\" \"Activity\" \"Click_Next\"","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","normalized_path":"%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe","parent_uid":"00000000-00003552","uid":"00000000-00002920"},{"pid":4080,"ppid":3552,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Licenseagreement\" \"Activity\" \"Click_Accept\"","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","normalized_path":"%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe","parent_uid":"00000000-00003552","uid":"00000000-00004080"},{"pid":4060,"ppid":3552,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Selectdestinationlocation\" \"Activity\" \"Click_Confirm\" \"Attribute\" \"{\\\"Path\\\":\\\"%PROGRAMFILES%\\EaseUS/EaseUS Data Recovery Wizard\\\"}\"","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","normalized_path":"%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe","parent_uid":"00000000-00003552","uid":"00000000-00004060"},{"pid":2384,"ppid":3552,"name":"InfoForSetup.exe","command_line":"/SendInfo \"Window\" \"Selectadditionaltasks\" \"Activity\" \"Click_Install\" \"Attribute\" \"{\\\"Test_id\\\":\\\"TR15200-0615\\\",\\\"Version\\\":\\\"Trial_trial\\\",\\\"Num\\\":\\\"15.2.0.0\\\",\\\"Language\\\":\\\"en\\\"}\"","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","normalized_path":"%TEMP%\\is-QBFH0.tmp\\InfoForSetup.exe","parent_uid":"00000000-00003552","uid":"00000000-00002384"}],"all_imported_dlls":["msftedit.dll","sfc_os.dll","profapi.dll","shfolder.dll","wow64.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","ExplorerFrame.dll","duser.dll","IPHLPAPI.DLL","ntdll.dll","comctl32.dll","urlmon.dll","msctf.dll","secur32.dll","dhcpcsvc6.dll","nsi.dll","comdlg32.dll","msasn1.dll","devrtl.dll","npmproxy.dll","wow64win.dll","mpr.dll","msimg32.dll","shlwapi.dll","version.dll","sfc.dll","userenv.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wininet.dll","netmsg.dll","ncrypt.dll","sspicli.dll","cryptbase.dll","setupapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","bcrypt.dll","dui70.dll","mswsock.dll","dwmapi.dll","Wldap32.dll","nlaapi.dll","usp10.dll","apphelp.dll","uxtheme.dll","devobj.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winnsi.dll","dhcpcsvc.dll","wshqos.dll","wow64cpu.dll","oleaut32.dll","rpcrt4.dll","msacm32.dll","bcryptprimitives.dll","rsaenh.dll","samcli.dll","api-ms-win-core-synch-l1-2-0.dll","AliyunWrap.dll","wship6.dll","dnsapi.dll","WSHTCPIP.DLL","RpcRtRemote.dll","user32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","clbcatq.dll","psapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netprofm.dll","rasadhlp.dll","cryptsp.dll","kernel32.dll","msvcrt.dll","advapi32.dll","winmm.dll","fltLib.dll","sechost.dll","lpk.dll","shell32.dll","webio.dll","FWPUCLNT.DLL","KernelBase.dll","gdi32.dll","AcGenral.dll","cfgmgr32.dll","ws2_32.dll","tiptsf.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","tzres.dll","imm32.dll","RstrtMgr.dll","imageres.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AliyunWrapExe.exe","sha256":"4e47e4b8f7a203ee68287ead5504064803a1c2263b57064594ce2095815471e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"InfoForSetup.exe","sha256":"4180e2b9918b0bdd20a7a1a9863f169bde0590a8089a2c3d7a2952f23df045b0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"AliyunWrap.dll","sha256":"af8612abcb8daaae505455b18778a90fc4208ac3277e7a7fa495f85eedc1693a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-4C1A6.tmp","sha256":"398c77e086d09e114265c9530f7f604c1651f084b03d2ac64d53451c7a6674c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-7TKGJ.tmp","sha256":"924f38150935b6c497ae6564e49d59178aae124636ebc0217ee5ae53522248ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-920E3.tmp","sha256":"80a5c9e7fe1933b011d75a68eef857ae42f3e4184b81a4347299ffece3fcbb2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-D52D4.tmp","sha256":"4a4c16a3663485a410c50a6cf58d8150cf2b96a4fed1492a1ac37053fb12af8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-G55J6.tmp","sha256":"313e1bebbd1b29c7b225223c2a43bab6f6a651d0e0b0cab276b2e431fe70eac2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-GUJPL.tmp","sha256":"15fb0280344ca0c0668995cc88fe36016558adcaf6852f079f416efd2691ab2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-H83D4.tmp","sha256":"d419fed3c58ea20520d627b5001adcfa7f3d324b94ddc6a4ea9ea67d56305269","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-HUGKH.tmp","sha256":"bdfeb0fe6d4db2f8078ca3e7c014a40f2df32dac10d543f49133b028a51d0bf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-IPC1B.tmp","sha256":"17975226d3e14d3cb1ffc5dffaa313d671a39627506d21e9c621ad97e4cf0f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-J76PJ.tmp","sha256":"0dd4bd4dffff66f72203e7fe0ce9363e99f532fd34a6549dfbb0600611f89186","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-LLG3U.tmp","sha256":"8d84e26342416daef19c31d66a3108a0377e776f953f2fce658f78da4eeb0837","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-N0877.tmp","sha256":"8b42d4ccc3ad6dad756bcbebbf387ac693eedcb7ec26830a9714fa048cf15bdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-NMUHP.tmp","sha256":"3520bc6a3937bdc74e4182eee1caca2b6eb5eb6d0482e090c7c9ed0cc1a0d3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-S697R.tmp","sha256":"84be8a482ff0492b07b371533d84308bbd3049791cde70c00eb283d53b24bd60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-VDQ39.tmp","sha256":"36b3e359140d948d35f63163b04eaa4ea17e0a160d0d15e39d57b12dadee4b62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-I4LAF.tmp","sha256":"021bf243fc9d94326f73d86e686e6b52efe92e846e5a47aca1fb448bdee2241d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-S5KNC.tmp","sha256":"8b48a9b29ba3ebc5280048d46cba4e9a282ac3b2f8475aacfae2b67e2d6483a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-0EN88.tmp","sha256":"17975226d3e14d3cb1ffc5dffaa313d671a39627506d21e9c621ad97e4cf0f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-2MG52.tmp","sha256":"84be8a482ff0492b07b371533d84308bbd3049791cde70c00eb283d53b24bd60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"is-3FP9E.tmp","sha256":"d419fed3c58ea20520d627b5001adcfa7f3d324b94ddc6a4ea9ea67d56305269","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\index[1].htm","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%TEMP%\\is-QBFH0.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-RFNOE.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-QJEGL.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Danish\\images\\is-EPOVA.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Korean\\images\\is-U7T94.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Korean\\images\\is-5FLHV.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Korean\\images\\is-EG1S0.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Malay\\images\\is-9D4PM.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Malay\\images\\is-PH2DD.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Portuguesa\\images\\is-4S7GF.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Portuguesa\\images\\is-CTADF.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Portuguesa\\images\\is-OA4RF.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Spanish\\images\\is-19UVC.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Svenska\\images\\is-CC1BJ.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Thai\\images\\is-92TTR.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%TEMP%\\is-QBFH0.tmp\\DataFile.ini","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\aliyun\\is-CEITJ.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\aliyun\\is-DL0JE.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\aliyun\\is-000LB.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\aliyun\\is-LK94Q.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-TO1TS.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-47PHP.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-DN089.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-Q4FJH.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-C01T2.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-N0NG6.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\is-ON80Q.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\config\\is-G046N.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-ARU4I.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-NH5KJ.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-U5K05.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-A48CU.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-DC6JD.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-97R6G.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-D3045.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-2E93R.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-L7FE8.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-OMOPE.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\language\\is-MPIPH.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\NasConfig\\is-P524R.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\NasConfig\\is-63AD6.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\NasConfig\\is-PJ9TT.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\is-I4LAF.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\images\\is-NMUHP.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\images\\is-HUGKH.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\images\\is-4C1A6.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\images\\is-H83D4.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Arabic\\images\\is-LLG3U.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\is-KJKE9.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-BGHSD.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-G8NN5.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-3UFLV.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-CJ9QP.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-TI10E.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\images\\is-BPM62.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Chinese\\js\\is-EOPQ1.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-7JQG5.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-L6QCT.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-VSD4C.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-AK53U.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\images\\is-2MG52.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\ChineseTrad\\js\\is-IALOV.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Danish\\is-LG23O.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Danish\\images\\is-JUVT9.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Danish\\images\\is-U8VBL.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Deutsch\\is-PHVKJ.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Deutsch\\images\\is-M9GH5.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Deutsch\\images\\is-S8QFD.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Deutsch\\images\\is-0A19L.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Deutsch\\images\\is-PI2JQ.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\is-2QUS7.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-GC34N.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-M3HSA.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-OA4B6.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-G28KU.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-1ME1S.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"path":"%PROGRAMFILES%\\EaseUS\\EaseUS Data Recovery Wizard\\InnerBuyRSS\\Dutch\\images\\is-G90FR.tmp","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DRW_Setup","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"DRW_Setup","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$ALIYUNCONFIG.INI","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C$$USERS$%OSUSER%$APPDATA$LOCAL$TEMP$IS-QBFH0.TMP$DATAFILE.INI","sources":[{"report_type":"sandbox","report_id":"62ab46242d4cdd5a56526159"}]}]}},"report_ids":{"sandbox_job_ids":["62ab46242d4cdd5a56526159"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample 836527ba46b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 836527ba46b8…. Threat score 100/100. 0/26 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 836527ba46b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 836527ba46b8…. Threat score 100/100. 0/26 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/836527ba46b8de0049bb71e0af443caba55a9e7d5cc67ba3a1681f5e0241a3e3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 836527ba46b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 836527ba46b8…. Threat score 100/100. 0/26 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]