26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T427,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a84a0d8c0ba5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a84a0d8c0ba5…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215"],"about":{"@type":"SoftwareApplication","name":"WinToUSB_Free.exe","applicationCategory":["peexe","executable"],"identifier":"a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":4,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c9,"GET /wintousb/thanks-install.html HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.easyuefi.com DNT: 1 Connection: Keep-Alive" "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCYyccBU%2BO5JwoAAAABM%2FlK HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog"28:T559,Process "WinToUSB_Free.tmp" (UID: 00000000-00003172) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "WinToUSB_Free.tmp" (UID: 00000000-00003172) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "dismhost.exe" (UID: 00000000-00003436) was launched with modified environment variables: "CommonProgramFiles, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles" Process "dismhost.exe" (UID: 00000000-00003436) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "iexplore.exe" (UID: 00000000-00001652) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\26bXBr2", HOMEDRIVE="C:"" Process "iexplore.exe" (UID: 00000000-00001652) was launched with modified environment variables: "CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles" Process "IEXPLORE.EXE" (UID: 00000000-00000172) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "IEXPLORE.EXE" (UID: 00000000-00000172) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"29:T772,"dismhost.exe.620FE970.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows" "Uninstall Hasleo WinToUSB.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Feb 18 17:45:13 2022 mtime=Fri Feb 18 17:45:13 2022 atime=Fri Feb 18 17:41:36 2022 length=1342673 window=hide" "Hasleo WinToUSB.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Feb 18 17:45:15 2022 mtime=Fri Feb 18 17:45:15 2022 atime=Tue Feb 15 19:55:08 2022 length=8867840 window=hide" "urlblockindex_1_.bin" has type "data" "unins000.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-3PPNV.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "main_1_.js" has type "HTML document ASCII text" "is-P4OGP.tmp" has type "GNU message catalog (little endian) revision 0.0 165 messages" "softpedia-review_1_.png" has type "PNG image data 120 x 40 8-bit/color RGBA non-interlaced" "is-E0K0F.tmp" has type "GNU message catalog (little endian) revision 0.0 338 messages" "is-1SKJB.tmp" has type "GNU message catalog (little endian) revision 0.0 341 messages" "is-KN0UH.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-QCKIB.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-M4MFS.tmp" has type "GNU message catalog (little endian) revision 0.0 341 messages" "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data" "is-MDMJR.tmp" has type "GNU message catalog (little endian) revision 0.0 241 messages" "70DAE932E3BCB3C00656A27B544BA9CA" has type "data" "ver89FD.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "is-0NUFO.tmp" has type "GNU message catalog (little endian) revision 0.0 341 messages"2a:T76f,"WinToUSB_Free.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "WinToUSB_Free.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "WinToUSB_Free.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "WinToUSB_Free.tmp" touched file "C:\Windows\syswow64\en\shell32.dll.mui" "WinToUSB_Free.tmp" touched file "C:\Windows\AppPatch\sysmain.sdb" "dismhost.exe" touched file "C:\Windows\TEMP\DDF12F8C-96BC-42F0-B170-684EE9426465\en-US\dismhost.exe.mui" "iexplore.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "IEXPLORE.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CP53U0VR\global-new[1].css" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAC5QEAJ\logo[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H3XVNPGD\icon_home[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P6QSO9MS\question[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EKCX8E9R\check[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98FKNM2M\forbid[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VC2ME0V4\wintousb-boxshot-small[1].png" "IEXPLORE.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VC2ME0V4\christmas2014-plus[1].png"2b:T13fc,Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "1.6.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IPs "0.0.0.0" "0.0.0.0" found in string ""2c:T62e,"WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB.lnk" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB.pif" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB.url" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB on the Web.lnk" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB on the Web.pif" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Hasleo WinToUSB on the Web.url" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Uninstall Hasleo WinToUSB.lnk" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Uninstall Hasleo WinToUSB.pif" with delete access "WinToUSB_Free.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo WinToUSB\Uninstall Hasleo WinToUSB.url" with delete access "WinToUSB_Free.tmp" opened "C:\Users\Public\Desktop\Hasleo WinToUSB.lnk" with delete access "WinToUSB_Free.tmp" opened "C:\Users\Public\Desktop\Hasleo WinToUSB.pif" with delete access "WinToUSB_Free.tmp" opened "C:\Users\Public\Desktop\Hasleo WinToUSB.url" with delete access2d:T487,RegCloseKey OpenProcessToken RegOpenKeyExW GetSystemInfo GetModuleFileNameW GetVersionExW VirtualProtect GetFileAttributesW GetFileSize LockResource GetCommandLineW UnhandledExceptionFilter LoadLibraryExW CreateDirectoryW DeleteFileW GetProcAddress LoadLibraryW GetSystemDirectoryW WriteFile GetStartupInfoA FindFirstFileW GetModuleHandleW FindResourceW CreateFileW CreateProcessW Sleep GetTickCount VirtualAlloc SetSecurityDescriptorDacl OutputDebugStringW OutputDebugStringA GetVersionExA GetStartupInfoW MapViewOfFile CreateFileMappingW CreateThread FindResourceExW TerminateProcess GetModuleHandleExW RegDeleteValueW RegOpenKeyW IsDebuggerPresent GetModuleFileNameA GetModuleHandleA LoadLibraryA CreateFileA GetCommandLineA RegOpenKeyExA GetDriveTypeA RegCreateKeyExW RegDeleteKeyW GetUserNameW RegEnumKeyExW GetDriveTypeW GetLogicalDrives DeviceIoControl CopyFileW ExitThread OpenProcess GetComputerNameW FindNextFileW WNetOpenEnumW ShellExecuteW ShellExecuteExW GetCursorPos SetWindowsHookExW GetLastActivePopup FindWindowExW FindWindowW GetWindowThreadProcessId CreateProcessAsUserW2e:Tab8,"WinToUSB_Free.exe" wrote bytes "711154017a3b5301ab8b02007f950200fc8c0200729602006cc805001ecd50017d265001" to virtual address "0x769807E4" (part of module "USER32.DLL") "WinToUSB_Free.exe" wrote bytes "c0dfe6771cf9e577ccf8e5770d64e77700000000c011367600000000fc3e367600000000e01336760000000094570d7625e0e677c6e0e67700000000bc6a0c7600000000cf3136760000000093190d76000000002c32367600000000" to virtual address "0x759D1000" (part of module "NSI.DLL") "WinToUSB_Free.tmp" wrote bytes "f8113676201436764cbc3876f5163676a911367685483676b9343676a93436766834367600000000a56bf375e485f375e04df3759cc0f375a3bff37592aef3750c7df37500000000" to virtual address "0x73F31000" (part of module "MSIMG32.DLL") "WinToUSB_Free.tmp" wrote bytes "711154017a3b5301ab8b02007f950200fc8c0200729602006cc805001ecd50017d265001" to virtual address "0x769807E4" (part of module "USER32.DLL") "WinToUSB_Free.tmp" wrote bytes "c0dfe6771cf9e577ccf8e5770d64e77700000000c011367600000000fc3e367600000000e01336760000000094570d7625e0e677c6e0e67700000000bc6a0c7600000000cf3136760000000093190d76000000002c32367600000000" to virtual address "0x759D1000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "d04f2df5fe070000f01d663f01000000101e663f01000000e036663f01000000501e663f010000000000000000000000" to virtual address "0x3F668000" "IEXPLORE.EXE" wrote bytes "8032f0007032f0000032f0006032f0005032f0004032f0003032f000000000002cc9d176c021f000000000009017f0005023f0000018f000601ff0002036f000000000004036f00000000000" to virtual address "0x00F08000" "IEXPLORE.EXE" wrote bytes "b033ed73" to virtual address "0x00F070C0" "IEXPLORE.EXE" wrote bytes "8049ed73" to virtual address "0x766892E8" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "7048ed73" to virtual address "0x7668B0C8" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "b033ed73" to virtual address "0x7668917C" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "f031ed73" to virtual address "0x7668B0BC" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "a035ed73" to virtual address "0x7668B0CC" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "b033ed73" to virtual address "0x75D917CC" (part of module "ADVAPI32.DLL") "IEXPLORE.EXE" wrote bytes "711154017a3b5301ab8b02007f950200fc8c0200729602006cc805001ecd50017d265001" to virtual address "0x769807E4" (part of module "USER32.DLL") "IEXPLORE.EXE" wrote bytes "a047ed73" to virtual address "0x76689274" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "c0dfe6771cf9e577ccf8e5770d64e77700000000c011367600000000fc3e367600000000e01336760000000094570d7625e0e677c6e0e67700000000bc6a0c7600000000cf3136760000000093190d76000000002c32367600000000" to virtual address "0x759D1000" (part of module "NSI.DLL")2f:T67a,"WinToUSB_Free.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-RJO3U.tmp\WinToUSB_Free.tmp" (Handle: 204) "WinToUSB_Free.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-RJO3U.tmp\WinToUSB_Free.tmp" (Handle: 204) "WinToUSB_Free.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-RJO3U.tmp\WinToUSB_Free.tmp" (Handle: 204) "WinToUSB_Free.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-RJO3U.tmp\WinToUSB_Free.tmp" (Handle: 204) "WinToUSB_Free.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-RJO3U.tmp\WinToUSB_Free.tmp" (Handle: 204) "WinToUSB_Free.tmp" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 936) "WinToUSB_Free.tmp" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 936) "WinToUSB_Free.tmp" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 936) "WinToUSB_Free.tmp" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 936) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 860) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 860) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 860) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 860)30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzIyAAAAAAAAAAAAAAADMzMzMzMwAAAAAAAAAAADMzMzMzMzMzAAAAAAAAAAMzMzMzMzMzMzAAAAAAAAAzMzMzOzMzMzM3AAAAAAADMzMzM7szd3d3d3AAAAAAMzMzMzu7N3iIiId3AAAAAzMzMzM7u3iIiIiIhzAAAAMzMzMzu7t4iIhmZ4iAAAAzMzMzM7u7iHZmZmaIhwAAMzMzMzu7u3Znd2ZmiIgAADMzMzM7u7hmiIh2Z4iIIAB2czMzO7u2aIiIiIiIiDAGZmYzMzu7doiIiIiIiHhwRmZmd3d3dmd3d3d3d3dmZGZmZmZmZmZmZmZmZmZmZmYGZmZmZmZmZ3d4iIiIh2cQBGZmRmZmZmd3d4iIiHd5EABmZERmZmZmd3d3d3d3mRAARmREZmZmZndmZ3d3d5kAAAZmREZmZmZmZmd3d5mRAAAEZkREZmZmGXZnd5mZkAAABGZEREZmZhEVmZmZmRAAAABGZEREZmYRERmZmZEAAAAABEREREZmERERERGQAAAAAABEREREZhEREREREAAAAAAABERERGYREREREAAAAAAAAABERERGEREREQAAAAAAAAAAAERERBEREQAAAAAAAAAAAAAAAEQREAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/8A///4AB//4AAP/8AAA/+AAAH/AAAA/gAAAHwAAAB8AAAAOAAAADgAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAGAAAABgAAAAcAAAAPAAAAD4AAAB/AAAA/wAAAf/AAAP/4AAH//gAH//+AP/w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzIyAAAAAAAAAAAAAAADMzMzMzMwAAAAAAAAAAADMzMzMzMzMzAAAAAAAAAAMzMzMzMzMzMzAAAAAAAAAzMzMzOzMzMzM3AAAAAAADMzMzM7szd3d3d3AAAAAAMzMzMzu7N3iIiId3AAAAAzMzMzM7u3iIiIiIhzAAAAMzMzMzu7t4iIhmZ4iAAAAzMzMzM7u7iHZmZmaIhwAAMzMzMzu7u3Znd2ZmiIgAADMzMzM7u7hmiIh2Z4iIIAB2czMzO7u2aIiIiIiIiDAGZmYzMzu7doiIiIiIiHhwRmZmd3d3dmd3d3d3d3dmZGZmZmZmZmZmZmZmZmZmZmYGZmZmZmZmZ3d4iIiIh2cQBGZmRmZmZmd3d4iIiHd5EABmZERmZmZmd3d3d3d3mRAARmREZmZmZndmZ3d3d5kAAAZmREZmZmZmZmd3d5mRAAAEZkREZmZmGXZnd5mZkAAABGZEREZmZhEVmZmZmRAAAABGZEREZmYRERmZmZEAAAAABEREREZmERERERGQAAAAAABEREREZhEREREREAAAAAAABERERGYREREREAAAAAAAAABERERGEREREQAAAAAAAAAAAERERBEREQAAAAAAAAAAAAAAAEQREAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/8A///4AB//4AAP/8AAA/+AAAH/AAAA/gAAAHwAAAB8AAAAOAAAADgAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAGAAAABgAAAAcAAAAPAAAAD4AAAB/AAAA/wAAAf/AAAP/4AAH//gAH//+AP/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791088139062,"unified_at":"2026-10-04T04:28:59.062Z","metadata":{"hashes":{"sha256":"a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215","sha1":"73a941a5437bcf5e97161d7629564a654ce3a538","md5":"68209a0b62e565c506c480b1ecd84124","sha512":"ac7b23af4f251888d61ec65fd3c4840f23546b2c3c35fa61df4f56bd76e4efec5d758717ab92fcd7d8788fb295c6c14a1d93752139b5e9feedcfd994dc1345b4","ssdeep":"98304:EWAaFJy5iP8Gl3WLxLs812MptD2lxxJSIdbbLxveIMwowtRDzcwG:n1jX5l3W9Ls812OClfJSebNcwtdc9","ssdeep_chunks":["98304:EWAaFJy","98304:WAaFJy5","98304:AaFJy5i","98304:aFJy5iP","98304:FJy5iP8","98304:Jy5iP8G","98304:y5iP8Gl","98304:5iP8Gl3","98304:iP8Gl3W","98304:P8Gl3WL","98304:8Gl3WLx","98304:Gl3WLxL","98304:l3WLxLs","98304:3WLxLs8","98304:WLxLs81","98304:LxLs812","98304:xLs812M","98304:Ls812Mp","98304:s812Mpt","98304:812MptD","98304:12MptD2","98304:2MptD2l","98304:MptD2lx","98304:ptD2lxx","98304:tD2lxxJ","98304:D2lxxJS","98304:2lxxJSI","98304:lxxJSId","98304:xxJSIdb","98304:xJSIdbb","98304:JSIdbbL","98304:SIdbbLx","98304:IdbbLxv","98304:dbbLxve","98304:bbLxveI","98304:bLxveIM","98304:LxveIMw","98304:xveIMwo","98304:veIMwow","98304:eIMwowt","98304:IMwowtR","98304:MwowtRD","98304:wowtRDz","98304:owtRDzc","98304:wtRDzcw","98304:tRDzcwG","196608:EWAaFJy","196608:WAaFJy5","196608:AaFJy5i","196608:aFJy5iP","196608:FJy5iP8","196608:Jy5iP8G","196608:y5iP8Gl","196608:5iP8Gl3","196608:iP8Gl3W","196608:P8Gl3WL","196608:8Gl3WLx","196608:Gl3WLxL","196608:l3WLxLs","196608:3WLxLs8","196608:WLxLs81","196608:LxLs812","196608:xLs812M","196608:Ls812Mp","196608:s812Mpt","196608:812MptD","196608:12MptD2","196608:2MptD2l","196608:MptD2lx","196608:ptD2lxx","196608:tD2lxxJ","196608:D2lxxJS","196608:2lxxJSI","196608:lxxJSId","196608:xxJSIdb","196608:xJSIdbb","196608:JSIdbbL","196608:SIdbbLx","196608:IdbbLxv","196608:dbbLxve","196608:bbLxveI","196608:bLxveIM","196608:LxveIMw","196608:xveIMwo","196608:veIMwow","196608:eIMwowt","196608:IMwowtR","196608:MwowtRD","196608:wowtRDz","196608:owtRDzc","196608:wtRDzcw","196608:tRDzcwG","98304:n1jX5l3","98304:1jX5l3W","98304:jX5l3W9","98304:X5l3W9L","98304:5l3W9Ls","98304:l3W9Ls8","98304:3W9Ls81","98304:W9Ls812","98304:9Ls812O","98304:Ls812OC","98304:s812OCl","98304:812OClf","98304:12OClfJ","98304:2OClfJS","98304:OClfJSe","98304:ClfJSeb","98304:lfJSebN","98304:fJSebNc","98304:JSebNcw","98304:SebNcwt","98304:ebNcwtd","98304:bNcwtdc","98304:Ncwtdc9"],"imphash":"20dd26497880c05caed9305b3c8b9109"},"file_info":{"file_name":"WinToUSB_Free.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6107601,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1645209562000,"last_seen":1677196499000,"last_multi_scan":1677196499000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":22,"suspicious_count":11,"malicious_count":4,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-46477350\n \"WinToUSB_Free.tmp\" queries volume information of \"%PROGRAMFILES%\\Hasleo\\WinToUSB\\bin\\WinToUSB.exe\" at 00000000-00003172-00000046-46500692\n \"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-47076847\n \"WinToUSB_Free.tmp\" queries volume information of \"%PROGRAMFILES%\\Hasleo\\WinToUSB\\unins000.exe\" at 00000000-00003172-00000046-47077975\n \"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-47148622\n \"WinToUSB_Free.tmp\" queries volume information of \"%PROGRAMFILES%\\Hasleo\\WinToUSB\\bin\\WinToUSB.exe\" at 00000000-00003172-00000046-47149754","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-46477350\n \"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-47076847\n \"WinToUSB_Free.tmp\" queries volume information of \"C:\\\" at 00000000-00003172-00000046-47148622","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/65 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.easyuefi.com\"\n \"ocsp.pki.goog\"\n \"crls.pki.goog\"\n \"crl.pki.goog\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"192.163.192.196:80\"\n \"192.163.192.196:443\"\n \"142.250.191.110:443\"\n \"172.217.4.35:80\"\n \"142.250.190.14:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\BaseNamedObjects\\DBWinMutex\"\n \"\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\BaseNamedObjects\\Global\\SetupLog\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_IESQMMUTEX_0_519\"\n \"IsoScope_674_IESQMMUTEX_0_303\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"IsoScope_674_IESQMMUTEX_0_519\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IsoScope_674_ConnHashTable<1652>_HashTable_Mutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.620FE970.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\"), Antivirus vendors marked dropped file \"unins000.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"is-3PPNV.tmp\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"is-KN0UH.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00001652)\n Launches browser \"IEXPLORE.EXE\" (UID: 00000000-00000172)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$28","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"iexplore.exe\" with commandline \"http://www.easyuefi.com/wintousb/thanks-install.html\" (UID: 00000000-00001652)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WinToUSB_Free.tmp\" searching for class \"Shell_TrayWnd\"\n \"WinToUSB_Free.tmp\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WinToUSB_Free.tmp\" with commandline \"/SL5=\"$401EA\n5521978\n253952\nC:\\WinToUSB_Free.exe\"\" (UID: 00000000-00003172)\n Spawned process \"dismhost.exe\" with commandline \"{5117DF46-3ED8-410C-854A-5DC1004E632F}\" (UID: 00000000-00003436)\n Spawned process \"iexplore.exe\" with commandline \"http://www.easyuefi.com/wintousb/thanks-install.html\" (UID: 00000000-00001652)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:1652 CREDAT:275457 /prefetch:2\" (UID: 00000000-00000172)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WinToUSB_Free.tmp\" with commandline \"/SL5=\"$401EA\n5521978\n253952\nC:\\WinToUSB_Free.exe\"\" (UID: 00000000-00003172)\n Spawned process \"dismhost.exe\" with commandline \"{5117DF46-3ED8-410C-854A-5DC1004E632F}\" (UID: 00000000-00003436)\n Spawned process \"iexplore.exe\" with commandline \"http://www.easyuefi.com/wintousb/thanks-install.html\" (UID: 00000000-00001652)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:1652 CREDAT:275457 /prefetch:2\" (UID: 00000000-00000172)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"WinToUSB_Free.exe\" connecting to \"\\ThemeApiPort\"\n \"WinToUSB_Free.tmp\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2\"\n Pattern match: \"http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline\"\n Pattern match: \"www.easyuefi.com\"\n Pattern match: \"http://www.easyuefi.com/wintousb/thanks-install.html\"\n Pattern match: \"https://www.easyuefi.com/wintohdd/index.html\"\n Pattern match: \"https://go.microsoft.com/fwlink/?LinkID=401352\"\n Pattern match: \"https://go.microsoft.com/fwlink/?LinkID=513071\"\n Pattern match: \"https://aka.ms/FlashEOLUpdate\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WinToUSB_Free.tmp\" opened \"\\Device\\KsecDD\"\n \"dismhost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215.bin\" was detected as \"Borland Delphi 4.0\"\n \"unins000.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-KN0UH.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-QCKIB.tmp\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"WinToUSB_Free.tmp\" at 00000000-00003172-00000033-51784292\n \"dismhost.exe\" at 00000000-00003436-00000033-3396016","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"WinToUSB_Free.tmp\" queried SystemProcessInformation at 00000000-00003172-00000033-22251496\n \"WinToUSB_Free.tmp\" queried SystemProcessInformation at 00000000-00003172-00000033-22251999","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"IEXPLORE.EXE\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.21066652492","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"dismhost.exe.620FE970.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"unins000.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"is-3PPNV.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"is-KN0UH.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"is-QCKIB.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2b","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 192.163.192.196 on port 80 is sent without HTTP header\n TCP traffic to 192.163.192.196 on port 443 is sent without HTTP header\n TCP traffic to 142.250.191.110 on port 443 is sent without HTTP header\n TCP traffic to 172.217.4.35 on port 80 is sent without HTTP header\n TCP traffic to 142.250.190.14 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dismhost.exe.620FE970.bin\" claimed CRC 141269 while the actual is CRC 6170463\n \"unins000.dll\" claimed CRC 803810 while the actual is CRC 141269\n \"is-3PPNV.tmp\" claimed CRC 207992 while the actual is CRC 803810\n \"is-QCKIB.tmp\" claimed CRC 73623 while the actual is CRC 1344046","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2d","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/69 Antivirus vendors marked dropped file \"is-QCKIB.tmp\" as malicious (classified as \"Malware.Generic\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"WinToUSB_Free.tmp\" allocated memory in \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\n Microsoft-CryptoAPI/6.1","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":42,"imported_dlls_count":158,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"620fe7d909280d358c3aceb4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"WinToUSB_Free.exe","analysis_start_time":"2022-02-18T18:39:35+00:00","indicators_count":{"informative":22,"suspicious":19,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"192.163.192.196","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"address":"192.163.192.196","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"address":"142.250.191.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"address":"172.217.4.35","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"address":"142.250.190.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"dns_resolutions":[{"domain":"crl.pki.goog","address":"172.217.4.35","ttl":49,"country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"domain":"crls.pki.goog","address":"142.250.190.14","ttl":3409,"country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"domain":"ocsp.pki.goog","address":"172.217.4.35","ttl":21,"country":"United States","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"domain":"www.easyuefi.com","address":"192.163.192.196","ttl":14400,"country":"United States","registrar_name":"XINNET TECHNOLOGY CORPORATION","registrar_organization":"XINNET WHOIS PRIVACY PRO SERVICE","registrar_name_servers":"NS1.BLUEHOST.COM","registrar_creation_date":"2013-04-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"http_requests":[{"host":"www.easyuefi.com","host_ip":"192.163.192.196:80","url":"/wintousb/thanks-install.html","method":"GET","header":"GET /wintousb/thanks-install.html HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.easyuefi.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.4.35:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.4.35:80","url":"/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D","method":"GET","header":"GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"host":"crls.pki.goog","host_ip":"142.250.190.14:80","url":"/gts1c3/moVDfISia2k.crl","method":"GET","header":"GET /gts1c3/moVDfISia2k.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crls.pki.goog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.4.35:80","url":"/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCYyccBU%2BO5JwoAAAABM%2FlK","method":"GET","header":"GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCYyccBU%2BO5JwoAAAABM%2FlK HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"host":"crl.pki.goog","host_ip":"172.217.4.35:80","url":"/gtsr1/gtsr1.crl","method":"GET","header":"GET /gtsr1/gtsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}],"processes":[{"pid":3188,"ppid":0,"name":"WinToUSB_Free.exe","command_line":"","sha256":"a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215","normalized_path":"C:\\WinToUSB_Free.exe","uid":"00000000-00003188","icon":"$30"},{"pid":3172,"ppid":3188,"name":"WinToUSB_Free.tmp","command_line":"/SL5=\"$401EA,5521978,253952,C:\\WinToUSB_Free.exe\"","sha256":"96a06bb69b18d2b588bd1c408aaf3c1304b866473d1c893cff909f7330cbd490","normalized_path":"%TEMP%\\is-RJO3U.tmp\\WinToUSB_Free.tmp","parent_uid":"00000000-00003188","uid":"00000000-00003172"},{"pid":1652,"ppid":3172,"name":"iexplore.exe","command_line":"http://www.easyuefi.com/wintousb/thanks-install.html","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003172","uid":"00000000-00001652"},{"pid":172,"ppid":1652,"name":"IEXPLORE.EXE","command_line":"SCODEF:1652 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE","parent_uid":"00000000-00001652","uid":"00000000-00000172"},{"pid":3436,"ppid":0,"name":"dismhost.exe","command_line":"{5117DF46-3ED8-410C-854A-5DC1004E632F}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\TEMP\\DDF12F8C-96BC-42F0-B170-684EE9426465\\dismhost.exe","uid":"00000000-00003436","icon":"$31"}],"all_imported_dlls":["drvstore.dll","mscoree.dll","sxs.dll","wshqos.dll","DWrite.dll","DismCorePS.dll","wdscore.dll","SPInf.dll","kernel32.dll","sspicli.dll","slc.dll","wkscli.dll","d2d1.dll","ExplorerFrame.dll","api-ms-win-downlevel-version-l1-1-0.dll","mscorwks.dll","rpcrt4.dll","msimg32.dll","imageres.dll","RpcRtRemote.dll","gpapi.dll","deploy.dll","jscript9.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","netapi32.dll","oleaccrc.dll","dhcpcsvc.dll","imm32.dll","advapi32.dll","lpk.dll","ieproxy.dll","mscoreei.dll","schannel.dll","mlang.dll","msvcr100.dll","WSHTCPIP.DLL","sqmapi.dll","nlaapi.dll","wow64cpu.dll","comctl32.dll","cfgmgr32.dll","wbemprox.dll","SwDir_1231201.dll","shell32.dll","duser.dll","wbemsvc.dll","Wldap32.dll","netutils.dll","crypt32.dll","credssp.dll","SSShim.dll","usp10.dll","unins000.dll","msasn1.dll","sfc.dll","d3d11.dll","KernelBase.dll","cryptbase.dll","tiptsf.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","DismProv.dll","sfc_os.dll","xmllite.dll","winhttp.dll","wow64win.dll","msctf.dll","nsi.dll","apphelp.dll","dui70.dll","ntmarta.dll","ole32.dll","shfolder.dll","iertutil.dll","CbsCore.dll","clbcatq.dll","linkinfo.dll","mshtml.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","cryptnet.dll","DrUpdate.dll","ntdll.dll","msvcrt.dll","version.dll","comdlg32.dll","profapi.dll","propsys.dll","MSOHEV.DLL","imagehlp.dll","VxSSL64.dll","DmiProvider.dll","msimtf.dll","d3d10warp.dll","bcrypt.dll","dhcpcsvc6.dll","wow64.dll","gdi32.dll","mswsock.dll","rasadhlp.dll","SensApi.dll","jp2ssv.dll","rpcss.dll","winnsi.dll","uxtheme.dll","devrtl.dll","ieframe.dll","wininet.dll","LogProvider.dll","shlwapi.dll","mpr.dll","ntdsapi.dll","fastprox.dll","userenv.dll","wship6.dll","ieui.dll","msvcr90.dll","ssv.dll","bcryptprimitives.dll","setupapi.dll","wbemcomn.dll","rsaenh.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dnsapi.dll","FWPUCLNT.DLL","srvcli.dll","webio.dll","URLREDIR.DLL","user32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","npmproxy.dll","wintrust.dll","oleaut32.dll","sechost.dll","dwmapi.dll","ncrypt.dll","msftedit.dll","ntshrui.dll","cscapi.dll","netprofm.dll","ws2_32.dll","netmsg.dll","RstrtMgr.dll","cryptsp.dll","normaliz.dll","IEShims.dll","IPHLPAPI.DLL","oleacc.dll","WindowsCodecs.dll","OSProvider.dll","devobj.dll","urlmon.dll","dxgi.dll","npctrl.dll","dbghelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-QCKIB.tmp","sha256":"791fd89645f65052c3d28af93597f08f6557d94fefa92d82fa319214ee6bd258","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"dismhost.exe.620FE970.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"unins000.dll","sha256":"1196a2d93d9a8d465aef6f4fb86f07c8103404398224e92405bcaa9bd64e96af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-3PPNV.tmp","sha256":"d405e66b29b5cc7dc08ce0a2ad8923d9810c6f3580403ce2cfa6f55798ec578b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-KN0UH.tmp","sha256":"13d1b75072a192ab2ad3bcb5d439772d4a09448f96eac78c7a706eb20f1af1e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Uninstall Hasleo WinToUSB.lnk","sha256":"79001d17b88918e02264099414f932ce5b72f959d37721dc34a2fc1c6d5f9b66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Hasleo WinToUSB.lnk","sha256":"f20353be887a6620a1f8d4740f0dd65d01433472e91564f703b157143bf36336","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"main_1_.js","sha256":"a9f6d803d9d61a3378997a9f10c2fa80ff016ffe70018b6efddbf9c88ad925a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-P4OGP.tmp","sha256":"3be4a1c883d7112e1782b1098b4e304eae0701642d2cf5a88e25fb5081845859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"softpedia-review_1_.png","sha256":"f318268ba5d1e586eb9a462be508cb044366b61e03c05b5b27a95dfb1d3736b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-E0K0F.tmp","sha256":"377f5a3f457144839592263d779352dcc1ae4fc031ba6f80770e57aff03e2a43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-1SKJB.tmp","sha256":"6b9a777408d26ab00d7cf91b0108a6604e4e897f3314845d870cc2fa2dd003a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-M4MFS.tmp","sha256":"b7e73ab1393c91b0e1daa811161004f5df3741fbae41b29d97f97b9aff348b53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA","sha256":"1060542f1fb77a10fe67b858b0829f9d896b7caa13d541f9e31e09c2836209fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-MDMJR.tmp","sha256":"925a257045a02c88f342b08a4681a6ecca9aba4b8ccd6000b176eae52ae04ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"70DAE932E3BCB3C00656A27B544BA9CA","sha256":"2849f55dd23a845d5355eb63f35fb16af78630b6e23a2377e5caa4148fd60cf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"ver89FD.tmp","sha256":"159bd4343f344a08f6af3b716b6fa679859c1bd1d7030d26ff5ef0255b86e1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"is-0NUFO.tmp","sha256":"25ffbc38f2103cc1df406601a847402c09c28dcf5e3bb372ba233887415b3adc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_ConnHashTable<1652>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_IE_EarlyTabStart_0xb70_Mutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1652","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1652","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_ConnHashTable<1652>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"IsoScope_674_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_674_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"620fe7d909280d358c3aceb4"}]}]}},"report_ids":{"sandbox_job_ids":["620fe7d909280d358c3aceb4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample a84a0d8c0ba5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a84a0d8c0ba5…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample a84a0d8c0ba5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a84a0d8c0ba5…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a84a0d8c0ba5ad5edf1fb68d1ff5eb14d647cf3733186da13064be17efa54215"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample a84a0d8c0ba5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a84a0d8c0ba5…. Threat score 100/100. 0/1 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]