24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 746c2f953228… — Score 79/100 — Hybrid Analysis","description":"Malicious verdict for sample 746c2f953228…. Malware family: Trojan.Generic. Threat score 79/100. 13/28 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b"],"about":{"@type":"SoftwareApplication","name":"winsv.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","additionalType":"Malicious sample"},"threatScore":79,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T44c,"" wrote 32 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00003392) "" wrote 52 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00003392) "" wrote 4 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00003392) "" wrote 122880 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00003392) "" wrote 32 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00000324) "" wrote 52 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00000324) "" wrote 4 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00000324) "" wrote 122880 bytes to a foreign process "746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b" (PID: 00000324)26:T5dc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAP6SURBVFhHXZYBluMwCENz9BxtbpYxkj7g7r5OU8fBICSR5/m+731ffZ73+f7+/nRd33zerO973u999V2/v+/53meuz8JZf86q1zmL/VqrDQp27r7nD4d483m0Ap517atN5/NkX+/V8y6g7quglUj/Pmv7mSR/AhKgUq4ACaIklICzrz96qCraqFRS61Dt18fP3AhUAUZd9dTmDS3wVAD/C6yNjqP6wCCTw7tlJJ31hnyhrULcgoEf2NyWFVw9Hmhdln8rQbVnCvGakRvEgmT4wvokcG6ABKSEjEC5kXKreMZcETaJU3vNF6+5zU4MpOq3EoDRaZkqMoN9zwermeZDVZ5rENRh2YuazANQCjGbH40IPaank1AfmGTMWivlkuSqDBQgGjJVrDxrRHzuSdDQNPzIaFUuOVLdSWZ7hAkWTqy2FPNdQLgSBYEgHJkWKBsHUv8gUg6WHkI6JZuetz7PBa1KmN7TRDzP1HMmsBMzAn2IYRnpBapwAdYvCcUJByHz6ebDKKji3y0UTnY8SBcJBVqIaIrPvc32W7Lh1EravJhWAL9VAiGStVwrLPf11nuIupitxAtaSMXBZ83QV95RTdAWSvyHpYbVwVqnYS3QkxiHFS/aUKL3bdUmaD6b6LUWNA/vloP9QCx0Mg8qOci3vaGHi22/+eSDzYVBAKfxentIPQpcaNVDyA90FYEZolnbbSg9H1ASBMektimhnkbA1jkBqcwPO2OGEAnzu80mg8sV395iaWvZoyQDrX2AIFOtIeIw27NJCSoKJIjtci03qWpISEz5A22J9KWCsUhzEy/IuMxQyeFNnnAihwmhK5H0P0SeQafym09G4GSLD6AENm3bRW6uwtyAmN2+jZrat96Cmk9xwUjRFV6SQT4xlS3NZblm+TKnNScUT4UNh1AJJLYK0LqgTQvSZ5Lq6Vd7Flqj+Ul4Zr3XtnT5zcwwhyCLejla3lOsuDAEi4tReTF+GN0voza2WHyehyeQNsSf1yb1dhnTPriwGSR+Eur2hXi2pPaP/XKzk8hQW3YZyICNqYerjbstjUdWNhYpvQ/fY9ir1cIZ2/1C0i64qrcx5d0gvd/9VDju6zq+oUTirLugoHTJvna2AVWA9BNJqSWaBXyj9cOD4kASw9kgEZKGdOOKqb4JnwQugkkavBXlcB20elqG02gVc2Ney+n2REVN11zJGULAuix241CbvSFcyS/7xtWQWfygJYotj6ybwEG1z93BtsYFe7x+T0iqwbIxHGYEfNrOqL2S7ShpjGpbp2QYm0y1dqt5pd7tGkcbVXRB4ZP5E0dNLEnRxClUvcHw/pCE1kRq01e3aztbgilZK2hm7ya6bD8vObX+D8UFlIsdEMYcAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":79,"unified_at_epoch_ms":1790599060096,"unified_at":"2026-09-28T12:37:40.096Z","metadata":{"hashes":{"sha256":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","sha1":"5f06cf2bdbde4dd0a14288ccd3d8eba8e4a74db2","md5":"4f0552476fb3d0779f873effa8823d44","sha512":"f109500c57f101514687c088d3d54abda097d93a4f0e191299a37a35eddc280ec6e6ab509fff4a0fe0a638700e5af403c44d70c94960c9d2b2a309fae26a0bfc","ssdeep":"3072:wXWCLLb50fdW1LDkUc1I4cz/QeFpl9oBn1OlcxARmweWWKyU:I3bP7cmVseX41OqqRS","ssdeep_chunks":["3072:wXWCLLb","3072:XWCLLb5","3072:WCLLb50","3072:CLLb50f","3072:LLb50fd","3072:Lb50fdW","3072:b50fdW1","3072:50fdW1L","3072:0fdW1LD","3072:fdW1LDk","3072:dW1LDkU","3072:W1LDkUc","3072:1LDkUc1","3072:LDkUc1I","3072:DkUc1I4","3072:kUc1I4c","3072:Uc1I4cz","3072:c1I4cz/","3072:1I4cz/Q","3072:I4cz/Qe","3072:4cz/QeF","3072:cz/QeFp","3072:z/QeFpl","3072:/QeFpl9","3072:QeFpl9o","3072:eFpl9oB","3072:Fpl9oBn","3072:pl9oBn1","3072:l9oBn1O","3072:9oBn1Ol","3072:oBn1Olc","3072:Bn1Olcx","3072:n1OlcxA","3072:1OlcxAR","3072:OlcxARm","3072:lcxARmw","3072:cxARmwe","3072:xARmweW","3072:ARmweWW","3072:RmweWWK","3072:mweWWKy","3072:weWWKyU","6144:wXWCLLb","6144:XWCLLb5","6144:WCLLb50","6144:CLLb50f","6144:LLb50fd","6144:Lb50fdW","6144:b50fdW1","6144:50fdW1L","6144:0fdW1LD","6144:fdW1LDk","6144:dW1LDkU","6144:W1LDkUc","6144:1LDkUc1","6144:LDkUc1I","6144:DkUc1I4","6144:kUc1I4c","6144:Uc1I4cz","6144:c1I4cz/","6144:1I4cz/Q","6144:I4cz/Qe","6144:4cz/QeF","6144:cz/QeFp","6144:z/QeFpl","6144:/QeFpl9","6144:QeFpl9o","6144:eFpl9oB","6144:Fpl9oBn","6144:pl9oBn1","6144:l9oBn1O","6144:9oBn1Ol","6144:oBn1Olc","6144:Bn1Olcx","6144:n1OlcxA","6144:1OlcxAR","6144:OlcxARm","6144:lcxARmw","6144:cxARmwe","6144:xARmweW","6144:ARmweWW","6144:RmweWWK","6144:mweWWKy","6144:weWWKyU","3072:I3bP7cm","3072:3bP7cmV","3072:bP7cmVs","3072:P7cmVse","3072:7cmVseX","3072:cmVseX4","3072:mVseX41","3072:VseX41O","3072:seX41Oq","3072:eX41Oqq","3072:X41OqqR","3072:41OqqRS"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"winsv.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":184320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297643000,"last_seen":1659987542000,"last_multi_scan":1659987542000}},"detections":{"summary":{"verdict":"malicious","score":79,"tags":null},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":17,"malicious_count":5,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.NetWiredRC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1202159","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Injector.LMP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e39a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.NetWiredRC.asr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NetWiredRC.dvnahb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_FA.18A285E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_FA.18A285E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL8.BYRD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"46.20.33.82:3444\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IPumgObt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"C:\\Windows\\System32\\riched20.dll\" at 72A00000\n \"HKRUN.exe\" loaded module \"C:\\Windows\\System32\\riched20.dll\" at 728F0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 6A3A0000\n \"HKRUN.exe\" loaded module \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69E90000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"HKRUN.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"21-08-2015\" has type \"data\"\n \"HKRUN.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"\n \".Identifier\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.14744778877","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")\n \"HKRUN.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"HKRUN.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"HKRUN.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Windows\\win.ini\"\n \"HKRUN.exe\" read file \"C:\\Windows\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config\"\n \"\" created file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"HKRUN.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"HKRUN.exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"HKRUN.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"REGEDIT1\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\")\n \"HKRUN.exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{SL5JY177-PJ3Y-E8CD-646H-S0V6OY4OJKL6}\")\n \"HKRUN.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{SL5JY177-PJ3Y-E8CD-646H-S0V6OY4OJKL6}\", Key: \"STUBPATH\", Value: \"\"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"39.85.149.40\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.3384.580671\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.3384.580687\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3384.581046\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"HKRUN.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"db4d787200000000\" to virtual address \"0x00E52000\" (part of module \"746C2F953228F7777866B3791A2F946C8AF5E4FD0BD0A698A4E59632FAB92C9B\")\n \"\" wrote bytes \"24128106\" to virtual address \"0x6AF41FDC\" (part of module \"MSCORWKS.DLL\")\n \"\" wrote bytes \"4053b5775858b677186ab677653cb7770000000000bf57770000000056cc5777000000007cca5777000000003768e0756a2cb777d62db777000000002069e0750000000029a6577700000000a48de07500000000f70e577700000000\" to virtual address \"0x76561000\" (part of module \"NSI.DLL\")\n \"HKRUN.exe\" wrote bytes \"db4d787200000000\" to virtual address \"0x00D72000\" (part of module \"HKRUN.EXE\")\n \"HKRUN.exe\" wrote bytes \"8fe80f33\" to virtual address \"0x6A991FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"HKRUN.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"HKRUN.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"HKRUN.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/56 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b\"\n \"\" allocated memory in \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"\n \"HKRUN.exe\" allocated memory in \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\HKRUN.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 46.20.33.82 on port 3444","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491721\n \"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491722\n \"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491765\n \"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491766\n \"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491797\n \"\" queried SystemProcessInformation at 00487593-00000452-76FE61F8-491798","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"55d708e70e316d066def2869","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"Injector.LMP","contacted_countries":["DEU"],"submit_name":"winsv.exe","analysis_start_time":"2015-08-21T06:18:58+00:00","indicators_count":{"informative":6,"suspicious":18,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"55d7057d0e316d4e028076f9","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":45,"malware_family":"Injector.LMP","contacted_countries":["DEU","NLD","ROU","SWE"],"submit_name":"winsv.exe","analysis_start_time":"2015-08-21T06:04:34+00:00","indicators_count":{"informative":3,"suspicious":11,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.20.33.82","port":3444,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"address":"62.102.148.181","port":57980,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"address":"46.165.208.108","port":3490,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"address":"213.152.162.99","port":3829,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"address":"109.163.226.153","port":3829,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"address":"95.211.229.148","port":3939,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}],"processes":[{"pid":3384,"ppid":0,"name":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","command_line":"","normalized_path":"","uid":"00036624-00003384","icon":"$26"},{"pid":3684,"ppid":0,"name":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","command_line":"","normalized_path":"","uid":"00038310-00003684"},{"pid":1152,"ppid":0,"name":"HKRUN.exe","command_line":"","normalized_path":"","uid":"00038730-00001152"},{"pid":3884,"ppid":0,"name":"HKRUN.exe","command_line":"","normalized_path":"","uid":"00040282-00003884"}],"all_imported_dlls":["advapi32.dll","mscoreei.dll","shell32.dll","msasn1.dll","nsi.dll","WSHTCPIP.DLL","KernelBase.dll","shlwapi.dll","mscorwks.dll","mscorjit.dll","System.Windows.Forms.ni.dll","GdiPlus.dll","psapi.dll","mswsock.dll","ntdll.dll","kernel32.dll","usp10.dll","cryptbase.dll","cryptsp.dll","System.Drawing.ni.dll","RpcRtRemote.dll","rasadhlp.dll","gdi32.dll","imm32.dll","msctf.dll","riched20.dll","oleaut32.dll","pnrpnsp.dll","msvcrt.dll","rpcrt4.dll","System.ni.dll","apphelp.dll","FWPUCLNT.DLL","mscorlib.ni.dll","comctl32.dll","NapiNSP.dll","dnsapi.dll","winrnr.dll","sechost.dll","user32.dll","lpk.dll","ole32.dll","profapi.dll","rsaenh.dll","version.dll","mscoree.dll","msvcr80.dll","uxtheme.dll","System.Windows.Forms.dll","dwmapi.dll","crypt32.dll","ws2_32.dll","nlaapi.dll","USP10.dll","SETUPAPI.dll","GDI32.dll","MSCTF.dll","USER32.dll","LPK.dll","CFGMGR32.dll","DEVOBJ.dll","KERNEL32.dll","gdiplus.dll","ADVAPI32.dll","CRYPTBASE.dll","SspiCli.dll","SHLWAPI.dll","VERSION.dll","OLEAUT32.dll","CRYPTSP.dll","RPCRT4.dll","RichEd20.DLL","PSAPI.DLL","IMM32.DLL","KERNELBASE.dll","MSCOREE.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"21-08-2015","sha256":"d031704dc1e5db6230757be9ccf53e7bb29422c779f303c59ae7f503ad07478b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"name":"HKRUN.exe","sha256":"746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"name":".Identifier","sha256":"8675547d8684c8e829a27891052b01a685570802307453304034dc923622db30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"},{"report_type":"sandbox","report_id":"55d7057d0e316d4e028076f9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{SL5JY177-PJ3Y-E8CD-646H-S0V6OY4OJKL6}\\","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IPumgObt","sources":[{"report_type":"sandbox","report_id":"55d708e70e316d066def2869"}]}]}},"report_ids":{"sandbox_job_ids":["55d708e70e316d066def2869","55d7057d0e316d4e028076f9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 746c2f953228… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 746c2f953228…. Malware family: Trojan.Generic. Threat score 79/100. 13/28 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 746c2f953228… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 746c2f953228…. Malware family: Trojan.Generic. Threat score 79/100. 13/28 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/746c2f953228f7777866b3791a2f946c8af5e4fd0bd0a698a4e59632fab92c9b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 746c2f953228… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 746c2f953228…. Malware family: Trojan.Generic. Threat score 79/100. 13/28 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]