26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Johnnie.Generic Sample c94ce321cf0e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c94ce321cf0e…. Malware family: Johnnie.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","keywords":["Malicious","Johnnie.Generic","malware analysis","sandbox report","threat intelligence","c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8"],"about":{"@type":"SoftwareApplication","name":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","applicationCategory":["peexe","executable"],"identifier":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Johnnie.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T421,"" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN") "" (Access type: "SETVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN", Key: "HKLM", Value: "C:\Windows\install\logonwindows.exe") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN") "" (Access type: "SETVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN", Key: "HKCU", Value: "C:\Windows\install\logonwindows.exe") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{754B680G-Q5IU-2288-K2V8-1CS822172J7U}") "" (Access type: "SETVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{754B680G-Q5IU-2288-K2V8-1CS822172J7U}", Key: "STUBPATH", Value: "C:\Windows\install\logonwindows.exe Restart")28:T9d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbvSURBVFhH1Zd5UJR1GMfR8AjzTEABIYEFlmMXuUFcDtdAxTBFyQOvtKzRPNI8yvBILZ0mp1EnnWmaHE0NR0GsBQEBFYGKFZZlhU3lkkOQQ44XlOPb83udl1DY1f7QmZj5zr7s877v83nO910Dg1fwVxp3AKmRs/BboAynLOxx9f15eAVuDQxufb8ZCYsiodiwFTdj41H2923U1NRA8fEGtNddfHkQLcVncf2jKGQcPoaKigrU1taioaEBjx49Qnd3N1K370Rr1fm+AIkGBrhMSu6lFDr+L1IvCUXq8qUoURegsbGRd86ifvDgAVpbW3mANALg7l8AcOVpiGvkrJrUajgY3OCh4F4fBm7kGHAm48FZWIGzFoGzdwTnJAUncQMndSfRp7MrOLELWmzFuOoTgJrycjQ1NfU4FwBaWlrQ1dVFALvQ1h9AHjnvGG2KDrEbOpw9/5XEG53u/ujymYpu/1BgygxANpMUBgTMAgLfAYJmQ+0ZhDJVPh8pi5g5FiRkgAGkUwb6BVATwGMrEdq9A9HuG9yvHk2WoyNoJrpDI4CZkaQFQNhCNEydDeWR43ydWb2F1AvRs+9KtVoUJl1BYtQKdLYl9i1BPgG0WdmBIwDOJ+i5apeFoitkLkG8h5wZEWApZhKiZxD19fUozldDEbEYiaNMsXX0m4g5urGvczaXuQTQYilCk5eMFPBi8g5APZWm4MQpPH78mI+eRS10fsWdO0j2D0HFtAi0DxuB6uilvPM+DcgAcgigycIWDR5T0OApeyE9pPNu+U1FI0XKcVxP9HV1dXw20pZ9iMqQeeDkEWg2Gg7N2nf7d84Asgmg3twatW6TUUtN9yKqp/Pyor9CZ2cnHj582FN7lvqa+/eRd/wnqEg5h44gZ6wZFMajdC+gDAKoHT8Rla6+qJzk91xV0TklUl9UFGjQ3t4OFrXQ9UL92USwzm9ra0OGgwQ3V83UDZBOAFWmViilsSuT+DxXleQ8b+FydHR0oLm5+anOF/qALSNmZ+XJEkuhWjdXNwDbeOUmlrjj5Ik7zl7PVamLN26fielpvt6jJ2SClYKNJgPIdnRFATWhzgdRAgGUjLVAodgdhY4eeqUlexFrPkp7f4tHAGBlYeVh52QRgEofwCUCuD3GDPl2k5Bv76ZXRQRZ9M23fPS9dz5zzJzepwYUIJidHWdSD+TqA4glgMJR46G0lUIpctWpXLIVeQWitqy838WTsX4zkvzluExKZJ+yt5HkJ0eR0QjcoDHUWYIYAlCPMEW2tQuybST96g/6Xk3Z0R75gU+r0Pls+7ExLC8sxF1qziKC1IikvIqcvHDbZTKK6QF3eZFcN8BpAsh9wxjXrZyQ8ZZzH2USmNrBHZqNW/iOF5yzY5ZmVo7CfQdRaecGlbUESjr/iSQocPCGetAQHBoySDfACQL402gs0iaIkWbp2CM1jWRB2FxoV38C7dlzqK6u7vOw4bcglaSYSpM30QVXe13P7pVh6Qyl4RB8TT50luBHMt4YOgZJZvZIsnBAsoUY1ygTJduj+eiYk97LRph1lno2aoWbtqHU0QuZEyX8tewePTK1RRa9Z+zRB3CMjOlDRkMxTgQFQSRbOiFb5IaKXXv5bdbfuLE5Z2NWfD4O5R6BuOXih2u2k5BMZUygeyjM7HhdGm2J9IGGiNYHcJiMSYNG4qKJDX43d0AKRaJ09EHl7n38q9SzAMJLRllKKrSy6aiaPANK1wBcc/BCirUUCspCPAUTT9HHjrSg172B+FwfwHdkVBiOQBxdoKDor4jckSeVoWr3fh6A7XOhBOyTNd7dn09CEzQLtaELCSIcf3nKkeHij1Q7DyRYOeMiAVyggM4NN8clAtiiD+AgGeMNhyN2HKWNok8V+0DlIUf1nicAbKezRyxrwruXk6FduQb58kjUR6xByYxlyA+ahxy/MGS6BSPN0RcJ1q6IM3PAOWNrnBk2HhcIYJM+gP1kjKUMxNJFCTZuSHP2R77PdDyIWoXqk6dRdfQ4ij/7AqrwRVDKF0A7fxMao3agZO56aMI+gGraYihlc5DlFYJ0lylItHVHnIUjYgjglNE4xBDAen0Au8l4gWXAXIwEkQfSJTLcpIhuBc9HZlAEskOXIXfOepRFRaNh5QHcW7IX2gU7oInYDHX4Gqimr4AyKBJZvmFIlwYi0c4TcROc8KuxDU4MNcYvBgOwVh/ARjLGDHgNiuGmuGIyEVm0DzQEUkM3a/ELBxcchebQ1aibtQHVszehIvxT3Atbh3shq3EvcDHKfMJR6hqMu/be0FD9s0xtkDLKHPG0W84PGIpDdP8V+gD8yMhS9CVp1zNi2WF69vsX+X8nXbeNFEky1wdAG4ptqZetV/K79P/j5B8eiGZh3eXMhAAAAABJRU5ErkJggg==29:T9d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbvSURBVFhH1Zd5UJR1GMfR8AjzTEABIYEFlmMXuUFcDtdAxTBFyQOvtKzRPNI8yvBILZ0mp1EnnWmaHE0NR0GsBQEBFYGKFZZlhU3lkkOQQ44XlOPb83udl1DY1f7QmZj5zr7s877v83nO910Dg1fwVxp3AKmRs/BboAynLOxx9f15eAVuDQxufb8ZCYsiodiwFTdj41H2923U1NRA8fEGtNddfHkQLcVncf2jKGQcPoaKigrU1taioaEBjx49Qnd3N1K370Rr1fm+AIkGBrhMSu6lFDr+L1IvCUXq8qUoURegsbGRd86ifvDgAVpbW3mANALg7l8AcOVpiGvkrJrUajgY3OCh4F4fBm7kGHAm48FZWIGzFoGzdwTnJAUncQMndSfRp7MrOLELWmzFuOoTgJrycjQ1NfU4FwBaWlrQ1dVFALvQ1h9AHjnvGG2KDrEbOpw9/5XEG53u/ujymYpu/1BgygxANpMUBgTMAgLfAYJmQ+0ZhDJVPh8pi5g5FiRkgAGkUwb6BVATwGMrEdq9A9HuG9yvHk2WoyNoJrpDI4CZkaQFQNhCNEydDeWR43ydWb2F1AvRs+9KtVoUJl1BYtQKdLYl9i1BPgG0WdmBIwDOJ+i5apeFoitkLkG8h5wZEWApZhKiZxD19fUozldDEbEYiaNMsXX0m4g5urGvczaXuQTQYilCk5eMFPBi8g5APZWm4MQpPH78mI+eRS10fsWdO0j2D0HFtAi0DxuB6uilvPM+DcgAcgigycIWDR5T0OApeyE9pPNu+U1FI0XKcVxP9HV1dXw20pZ9iMqQeeDkEWg2Gg7N2nf7d84Asgmg3twatW6TUUtN9yKqp/Pyor9CZ2cnHj582FN7lvqa+/eRd/wnqEg5h44gZ6wZFMajdC+gDAKoHT8Rla6+qJzk91xV0TklUl9UFGjQ3t4OFrXQ9UL92USwzm9ra0OGgwQ3V83UDZBOAFWmViilsSuT+DxXleQ8b+FydHR0oLm5+anOF/qALSNmZ+XJEkuhWjdXNwDbeOUmlrjj5Ik7zl7PVamLN26fielpvt6jJ2SClYKNJgPIdnRFATWhzgdRAgGUjLVAodgdhY4eeqUlexFrPkp7f4tHAGBlYeVh52QRgEofwCUCuD3GDPl2k5Bv76ZXRQRZ9M23fPS9dz5zzJzepwYUIJidHWdSD+TqA4glgMJR46G0lUIpctWpXLIVeQWitqy838WTsX4zkvzluExKZJ+yt5HkJ0eR0QjcoDHUWYIYAlCPMEW2tQuybST96g/6Xk3Z0R75gU+r0Pls+7ExLC8sxF1qziKC1IikvIqcvHDbZTKK6QF3eZFcN8BpAsh9wxjXrZyQ8ZZzH2USmNrBHZqNW/iOF5yzY5ZmVo7CfQdRaecGlbUESjr/iSQocPCGetAQHBoySDfACQL402gs0iaIkWbp2CM1jWRB2FxoV38C7dlzqK6u7vOw4bcglaSYSpM30QVXe13P7pVh6Qyl4RB8TT50luBHMt4YOgZJZvZIsnBAsoUY1ygTJduj+eiYk97LRph1lno2aoWbtqHU0QuZEyX8tewePTK1RRa9Z+zRB3CMjOlDRkMxTgQFQSRbOiFb5IaKXXv5bdbfuLE5Z2NWfD4O5R6BuOXih2u2k5BMZUygeyjM7HhdGm2J9IGGiNYHcJiMSYNG4qKJDX43d0AKRaJ09EHl7n38q9SzAMJLRllKKrSy6aiaPANK1wBcc/BCirUUCspCPAUTT9HHjrSg172B+FwfwHdkVBiOQBxdoKDor4jckSeVoWr3fh6A7XOhBOyTNd7dn09CEzQLtaELCSIcf3nKkeHij1Q7DyRYOeMiAVyggM4NN8clAtiiD+AgGeMNhyN2HKWNok8V+0DlIUf1nicAbKezRyxrwruXk6FduQb58kjUR6xByYxlyA+ahxy/MGS6BSPN0RcJ1q6IM3PAOWNrnBk2HhcIYJM+gP1kjKUMxNJFCTZuSHP2R77PdDyIWoXqk6dRdfQ4ij/7AqrwRVDKF0A7fxMao3agZO56aMI+gGraYihlc5DlFYJ0lylItHVHnIUjYgjglNE4xBDAen0Au8l4gWXAXIwEkQfSJTLcpIhuBc9HZlAEskOXIXfOepRFRaNh5QHcW7IX2gU7oInYDHX4Gqimr4AyKBJZvmFIlwYi0c4TcROc8KuxDU4MNcYvBgOwVh/ARjLGDHgNiuGmuGIyEVm0DzQEUkM3a/ELBxcchebQ1aibtQHVszehIvxT3Atbh3shq3EvcDHKfMJR6hqMu/be0FD9s0xtkDLKHPG0W84PGIpDdP8V+gD8yMhS9CVp1zNi2WF69vsX+X8nXbeNFEky1wdAG4ptqZetV/K79P/j5B8eiGZh3eXMhAAAAABJRU5ErkJggg==2a:T9d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbvSURBVFhH1Zd5UJR1GMfR8AjzTEABIYEFlmMXuUFcDtdAxTBFyQOvtKzRPNI8yvBILZ0mp1EnnWmaHE0NR0GsBQEBFYGKFZZlhU3lkkOQQ44XlOPb83udl1DY1f7QmZj5zr7s877v83nO910Dg1fwVxp3AKmRs/BboAynLOxx9f15eAVuDQxufb8ZCYsiodiwFTdj41H2923U1NRA8fEGtNddfHkQLcVncf2jKGQcPoaKigrU1taioaEBjx49Qnd3N1K370Rr1fm+AIkGBrhMSu6lFDr+L1IvCUXq8qUoURegsbGRd86ifvDgAVpbW3mANALg7l8AcOVpiGvkrJrUajgY3OCh4F4fBm7kGHAm48FZWIGzFoGzdwTnJAUncQMndSfRp7MrOLELWmzFuOoTgJrycjQ1NfU4FwBaWlrQ1dVFALvQ1h9AHjnvGG2KDrEbOpw9/5XEG53u/ujymYpu/1BgygxANpMUBgTMAgLfAYJmQ+0ZhDJVPh8pi5g5FiRkgAGkUwb6BVATwGMrEdq9A9HuG9yvHk2WoyNoJrpDI4CZkaQFQNhCNEydDeWR43ydWb2F1AvRs+9KtVoUJl1BYtQKdLYl9i1BPgG0WdmBIwDOJ+i5apeFoitkLkG8h5wZEWApZhKiZxD19fUozldDEbEYiaNMsXX0m4g5urGvczaXuQTQYilCk5eMFPBi8g5APZWm4MQpPH78mI+eRS10fsWdO0j2D0HFtAi0DxuB6uilvPM+DcgAcgigycIWDR5T0OApeyE9pPNu+U1FI0XKcVxP9HV1dXw20pZ9iMqQeeDkEWg2Gg7N2nf7d84Asgmg3twatW6TUUtN9yKqp/Pyor9CZ2cnHj582FN7lvqa+/eRd/wnqEg5h44gZ6wZFMajdC+gDAKoHT8Rla6+qJzk91xV0TklUl9UFGjQ3t4OFrXQ9UL92USwzm9ra0OGgwQ3V83UDZBOAFWmViilsSuT+DxXleQ8b+FydHR0oLm5+anOF/qALSNmZ+XJEkuhWjdXNwDbeOUmlrjj5Ik7zl7PVamLN26fielpvt6jJ2SClYKNJgPIdnRFATWhzgdRAgGUjLVAodgdhY4eeqUlexFrPkp7f4tHAGBlYeVh52QRgEofwCUCuD3GDPl2k5Bv76ZXRQRZ9M23fPS9dz5zzJzepwYUIJidHWdSD+TqA4glgMJR46G0lUIpctWpXLIVeQWitqy838WTsX4zkvzluExKZJ+yt5HkJ0eR0QjcoDHUWYIYAlCPMEW2tQuybST96g/6Xk3Z0R75gU+r0Pls+7ExLC8sxF1qziKC1IikvIqcvHDbZTKK6QF3eZFcN8BpAsh9wxjXrZyQ8ZZzH2USmNrBHZqNW/iOF5yzY5ZmVo7CfQdRaecGlbUESjr/iSQocPCGetAQHBoySDfACQL402gs0iaIkWbp2CM1jWRB2FxoV38C7dlzqK6u7vOw4bcglaSYSpM30QVXe13P7pVh6Qyl4RB8TT50luBHMt4YOgZJZvZIsnBAsoUY1ygTJduj+eiYk97LRph1lno2aoWbtqHU0QuZEyX8tewePTK1RRa9Z+zRB3CMjOlDRkMxTgQFQSRbOiFb5IaKXXv5bdbfuLE5Z2NWfD4O5R6BuOXih2u2k5BMZUygeyjM7HhdGm2J9IGGiNYHcJiMSYNG4qKJDX43d0AKRaJ09EHl7n38q9SzAMJLRllKKrSy6aiaPANK1wBcc/BCirUUCspCPAUTT9HHjrSg172B+FwfwHdkVBiOQBxdoKDor4jckSeVoWr3fh6A7XOhBOyTNd7dn09CEzQLtaELCSIcf3nKkeHij1Q7DyRYOeMiAVyggM4NN8clAtiiD+AgGeMNhyN2HKWNok8V+0DlIUf1nicAbKezRyxrwruXk6FduQb58kjUR6xByYxlyA+ahxy/MGS6BSPN0RcJ1q6IM3PAOWNrnBk2HhcIYJM+gP1kjKUMxNJFCTZuSHP2R77PdDyIWoXqk6dRdfQ4ij/7AqrwRVDKF0A7fxMao3agZO56aMI+gGraYihlc5DlFYJ0lylItHVHnIUjYgjglNE4xBDAen0Au8l4gWXAXIwEkQfSJTLcpIhuBc9HZlAEskOXIXfOepRFRaNh5QHcW7IX2gU7oInYDHX4Gqimr4AyKBJZvmFIlwYi0c4TcROc8KuxDU4MNcYvBgOwVh/ARjLGDHgNiuGmuGIyEVm0DzQEUkM3a/ELBxcchebQ1aibtQHVszehIvxT3Atbh3shq3EvcDHKfMJR6hqMu/be0FD9s0xtkDLKHPG0W84PGIpDdP8V+gD8yMhS9CVp1zNi2WF69vsX+X8nXbeNFEky1wdAG4ptqZetV/K79P/j5B8eiGZh3eXMhAAAAABJRU5ErkJggg==2b:T9d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbvSURBVFhH1Zd5UJR1GMfR8AjzTEABIYEFlmMXuUFcDtdAxTBFyQOvtKzRPNI8yvBILZ0mp1EnnWmaHE0NR0GsBQEBFYGKFZZlhU3lkkOQQ44XlOPb83udl1DY1f7QmZj5zr7s877v83nO910Dg1fwVxp3AKmRs/BboAynLOxx9f15eAVuDQxufb8ZCYsiodiwFTdj41H2923U1NRA8fEGtNddfHkQLcVncf2jKGQcPoaKigrU1taioaEBjx49Qnd3N1K370Rr1fm+AIkGBrhMSu6lFDr+L1IvCUXq8qUoURegsbGRd86ifvDgAVpbW3mANALg7l8AcOVpiGvkrJrUajgY3OCh4F4fBm7kGHAm48FZWIGzFoGzdwTnJAUncQMndSfRp7MrOLELWmzFuOoTgJrycjQ1NfU4FwBaWlrQ1dVFALvQ1h9AHjnvGG2KDrEbOpw9/5XEG53u/ujymYpu/1BgygxANpMUBgTMAgLfAYJmQ+0ZhDJVPh8pi5g5FiRkgAGkUwb6BVATwGMrEdq9A9HuG9yvHk2WoyNoJrpDI4CZkaQFQNhCNEydDeWR43ydWb2F1AvRs+9KtVoUJl1BYtQKdLYl9i1BPgG0WdmBIwDOJ+i5apeFoitkLkG8h5wZEWApZhKiZxD19fUozldDEbEYiaNMsXX0m4g5urGvczaXuQTQYilCk5eMFPBi8g5APZWm4MQpPH78mI+eRS10fsWdO0j2D0HFtAi0DxuB6uilvPM+DcgAcgigycIWDR5T0OApeyE9pPNu+U1FI0XKcVxP9HV1dXw20pZ9iMqQeeDkEWg2Gg7N2nf7d84Asgmg3twatW6TUUtN9yKqp/Pyor9CZ2cnHj582FN7lvqa+/eRd/wnqEg5h44gZ6wZFMajdC+gDAKoHT8Rla6+qJzk91xV0TklUl9UFGjQ3t4OFrXQ9UL92USwzm9ra0OGgwQ3V83UDZBOAFWmViilsSuT+DxXleQ8b+FydHR0oLm5+anOF/qALSNmZ+XJEkuhWjdXNwDbeOUmlrjj5Ik7zl7PVamLN26fielpvt6jJ2SClYKNJgPIdnRFATWhzgdRAgGUjLVAodgdhY4eeqUlexFrPkp7f4tHAGBlYeVh52QRgEofwCUCuD3GDPl2k5Bv76ZXRQRZ9M23fPS9dz5zzJzepwYUIJidHWdSD+TqA4glgMJR46G0lUIpctWpXLIVeQWitqy838WTsX4zkvzluExKZJ+yt5HkJ0eR0QjcoDHUWYIYAlCPMEW2tQuybST96g/6Xk3Z0R75gU+r0Pls+7ExLC8sxF1qziKC1IikvIqcvHDbZTKK6QF3eZFcN8BpAsh9wxjXrZyQ8ZZzH2USmNrBHZqNW/iOF5yzY5ZmVo7CfQdRaecGlbUESjr/iSQocPCGetAQHBoySDfACQL402gs0iaIkWbp2CM1jWRB2FxoV38C7dlzqK6u7vOw4bcglaSYSpM30QVXe13P7pVh6Qyl4RB8TT50luBHMt4YOgZJZvZIsnBAsoUY1ygTJduj+eiYk97LRph1lno2aoWbtqHU0QuZEyX8tewePTK1RRa9Z+zRB3CMjOlDRkMxTgQFQSRbOiFb5IaKXXv5bdbfuLE5Z2NWfD4O5R6BuOXih2u2k5BMZUygeyjM7HhdGm2J9IGGiNYHcJiMSYNG4qKJDX43d0AKRaJ09EHl7n38q9SzAMJLRllKKrSy6aiaPANK1wBcc/BCirUUCspCPAUTT9HHjrSg172B+FwfwHdkVBiOQBxdoKDor4jckSeVoWr3fh6A7XOhBOyTNd7dn09CEzQLtaELCSIcf3nKkeHij1Q7DyRYOeMiAVyggM4NN8clAtiiD+AgGeMNhyN2HKWNok8V+0DlIUf1nicAbKezRyxrwruXk6FduQb58kjUR6xByYxlyA+ahxy/MGS6BSPN0RcJ1q6IM3PAOWNrnBk2HhcIYJM+gP1kjKUMxNJFCTZuSHP2R77PdDyIWoXqk6dRdfQ4ij/7AqrwRVDKF0A7fxMao3agZO56aMI+gGraYihlc5DlFYJ0lylItHVHnIUjYgjglNE4xBDAen0Au8l4gWXAXIwEkQfSJTLcpIhuBc9HZlAEskOXIXfOepRFRaNh5QHcW7IX2gU7oInYDHX4Gqimr4AyKBJZvmFIlwYi0c4TcROc8KuxDU4MNcYvBgOwVh/ARjLGDHgNiuGmuGIyEVm0DzQEUkM3a/ELBxcchebQ1aibtQHVszehIvxT3Atbh3shq3EvcDHKfMJR6hqMu/be0FD9s0xtkDLKHPG0W84PGIpDdP8V+gD8yMhS9CVp1zNi2WF69vsX+X8nXbeNFEky1wdAG4ptqZetV/K79P/j5B8eiGZh3eXMhAAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790297079045,"unified_at":"2026-09-25T00:44:39.045Z","metadata":{"hashes":{"sha256":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","sha1":"f435642bc2b0fa7c9d49aa610fa65a1512e77ec3","md5":"2c58718ef4831319c9e01d9412ecc401","sha512":"3adeed27d45bd836b18db28d90f3e2ca8e2da479d16d805ea36c2c6f265da806ae2160ed368fa69745ca165ac9ce938acf019c8e7ce4bfc603279b563d9b52fe","ssdeep":"6144:3DV0DXSlOKCCC3RgGt3REcCI5XlYUJCYf0Pq+EeDkXY0dtlovvjiT1Yyjxi9:30XxKCCCpItIXJoq0IeGYUoOW","ssdeep_chunks":["6144:3DV0DXS","6144:DV0DXSl","6144:V0DXSlO","6144:0DXSlOK","6144:DXSlOKC","6144:XSlOKCC","6144:SlOKCCC","6144:lOKCCC3","6144:OKCCC3R","6144:KCCC3Rg","6144:CCC3RgG","6144:CC3RgGt","6144:C3RgGt3","6144:3RgGt3R","6144:RgGt3RE","6144:gGt3REc","6144:Gt3REcC","6144:t3REcCI","6144:3REcCI5","6144:REcCI5X","6144:EcCI5Xl","6144:cCI5XlY","6144:CI5XlYU","6144:I5XlYUJ","6144:5XlYUJC","6144:XlYUJCY","6144:lYUJCYf","6144:YUJCYf0","6144:UJCYf0P","6144:JCYf0Pq","6144:CYf0Pq+","6144:Yf0Pq+E","6144:f0Pq+Ee","6144:0Pq+EeD","6144:Pq+EeDk","6144:q+EeDkX","6144:+EeDkXY","6144:EeDkXY0","6144:eDkXY0d","6144:DkXY0dt","6144:kXY0dtl","6144:XY0dtlo","6144:Y0dtlov","6144:0dtlovv","6144:dtlovvj","6144:tlovvji","6144:lovvjiT","6144:ovvjiT1","6144:vvjiT1Y","6144:vjiT1Yy","6144:jiT1Yyj","6144:iT1Yyjx","6144:T1Yyjxi","6144:1Yyjxi9","12288:3DV0DXS","12288:DV0DXSl","12288:V0DXSlO","12288:0DXSlOK","12288:DXSlOKC","12288:XSlOKCC","12288:SlOKCCC","12288:lOKCCC3","12288:OKCCC3R","12288:KCCC3Rg","12288:CCC3RgG","12288:CC3RgGt","12288:C3RgGt3","12288:3RgGt3R","12288:RgGt3RE","12288:gGt3REc","12288:Gt3REcC","12288:t3REcCI","12288:3REcCI5","12288:REcCI5X","12288:EcCI5Xl","12288:cCI5XlY","12288:CI5XlYU","12288:I5XlYUJ","12288:5XlYUJC","12288:XlYUJCY","12288:lYUJCYf","12288:YUJCYf0","12288:UJCYf0P","12288:JCYf0Pq","12288:CYf0Pq+","12288:Yf0Pq+E","12288:f0Pq+Ee","12288:0Pq+EeD","12288:Pq+EeDk","12288:q+EeDkX","12288:+EeDkXY","12288:EeDkXY0","12288:eDkXY0d","12288:DkXY0dt","12288:kXY0dtl","12288:XY0dtlo","12288:Y0dtlov","12288:0dtlovv","12288:dtlovvj","12288:tlovvji","12288:lovvjiT","12288:ovvjiT1","12288:vvjiT1Y","12288:vjiT1Yy","12288:jiT1Yyj","12288:iT1Yyjx","12288:T1Yyjxi","12288:1Yyjxi9","6144:30XxKCC","6144:0XxKCCC","6144:XxKCCCp","6144:xKCCCpI","6144:KCCCpIt","6144:CCCpItI","6144:CCpItIX","6144:CpItIXJ","6144:pItIXJo","6144:ItIXJoq","6144:tIXJoq0","6144:IXJoq0I","6144:XJoq0Ie","6144:Joq0IeG","6144:oq0IeGY","6144:q0IeGYU","6144:0IeGYUo","6144:IeGYUoO","6144:eGYUoOW"],"imphash":"4c5456293dd04d49c619d6907a9be7b8"},"file_info":{"file_name":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","file_type":["peexe","executable"],"file_type_id":"exe","file_size":368640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296935000,"last_seen":1633311153000,"last_multi_scan":1633311153000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":18,"malicious_count":7,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Ngrbot.m4c4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dynamer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1117785","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.22806","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.22806 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.COKI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Llac.khpq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericR-KNM!2C58718EF483","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Llac.edrrup","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Heur.AdvML.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.JJF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.VB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Johnnie.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"unshowmas.ddns.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"181.207.40.230:3460\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\PSPUBWS2.txt\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\PSPUBWS5\"\n \"\\Sessions\\1\\BaseNamedObjects\\QU5244KV047N0E\"\n \"\\Sessions\\1\\BaseNamedObjects\\QU5244KV047N0EPSPUBWS15\"\n \"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"firefox.exe\" (UID: 00010812-00002320)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"C:\\Windows\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00010144-00002140)\n Spawned process \"Explorer.EXE\" (UID: 00010575-00001560)\n Spawned process \"firefox.exe\" (UID: 00010812-00002320)\n Spawned process \"logonwindows.exe\" (UID: 00010993-00002868)\n Spawned process \"logonwindows.exe\" (UID: 00011010-00002516)\n Spawned process \"cscript.exe\" with commandline \"\"C:\\Users\\PSPUBWS\\AppData\\Roaming\\PSPUBWSv1.18.0 - Trial version.vbs\"\" (UID: 00011669-00001972)\n Spawned process \"logonwindows.exe\" (UID: 00013215-00002072)\n Spawned process \"logonwindows.exe\" (UID: 00013241-00002032)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00010144-00002140-23758-122-004071C4\n GetUserNameA@ADVAPI32.DLL at 00010144-00002140-23758-173-00407DC0\n GetUserNameA@ADVAPI32.DLL at 00010144-00002140-23758-127-0040707C\n GetUserNameA@ADVAPI32.DLL at 00010144-00002140-23758-193-00407120","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"PSPUBWS2.txt\" has type \"data\"\n \"PSPUBWSv1.18.0 - Trial versionlog.dat\" has type \"data\"\n \"PSPUBWS7\" has type \"ASCII text, with no line terminators\"\n \"PSPUBWS8\" has type \"ASCII text, with no line terminators\"\n \"PSPUBWSv1.18.0 - Trial version.vbs\" has type \"ASCII text, with CRLF line terminators\"\n \"PSPUBWSv1.18.0 - Trial version.txt\" has type \"ASCII text, with CRLF line terminators\"\n \"logonwindows.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.88526608021","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00010144-00002140-18353-684-00404992\n GetVersion@KERNEL32.DLL at 00010144-00002140-18353-440-00401108","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8.exe\", Stream UID: \"00010144-00002140-18353-684-00404992\")\n which is directly followed by \"cmp eax, 80000000h\" and \"je 004049FDh\". See related instructions: \"...\n+35 call 00401110h\n+40 mov dword ptr [0040C028h], eax\n+45 call 00401108h ;GetVersion\n+50 and eax, 80000000h\n+55 cmp eax, 80000000h\n+60 je 004049FDh\" ... at 00010144-00002140-18353-684-00404992","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00010144-00002140-23758-30-0040922C\n GetProcessHeap@KERNEL32.DLL at 00010144-00002140-23758-219-00409464","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VBoxService.exe\" (Indicator: \"vbox\")\n \"VBoxService.exe\" (Indicator: \"vboxservice\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00010144-00002140-23758-192-00405AB0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Windows\\install\\\"\n \"\" created file \"C:\\Windows\\install\\logonwindows.exe\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"logonwindows.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$27","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00010144-00002140-18353-145-00406018\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010144-00002140-23758-115-00406018","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 1812070581 does not match actual CRC 401808","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/55 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8.exe\"\n \"\" allocated memory in \"C:\\Windows\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00010575-00001560)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"\\Device\\HarddiskVolume2\\Windows\\install\\logonwindows.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 181.207.40.230 on port 3460","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"PSPUBWSv1.18.0 - Trial version.vbs\" contains indicator \"ExecQuery\" (Line: 2, Offset: 36)","origin":"Binary File","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00009733-00004028)\n Spawned process \"\" (UID: 00010144-00002140)\n Spawned process \"Explorer.EXE\" (UID: 00010575-00001560)\n Spawned process \"logonwindows.exe\" (UID: 00010993-00002868)\n Spawned process \"logonwindows.exe\" (UID: 00011010-00002516)\n Spawned process \"cscript.exe\" with commandline \"\"C:\\Users\\PSPUBWS\\AppData\\Roaming\\PSPUBWSv1.18.0 - Trial version.vbs\"\" (UID: 00011669-00001972)\n Spawned process \"logonwindows.exe\" (UID: 00013215-00002072)\n Spawned process \"logonwindows.exe\" (UID: 00013241-00002032)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"},{"detail":"Persists itself using auto-execute at a hidden registry location"}],"sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":83,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"566f34f10e316d3d5424c07a","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HW32.Packed","contacted_countries":["COL"],"submit_name":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","analysis_start_time":"2015-12-14T15:30:58+00:00","indicators_count":{"informative":10,"suspicious":29,"malicious":7},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"181.207.40.230","port":3460,"protocol":"TCP","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"dns_resolutions":[{"domain":"unshowmas.ddns.net","address":"181.207.40.230","country":"Colombia","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}],"processes":[{"pid":4028,"ppid":0,"name":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8.exe","command_line":"","normalized_path":"","uid":"00009733-00004028","icon":"$28"},{"pid":2140,"ppid":0,"name":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8.exe","command_line":"","normalized_path":"","uid":"00010144-00002140"},{"pid":1560,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00010575-00001560"},{"pid":2320,"ppid":0,"name":"firefox.exe","command_line":"","normalized_path":"","uid":"00010812-00002320"},{"pid":1972,"ppid":0,"name":"cscript.exe","command_line":"\"C:\\Users\\PSPUBWS\\AppData\\Roaming\\PSPUBWSv1.18.0 - Trial version.vbs\"","normalized_path":"","uid":"00011669-00001972"},{"pid":2072,"ppid":0,"name":"logonwindows.exe","command_line":"","normalized_path":"","uid":"00013215-00002072"},{"pid":2868,"ppid":0,"name":"logonwindows.exe","command_line":"","normalized_path":"","uid":"00010993-00002868","icon":"$29"},{"pid":2516,"ppid":0,"name":"logonwindows.exe","command_line":"","normalized_path":"","uid":"00011010-00002516","icon":"$2a"},{"pid":2032,"ppid":0,"name":"logonwindows.exe","command_line":"","normalized_path":"","uid":"00013241-00002032","icon":"$2b"}],"all_imported_dlls":["uxtheme.dll","shlwapi.dll","RpcRtRemote.dll","ntshrui.dll","cscapi.dll","version.dll","IPHLPAPI.DLL","msctf.dll","crypt32.dll","msasn1.dll","devrtl.dll","wininet.dll","msvbvm60.dll","propsys.dll","gameux.dll","urlmon.dll","winmm.dll","dnsapi.dll","gdi32.dll","sxs.dll","ntdll.dll","clbcatq.dll","devobj.dll","slc.dll","sfc_os.dll","usp10.dll","profapi.dll","srvcli.dll","netutils.dll","lpk.dll","msvcrt.dll","ole32.dll","sspicli.dll","cfgmgr32.dll","xmllite.dll","msacm32.dll","cryptbase.dll","shell32.dll","twext.dll","imm32.dll","userenv.dll","GdiPlus.dll","shdocvw.dll","apphelp.dll","comctl32.dll","rsaenh.dll","acppage.dll","wsock32.dll","mswsock.dll","FWPUCLNT.DLL","kernel32.dll","setupapi.dll","syncui.dll","sfc.dll","iertutil.dll","ws2_32.dll","nsi.dll","winrnr.dll","wer.dll","synceng.dll","linkinfo.dll","avicap32.dll","msvfw32.dll","advapi32.dll","WinCDEmuContextMenu.dll","rpcrt4.dll","oleaut32.dll","msi.dll","mpr.dll","NapiNSP.dll","rasadhlp.dll","sechost.dll","Wldap32.dll","powrprof.dll","winnsi.dll","nlaapi.dll","KernelBase.dll","user32.dll","ntmarta.dll","cryptsp.dll","WSHTCPIP.DLL","pnrpnsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PSPUBWSv1.18.0 - Trial version.txt","sha256":"7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"PSPUBWSv1.18.0 - Trial version.vbs","sha256":"f7addc3f4f5f81442d8be1f45cc866463a75aac66c16e9a67882844c33f37443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"PSPUBWS2.txt","sha256":"abc473c8041fadcdf173a6005b87d4b51d0f0ec91b5da8b226443e881cba7422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"PSPUBWS7","sha256":"3baa8edfbc7c772bcf89ebb77935f0db3174719ab00ad5665986ed5670be8490","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"PSPUBWS8","sha256":"033d651f6860aa335db13625dfdd2d5874ba702d4177e3e8520e9f31539b7349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"PSPUBWSv1.18.0 - Trial versionlog.dat","sha256":"c6a693d99c6f06242fe4f6e8ef8f8720156a220a2eb695afa3c542d268a94a3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"logonwindows.exe","sha256":"c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8.exe","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"SICE","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"NTICE","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\install\\logonwindows.exe","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%TEMP%\\PSPUBWS2.txt","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\install","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_bulgarian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_dansk.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_dutch.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_estonian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_french.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_german.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_greek.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_hebrew.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_italian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_japanese.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_korean.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_lithuanian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_norsk.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_polish.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_portuguese.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_romanian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_russian.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_spanish.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_swedish.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_turkish.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_zh_CN.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_zh_TW.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_english.lng","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\install\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\cscript.exe","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\en-US\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\en\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\en-US\\AVICAP32.dll.mui","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%TEMP%\\PSPUBWS8","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\PSPUBWSv1.18.0 - Trial versionlog.dat","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%TEMP%\\PSPUBWS7","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"path":"%APPDATA%\\PSPUBWSv1.18.0 - Trial version.txt","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{754B680G-Q5IU-2288-K2V8-1CS822172J7U}\\","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\PSPUBWS5","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QU5244KV047N0E","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QU5244KV047N0EPSPUBWS15","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566f34f10e316d3d5424c07a"}]}]}},"report_ids":{"sandbox_job_ids":["566f34f10e316d3d5424c07a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Johnnie.Generic Sample c94ce321cf0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c94ce321cf0e…. Malware family: Johnnie.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8"}],["$","meta","4",{"property":"og:title","content":"Malicious Johnnie.Generic Sample c94ce321cf0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c94ce321cf0e…. Malware family: Johnnie.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c94ce321cf0e2b177e1c9d699402319c0a28ad7468ad31a9fd9a3c56f9318bd8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Johnnie.Generic Sample c94ce321cf0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c94ce321cf0e…. Malware family: Johnnie.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]