26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T467,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 97061e7baa01… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 97061e7baa01…. Malware family: Malware. Threat score 100/100. 2/24 AV engines flagged this file. 4 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20"],"about":{"@type":"SoftwareApplication","name":"center.exe","applicationCategory":["neexe","executable"],"identifier":"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":2,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T494,"center.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00000000-00003472-0000010C-4431066 "center.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00000000-00003472-0000010C-10357520530001435 "center.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00000000-00003472-0000010C-10357520530041662 "center.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00003472-0000010C-10357520530117705 "center.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00000000-00003472-0000010C-10357520530425748 "center.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00000000-00002792-0000010C-7218676 "center.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00002792-0000010C-7237970 "center.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00000000-00002792-0000010C-7259086 "center.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00000000-00002792-0000010C-24932988 "center.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00000000-00002792-0000010C-2494224928:T30c8,"GetModuleHandleA" (Indicator: "GetModuleHandleA") "GetProcAddress" (Indicator: "GetProcAddress") "WTSFreeMemory" (Indicator: "WTSFreeMemory") "VerQueryValueA" (Indicator: "VerQueryValueA") "NetApiBufferFree" (Indicator: "NetApiBufferFree") "WNetOpenEnumA" (Indicator: "WNetOpenEnumA") "InternetOpenA" (Indicator: "InternetOpenA") "BCryptGenRandom" (Indicator: "BCryptGenRandom") ".NonClientBackground { background-color: buttonface;} .Selectable { cursor:hand; padding:1px; border:'1px solid highlight'; behavior:url(selectable.htc); } .Selectable2 { cursor:hand; } .Btn{ font-family:Tahoma; font-size:8pt; font-style:normal;} .Prop{ font-family:Tahoma; font-size:8pt; font-style:normal; color:green} .NonBold{ font-weight:normal;} .Bold{ font-weight:bold;} /*BUTTON {font-family:Tahoma; font-size:13pt;}*/ /* Horizomtal lines with*/ .HorzLine1 {width:100%; font-size:1pt; border-top:'1px solid activecaption'; filter:alpha(style=1 startX=0 finishX=100 opacity=0 finishOpacity=100);} .HorzLine2 {width:100%; font-size:1pt; border-top:'2px solid activecaption'; filter:alpha(style=1 startX=0 finishX=100 opacity=100 finishOpacity=0);} TABLE { cellspacing:0; cellpadding:0; border:0; font-size:10px; font-family:Verdana,Arial,sans-serif; cursor:default; /* border-width:1" (Indicator: "select") "// ******************************************************************* // ******************************************************************* // // Obligatory functions // // function onSelect1(){ if ( window.event.srcElement.tagName !="INPUT" ) { window.event.returnValue = false; window.event.cancelBubble = true; } } function onContextMenu(){ if ( window.event.srcElement.tagName !="INPUT" ) { window.event.returnValue = false; window.event.cancelBubble = true; return false; } } function onLoad() { try { // alert(window.external); if (window.external.strings_js_path.length) idStringsFile.src = window.external.strings_js_path; //alert(window.external.strings_js_path); details =0; var Objs = document.all; for (i=0; i< Objs.length; i++) if (Objs(i).tagName!="INPUT" && Objs(i).tagName!="A") Objs(i).style.cursor = "default"; document.onselectstart = onSelect1; document.oncontextmenu = onContextMenu;" (Indicator: "select") "window.onerror = errorHandler; document.onhelp = onhelpHandler; } catch(e) { // alert(e.message); window.external.WriteLog( "JScript excpt #1: " + e.message + ". " + e.name); } try { document.charset = txtCharset; } catch(e) { //alert(e.message); window.external.WriteLog( "JScript excpt #2: " + e.message + ". line:" + e.name ); } try { document.characterSet = txtCharset; // document.charset = txtCharset; } catch(e) { // alert(e.message); //alert("err"); window.external.WriteLog( "JScript excpt #3: " + e.message + ". " + e.name); } cbKeys =0; } function onLoad2() { details =0; var Objs = document.all; for (i=0; i< Objs.length; i++) if (Objs(i).tagName!="INPUT" && Objs(i).tagName!="A") Objs(i).style.cursor = "default"; document.onselectstart = onSel" (Indicator: "select") "var txtCharset = "iso-8859-1"; var txtYouCanSetupUSBforDisk_Info ="You can setup authentication key for "+ "secure access to Rohos disk with it instead of typing a password. "+ ""; var txtEnterYouDiskPass="Enter Rohos disk password:"; var txtWrongConfirmationTryAgain="The new and confirmed passwords you entered do not match!\nRe-enter the new password in \x22Confirmation\x22 text box."; var txtConnectUSBKeyXX="Connect your key (XX). "; var txtNewPassToUSBKeyXX="New password will be stored on the Key XX ."; var txtYouMayChangeDiskPassw="You can change Rohos disk password."; var txtPass="Password:"; var txtNewPass="New password:"; var txtConfirm="Confirmation:"; var txtLetterWillChangeLater="You should reconnect disk to apply new disk letter."; var txtDiskLetterInfo="To change disk letter you should first connect disk."; var txtCryptoAlg="Encryption algorithm: "; var txtDiskImage="Disk container: "; var txtAutomountLabel="Connect Ro" (Indicator: "connect"), "hos disk automatically on system start."; var txtAutomountInfo="You will be prompted to enter disk password on Windows start-up. If there will be connected Key for the disk it be connected automatically."; var txtChangeDiskLetter="Change disk letter: "; var txtDiskNotMounted_Info="Your favorite disk is not connected."; var txtEmptyPassNotAllowed="Password cannot be empty."; var txtNewDiskInfo="Encrypted Rohos disk size XX Megabytes" + " disk letter YYY . Disk container path: ZZZZ ." var txtDiskParams= "[Change...]"; var txtCreateNewDisk="Creating encrypted virtual drive. Rohos automatically has defined virtual drive configuration however you can change it."; var txtDiskPasswInfo="Specify a new password to access the disk: "; var txtConfirmPassw="Confirm password:"; var txtErrorSetNewPassword = "Unable to set new password.\n"; var txtDiskWiz" (Indicator: "connect") "ardInfo = "This wizard helps you create your personal encrypted disk. You can use it to store sensitive files and folders. The disk will be protected by a password. The wizard has determined best parameters for the disk but you may change it using 'details' link."; var txtNextYoucanSetDiskOptions = "You can change disk parameters later on in Rohos Center window"; var txtPressNext="Press 'Next'."; var txtLogonWizard_Info= "If you have USB drivey you can use it to access your Rohos disk so you don't have to manually enter the password every time."+ "

Plug it in and choose check boxes to setup Key. If you don't have a USB flash drive click 'Next'."; var txtSetupUSBinfo= "Setup this device :"; var txtDiskKey= "To access your Rohos disk"; var txtWizard_UpdatesInfo = "With Rohos Center you can check for updates over an Internet connection."+ "You will have a chance to see what's new in Rohos and update size, and to download and install update instantly."+ ""; var tx" (Indicator: "connect"), "tStartInfo="Information:

"+ "

You may close Rohos Center window and Rohos will continue to run in the taskbar (near the clock).

"+ "

Find and use Rohos disk icon through Save As/Open dialog within MS Office and others applications.

"+ "It is strongly recommended to create a Password Reset File for Rohos disk to prevent forgotten password."+ "

Press 'Finish' to create Rohos disk and open Rohos Center.
"; var txtStart= "Finish"; var txtTitle_Disk= "Disk Encryption"; var txtStep1= "Step 1 of 3"; var txtStep2= "Step 1 of 3"; var txtStep3= "Step 2 of 3"; var txtLastStep= "Finish"; var txtTitle_Updates= "Rohos Updates"; var txtI_Need= "I want to ..."; var txtEncryptFiles = "Encrypt files"; var txtEncryptFiles_Desc= "Learn how to instantly encrypt your files within any appl" (Indicator: "open"), "ication or MS Office."; var txtSetDiskOpt_Desk = "Setup disk auto start, disconnect hotkeys and other options."; var txtChangeDiskPasw = "Change password"; var txtChangeDiskPasw_Desc= "Specify new password to access Rohos disk."; var txtWWW_disk="http://www.rohos.com/desktop_security_howto.htm"; var txtTips="10 Tips "; var txtTips_Desc ="Visit Rohos web site"; var txtSetupUSBdisk_Desc= "Setup hardware authentication key for secure access to Rohos disk."; var txtDiskNotMounted="Primary Rohos disk is not connected." ; var txtMountDisk="Connect disk"; var txtDeleteDisk="Delete disk"; var txtDiskNotCreated= "Rohos disk is not created as yet."; var txtCreateDisk= " Create new disk... | Open exisiting disk... "; var txtDiskMounted= "Disk is connected. "; var txtDiskInfo= "Size: XX. Free space: YYY. ZZZZ"; var txtBrowseDisk2= " Disconnect Browse "; var txtBrowseDisk= " Disconnect Browse "; var txtBadDisk_Info= "Disk is damaged. Please report this problem. Create new disk "; var txtUpdatesLink= "Updates "; var txtSupportLink= "Support "; var txtDiskTab= "Disk
Encryption"; var txtLogonTab" (Indicator: "connect"), "= "Windows
logon"; var txtNext= "Next >"; var txtCreateDiskBtn= "Create disk"; var txtMainDiskOption = "Favorite disk"; var txtSkipWizard= "Skip this Wizard..." var txtQuickDismount = "Hotkeys to disconnect disk:"; var txtQuickDismount_Desc = "You can quickly disconnect (turn-off) encrypted disk by using hotkeys: "; var txtDismountByHotKey = "Disconnect by HotKey: "; var txtSetHotkey_Tip= "define a new hotkey shortcut."; var txtSetHotKey_= "Change..."; var txtDismountByUSB= "Disconnect by un-plugging USB flash drive:"; var txtRohosHeader1= "Welcome to Rohos"; var txtRohosHeader2= "Additional security"; var txtToProtectRohos= "You can define additional security options to reduce the risk of unauthorized
usage of your private information:" var txtWelcomeToRohos= "Visit our Tools..."; var txtConnectMore = "Open existing..." var txt_AnyDiskHtml = " XX "; var txtDisconnect = "Disconnect" var txtShowRohosIconTray= "Show Rohos icon near the clock."; var txtMountByUSB= "Connect Rohos Disk automatically by plugging the Key"; var txtDismountByLogoff = "Disconnect all when user logs off." var txtBrowseDiskExplorer = "Browse"; var txt_AnyDiskHtml_new = " XX "; var txt_ChooseLanguage = "Language:"; var txt_EnableLogFile= "Write log files for troubleshooting purposes" var txtHideFolder = "Encrypt Application"; var txtHideFolder_Desc = "Hide and protect apps like Skype Chrome or folder" (Indicator: "connect"), "s."; var txtHideFolder_dialogtext = "Choose a folder that will be linked with Rohos Disk. This folder will be accessible only when Rohos Disk is on. During this operation all folder data will be moved into Rohos Disk."; var txtSelectExistingFolder= "Select a predefined App or Folder:"; var txtSpecifyFolder_manualy = "Or specify a folder path manually:"; var txtHide_Folder_Relink= " Restore " var txtHide_Folder_Delete= " Delete link " var txtHide_Folder_Unhide= " Cancel Encryption " var txtReconnectOnResume= "Lock disk on Sleep or inactivity timeout (mins) : " var txtDiskSharedDrive= "Enable shared disk drive (local and network)" var txtPleaseCloseApp= "Please close selected application or folder befor" (Indicator: "connect")29:T506,"center.exe" touched "File Open Dialog" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DC1C5A9C-E88A-4DDE-A5A1-60F82A20AEF7}") "center.exe" touched "Microsoft Web Browser" (Path: "HKCU\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\INPROCSERVER32") "center.exe" touched "Microsoft HTML Resource Pluggable Protocol" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}\PROGID") "center.exe" touched "HTML Document" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCHANDLER") "center.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "center.exe" touched "Browser Application State" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "center.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "center.exe" touched "JScript Language" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "center.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "center.exe" touched "UIAutomation Registrar Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\TREATAS")2a:T567,"129_1_" has type "HTML document ISO-8859 text with CRLF line terminators"- [targetUID: N/A] "center.log" has type "ASCII text with CRLF LF line terminators"- Location: [C:\center.log]- [targetUID: 00000000-00002792] "backup-disk_1_" has type "PNG image data 35 x 34 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "common_1_" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "ENCRYPT-FOLDER-45_1_" has type "PNG image data 53 x 42 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "134_1_" has type "HTML document ISO-8859 text with CRLF line terminators"- [targetUID: N/A] "disk_drive_1_" has type "PNG image data 39 x 39 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "encrypt-usb-drive_1_" has type "PNG image data 23 x 46 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "129_2_" has type "HTML document ISO-8859 text with CRLF line terminators"- [targetUID: N/A] "options_1_" has type "PNG image data 120 x 120 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "common_2_" has type "ISO-8859 text with CRLF line terminators"- [targetUID: N/A] "help_1_" has type "GIF image data version 89a 17 x 17"- [targetUID: N/A] "logon_strings_1_" has type "HTML document ASCII text with very long lines with CRLF line terminators"- [targetUID: N/A] "disk-key_1_" has type "PNG image data 23 x 46 8-bit/color RGBA non-interlaced"- [targetUID: N/A]2b:T6d0,"center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\134[1]" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\common[1]" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\common[1]" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "center.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\logon_strings[1]" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\134[1]" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\common[1]" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "center.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\logon_strings[1]" "center.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\logon_strings[1]"2c:T4e5,Heuristic match: "y#:V5?A.an" Pattern match: "h.vYu/m^|6" Pattern match: "www.inkscape.org" Pattern match: "http://www.rohos.com/protecting_ms_office_documents.htm" Pattern match: "http://www.rohos.com/howto.htm" Pattern match: "http://www.rohos.com/prevent_forgotten_password.htm" Pattern match: "http://www.rohos.com/2016/07/rohos_disk2-3-dropbox/" Pattern match: "http://www.rohos.com/2013/12/login-unlock-computer-by-using-smartphone/" Pattern match: "http://www.rohos.com/2016/07/rohos-logon-key-3-3/" Pattern match: "https://www.rohos.com/2021/06/30/2fa-bypass-notification-in-rohos-logon-key-4-8/" Pattern match: "http://www.rohos.com/products/rohos-logon-free/upgrade/" Pattern match: "http://rohos.com/products/rohos-disk-encryption/" Heuristic match: "de@rohos.com" Pattern match: "http://www.rohos.com/" Pattern match: "http://www.rohos.com/free-encryption/upgrade-with-discount/" Pattern match: "http://www.rohos.com/support" Pattern match: "http://www.rohos.com/desktop_security_howto.htm" Pattern match: "www.rohos.com" Pattern match: "http://www.rohos.com/desktop-security/buy_on-line.htm" Pattern match: "http://www.rohos.com/welcome-screen/buy_on-line.htm" Pattern match: "http://rohos.com/products/rohos-logon-key/"2d:T402,"get=_blank href='https://www.rohos.com/2021/06/30/2fa-bypass-notification-in-rohos-logon-key-4-8/'>Learn more.." var txtControl2FA_bypass_info = "Immideatelly delivers push notification in cases when 2FA procedure was avoided for any use session. " var txt_bypass_none = "None"; var txt_bypass_notify = "Send push notification"; var txt_bypass_notify_lock = "Notify and lock desktop"; var txt_bypass_notify_switch = "Notify and switch RDP desktop"; var txt_bypass_mode_1 = "Any 1FA login" ; var txt_bypass_mode_2 = "1FA login by use from 2FA group/list"; var txt_bypass_mode_4 = "1FA login by 2FA user or session hijack"; var txt_bypass_mode_8 = "1FA login by Admin account"; //common strings ************************************************** var txtUnblockPIN = "[Unblock key...]"; var txtErrorWhile = "Error while HTML scripting. Sorry for inconvenience." var txtSetupUSB = "Setup authentication key" (Indicator: "https://")2e:T9b6,"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.79533800476" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.81387277008" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.71407379153" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.83197718461" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.29205283629" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.26444244531" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.78877043994" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.92380328096" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.82570582364" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.61209969082" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.93049376631" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.66495300551" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.8009883009" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.86128771735" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.92352794011" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.81483610719" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.28535119687" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.60901297278" "97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin" has resource with unusual entropy "RT_HTML:7.53967888213"2f:T43e,"center.exe" wrote bytes "75dc5075273e507551c14e75ee9c4e7594984e750fb3547510994e7590974e750000000042c6e776152ee776c0d9e7761bf7e776c108e976e0c2e77636dae77630c6e776d5d9e77686c4e77600000000" to virtual address "0x6EE1E000" (part of module "MSLS31.DLL") "center.exe" wrote bytes "e7392b77e1a62f772e712f77ee292f7785e22a776da02f7790642e773ad5357726e42a77d16d2f77003d2d77804b2d7700000000ad377a768b2d7a76b6417a7600000000" to virtual address "0x74B61000" (part of module "WSHIP6.DLL") "center.exe" wrote bytes "c04e2d7720542e77e0652e77b5382f770000000000d0e77600000000c5eae7760000000088eae77600000000e9681e7582282f77ee292f7700000000d2691e75000000007dbbe7760000000009be1e7500000000ba18e77600000000" to virtual address "0x76B91000" (part of module "NSI.DLL") "center.exe" wrote bytes "e93145dbf7" to virtual address "0x7470E52A" ("GetIpNetTable@IPHLPAPI.DLL") "center.exe" wrote bytes "d5d9e77630c6e776e0c2e77642c6e77610c6e776acdce776a0dfe77636dae77687f1e7760000000091775f76c0905f767f6f5f761ffa5f76def45f76f2825f76857d5f7600000000" to virtual address "0x6C7B1000" (part of module "MSIMG32.DLL")30:T6aa,"center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IT-IT") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL-NL") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NL-NL") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NB-NO") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PL-PL") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PL-PL") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-BR") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-BR") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU-RU") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU-RU") "center.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SK-SK")31:T271e,"vboxvideo.inf" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-03-21 15:34:49, Info DISM API: PID=2344 TID=1716 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_9bc3c1389d21f9ef\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790907796251,"unified_at":"2026-10-02T02:23:16.251Z","metadata":{"hashes":{"sha256":"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","sha1":"21b5f14b185ed0e4abf1dcf481ce7288fd819b55","md5":"65234dc9275b566a3e076afdbbde9266","sha512":"d2ab51ab8bb9a41dce071804fabf4c03ba14ea1581936cdee768143b7201ba8d5c8c5cb0fc9df6aae06b5ea3836702e049d1bfcb9ee8a3b69e98a54eb1b9d566","ssdeep":"49152:V9nq9KHjspLo7M1/edTjS3wT5I3Rhd/a:SLpLoI12lS36Shd/","ssdeep_chunks":["49152:V9nq9KH","49152:9nq9KHj","49152:nq9KHjs","49152:q9KHjsp","49152:9KHjspL","49152:KHjspLo","49152:HjspLo7","49152:jspLo7M","49152:spLo7M1","49152:pLo7M1/","49152:Lo7M1/e","49152:o7M1/ed","49152:7M1/edT","49152:M1/edTj","49152:1/edTjS","49152:/edTjS3","49152:edTjS3w","49152:dTjS3wT","49152:TjS3wT5","49152:jS3wT5I","49152:S3wT5I3","49152:3wT5I3R","49152:wT5I3Rh","49152:T5I3Rhd","49152:5I3Rhd/","49152:I3Rhd/a","98304:V9nq9KH","98304:9nq9KHj","98304:nq9KHjs","98304:q9KHjsp","98304:9KHjspL","98304:KHjspLo","98304:HjspLo7","98304:jspLo7M","98304:spLo7M1","98304:pLo7M1/","98304:Lo7M1/e","98304:o7M1/ed","98304:7M1/edT","98304:M1/edTj","98304:1/edTjS","98304:/edTjS3","98304:edTjS3w","98304:dTjS3wT","98304:TjS3wT5","98304:jS3wT5I","98304:S3wT5I3","98304:3wT5I3R","98304:wT5I3Rh","98304:T5I3Rhd","98304:5I3Rhd/","98304:I3Rhd/a","49152:SLpLoI1","49152:LpLoI12","49152:pLoI12l","49152:LoI12lS","49152:oI12lS3","49152:I12lS36","49152:12lS36S","49152:2lS36Sh","49152:lS36Shd","49152:S36Shd/"],"imphash":"3e25249c97c45dafad834cf4f2caa702"},"file_info":{"file_name":"center.exe","file_type":["neexe","executable"],"file_type_id":"dos","file_size":2257920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1641306737000,"last_seen":1720094617000,"last_multi_scan":1720094617000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":34,"suspicious_count":29,"malicious_count":4,"total":67},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with MPress Packer"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Read windows product name from registry"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1471","attack_id_wiki":"https://attack.mitre.org/techniques/T1471","identifiers":[{"type":"informative","value":"Imports Crypto related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed api string:\"CryptProtectData which can performs encryption on the data\"[Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptProtectData\" which can \"performs encryption on the data\" [Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"center.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"center.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"center.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"center.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"23:15 : 35:454 ReadReg lpbyte failed 2 SOFTWARE\\Rohos KeyValue2\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\MSIMGSIZECacheMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"!IECompat!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$28","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an executable section named \".MPRESS1\"\n \"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an executable section named \".MPRESS2\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an writable section named \".MPRESS1\"\n \"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an writable section named \".MPRESS2\"\n \"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an writable section named \".rsrc\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" file has an entrypoint instructions - \"pushal,call0x9b55a9,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x9b55c8,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"center.exe\" searching for class \"MS_AutodialMonitor\"\n \"center.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"center.exe\" (UID: 00000000-00002792)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"center.exe\" (UID: 00000000-00002792)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"center.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2a","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Observed api string:\"WNetOpenEnumA which can Starts an enumeration of network resources or existing connections\"[Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetOpenEnum\" which can \"starts an enumeration of network resources or existing connections.\" [Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"center.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003472)\n \"center.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"CopySid which can Copies a security identifier (SID) to a buffer\"[Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"CopySid\" which can \"Copies a security identifier (SID) to a buffer\" [Source: 97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"center.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"center.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".MPRESS1 with unusual entropies 7.99987949293","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with MPress Packer","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has a section named \".MPRESS1\"\n \"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has a section named \".MPRESS2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-77","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"center.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"center.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/67 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"de@rohos.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$2e","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"center.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ROHOS\"; Value: \"C:\\agent.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"23:13 : 17:492 ============================= (Dec 15 2021, 3.2, 0.0.0.0)\"\n Potential IP \"0.0.0.0\" found in string \"23:15 : 35:360 ============================= (Dec 15 2021, 3.2, 0.0.0.0)\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"center.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"var txtClearUSBlogin= \"Disable...\"\" (Indicator: \"login=\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"center.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"center.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003472)\n \"center.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002792)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"center.exe\" called \"GetLogicalDriveStringsA\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"center.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"center.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL\"\n \"center.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLLIB.DLL.DLL\"\n \"center.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Office\\Office14\\outllib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetIpNetTable@IPHLPAPI.DLL\" in \"center.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"center.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"center.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"center.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"center.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"center.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"center.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20.bin\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetModuleHandleA\n WNetOpenEnumA\n InternetOpenA\n URLDownloadToFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"3/67 Antivirus vendors marked spawned process \"center.exe\" (PID: 2792) as malicious (classified as \"Gen:NN.ZexaF.34638\" with 4% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"center.exe\" allocated memory in \"\\\\?\\Volume{dcbfaac3-d86\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"center.exe\" wrote 32 bytes to a remote process \"C:\\center.exe\" (Handle: 1208)\n \"center.exe\" wrote 52 bytes to a remote process \"C:\\center.exe\" (Handle: 1208)\n \"center.exe\" wrote 4 bytes to a remote process \"C:\\center.exe\" (Handle: 1208)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004072-13697-75--00CF0C10\n SetUnhandledExceptionFilter@KERNEL32.dll at 19675-111-000000010000F3F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004072-13697-285--00CF23C0\n GetVersionExA@KERNEL32.DLL at 00000000-00004072-13697-437--00CF1246\n GetVersionExW@KERNEL32.dll at 19675-312-000000010000DC40\n GetVersionExA@KERNEL32.dll at 19675-464-000000010000EDBA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [rsp+30h], 02h\" and \"jne FFFFFFFFFF30EDEBh\" at 00000000-00004072-13697-437--00CF1246\n Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+30h], 02h\" and \"jne 000000010000EDEBh\" at 19675-464-000000010000EDBA","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00004072-13697-322--00CF29E8\n GetProcessHeap@KERNEL32.dll at 19675-349-000000010000D618\n GetProcessHeap@KERNEL32.dll at 19675-562-000000010000E3F0\n GetProcessHeap@KERNEL32.dll at 19675-567-000000010000E0DC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"dismhost.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.61D45D88.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"center.exe\" (UID: 00000000-00000716) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"center.exe\" (UID: 00000000-00000716) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"dismhost.exe\" (UID: 00000000-00004072) was launched with modified environment variables: \"CommonProgramFiles, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles\"\n Process \"dismhost.exe\" (UID: 00000000-00004072) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00004072-13697-284--00CF213C\n LoadResource@KERNEL32.DLL at 00000000-00004072-13697-290--00CF256C\n FindResourceExW@KERNEL32.dll at 19675-311-000000010000DEC4\n LoadResource@KERNEL32.dll at 19675-317-000000010000DA94","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"dismhost.exe.61D45D88.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"center.exe\" opened \"%WINDIR%\\SysWOW64\\ieframe.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dismhost.exe.61D45D88.bin\" claimed CRC 141269 while the actual is CRC 2265613","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"center.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"PE file is packed with MPress Packer"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":111,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"6347498db29b7437a71ac569","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:NN.ZexaF.34638","submit_name":"center.exe","analysis_start_time":"2022-10-12T23:11:10+00:00","indicators_count":{"informative":27,"suspicious":32,"malicious":3},"tags":["Multi-Process","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"61d45a705db862347661c1ce","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.AIDetect","submit_name":"center.exe","analysis_start_time":"2022-01-04T14:38:58+00:00","indicators_count":{"informative":21,"suspicious":30,"malicious":4},"tags":["Multi-Process","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}],"processes":[{"pid":3092,"ppid":0,"name":"center.exe","command_line":"","sha256":"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","normalized_path":"C:\\center.exe","uid":"00000000-00003092","icon":"$32"},{"pid":716,"ppid":3092,"name":"center.exe","command_line":"","sha256":"97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20","normalized_path":"C:\\center.exe","parent_uid":"00000000-00003092","uid":"00000000-00000716"},{"pid":4072,"ppid":0,"name":"dismhost.exe","command_line":"{AC912E0F-9344-4108-A9A6-EEFBB0C12176}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\TEMP\\241BA1E7-652E-4C8D-AEF1-61A4039BE48B\\dismhost.exe","uid":"00000000-00004072","icon":"$33"}],"all_imported_dlls":["msimg32.dll","oledlg.dll","bcrypt.dll","cfgmgr32.dll","msvcrt.dll","usp10.dll","rsaenh.dll","wintrust.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","RpcRtRemote.dll","imageres.dll","crypt32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","winhttp.dll","mlang.dll","psapi.dll","iertutil.dll","rpcrt4.dll","winmm.dll","nsi.dll","secur32.dll","d2d1.dll","msls31.dll","kernel32.dll","sechost.dll","setupapi.dll","comdlg32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msimtf.dll","api-ms-win-core-synch-l1-2-0.dll","normaliz.dll","oleacc.dll","jscript9.dll","KernelBase.dll","netapi32.dll","user32.dll","lpk.dll","devobj.dll","winsta.dll","mpr.dll","clbcatq.dll","winnsi.dll","profapi.dll","shell32.dll","urlmon.dll","mswsock.dll","srvcli.dll","gdi32.dll","advapi32.dll","fltLib.dll","oleaut32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wship6.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","apphelp.dll","tzres.dll","ws2_32.dll","dxgi.dll","ntdll.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","WindowsCodecs.dll","userenv.dll","comctl32.dll","msctf.dll","cryptbase.dll","api-ms-win-downlevel-version-l1-1-0.dll","cryptsp.dll","netutils.dll","wkscli.dll","ieframe.dll","IPHLPAPI.DLL","propsys.dll","DWrite.dll","mshtml.dll","d3d11.dll","wtsapi32.dll","shlwapi.dll","oleaccrc.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dwmapi.dll","webio.dll","msasn1.dll","GdiPlus.dll","imm32.dll","d3d10warp.dll","uxtheme.dll","version.dll","wininet.dll","rpcss.dll","sspicli.dll","sxs.dll","UIAutomationCore.dll","SSShim.dll","DrUpdate.dll","DmiProvider.dll","wow64win.dll","devrtl.dll","LogProvider.dll","CbsCore.dll","dbghelp.dll","wow64.dll","OSProvider.dll","wow64cpu.dll","SPInf.dll","drvstore.dll","VxSSL64.dll","DismCorePS.dll","wdscore.dll","DismProv.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"common_1_","sha256":"5a54994ed482ee91755eb963125e3a18c1b54f1cebb229c1117067cfa80fbf87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"center.log","sha256":"83cc3b58fe0f175e9d7825a1a07367cc1e64ff8d158db0cdf9480091ac5555f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"129_1_","sha256":"a4637368ade1fa35d1b12bf3acb479ab4661347b00d3faf4b95a69af8962ebb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"backup-disk_1_","sha256":"8c964d5d897cbae6856d22c286854b8c0dea251978fdd67934cebfddfb90cab4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"ENCRYPT-FOLDER-45_1_","sha256":"39c146d56d69d07a1c3aa16891c86a185fb7d68cf4d0732548b9c661c8d21d81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"name":"134_1_","sha256":"1d03c0b6bf620878448fa11c7020c489ab7ca4666607b71637da876728fe1b96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"disk_drive_1_","sha256":"5b76f1f31bfbb85edd4289b0684bb627307fbb8a2d0235a62c883e17eb945983","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"encrypt-usb-drive_1_","sha256":"fc2c9a9efe5dfccef57e6e3bb2375dbd7a9edbc7a88c7e65d146051e4e510e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"129_2_","sha256":"a4637368ade1fa35d1b12bf3acb479ab4661347b00d3faf4b95a69af8962ebb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"name":"options_1_","sha256":"2a8bf6a836986ce816fd469974025c9ce6eb3fa6e2aa33f1ce425f5d259d99a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"common_2_","sha256":"9af91a9c6b61ede79eaa630219c3cc4df8c8287203cae72f189ae0bdc85affd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"name":"help_1_","sha256":"c625a19df640e0c5ddc03c6b9c8b21e899c091a7b0b1ed18f96e8bf598aed1e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"logon_strings_1_","sha256":"3720a93fac9d87b46cc29638c7d67cf7fb1c014e631d4d21ccd8a917cff70d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"name":"disk-key_1_","sha256":"e287ac00be51d7dec2ded5c4bbdaef6a3b7d02f6d82992f6598fc7abe8d425de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"dismhost.exe.61D45D88.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"dism.log","sha256":"33c1392f29e93b1518dbe39f22974f29fd3a66fb91843b59ee7867277b58fa45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}],"files_written":[{"path":"Global\\RHDISK","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\134[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\common[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\logon_strings[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\help[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\ENCRYPT-FOLDER-45[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\options[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\backup-disk[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\disk-key[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\encrypt-usb-drive[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\129[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\129[2]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\logon_strings[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\common[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\common[2]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\help[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\ENCRYPT-FOLDER-45[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\options[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\backup-disk[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\disk-key[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\encrypt-usb-drive[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\disk_drive[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"C:\\center.log","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\disk_drive[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\common[1]","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKLM\\SOFTWARE\\ROHOS\\","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"key":"HKCU\\SOFTWARE\\ROHOS\\","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"key":"HKLM\\SOFTWARE\\ROHOS\\VZYS4Y3\\","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"key":"HKLM\\SOFTWARE\\ROHOS\\DISK\\","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\ROHOS\\DISK\\","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6347498db29b7437a71ac569"},{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61d45a705db862347661c1ce"}]}]}},"report_ids":{"sandbox_job_ids":["6347498db29b7437a71ac569","61d45a705db862347661c1ce"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 97061e7baa01… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 97061e7baa01…. Malware family: Malware. Threat score 100/100. 2/24 AV engines flagged this file. 4 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 97061e7baa01… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 97061e7baa01…. Malware family: Malware. Threat score 100/100. 2/24 AV engines flagged this file. 4 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/97061e7baa01bd34e937c3549571a709b10f3f5415d1568619b81bef3ac18e20"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 97061e7baa01… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 97061e7baa01…. Malware family: Malware. Threat score 100/100. 2/24 AV engines flagged this file. 4 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]