34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 56:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryxos.JS Sample 01b5272358a2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 01b5272358a2…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","keywords":["Malicious","Trojan.Cryxos.JS","malware analysis","sandbox report","threat intelligence","01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229"],"about":{"@type":"SoftwareApplication","name":"BL.JS","applicationCategory":["script","javascript"],"identifier":"01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cryxos.JS","antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T995,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TYPELIBINDEX") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\0")37:Ta50,"WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1085661560 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1085671667 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1085824995 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1085833641 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086249398 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086259636 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086411688 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086420352 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086965717 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1086974631 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1087441346 [PID: 6584] "WScript.exe" queried SystemProcessInformation at 00000000-00006584-00000C15-1087450079 [PID: 6584] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1094834851 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1094842619 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1094999167 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1095006801 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1095141582 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1095149673 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1098083328 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1098090992 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1098257444 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1098265114 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1099203393 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1099211934 [PID: 7024] "OEMFWGXWMYLVUJAK.exe" queried SystemProcessInformation at 00000000-00007024-00000C15-1099621759 [PID: 7024]38:T68c,"OEMFWGXWMYLVUJAK.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAALYh0LPj8fu4Etx63N3lgWs6sbRHZPtzFiEo2HHPdsvQAAAAADoAAAAACAAAgAAAAScMZiXF5UGqg9GZWr56DQJTVIJU/+1rBU0ZzLoRAjLIwAAAANd5CrqGqOi43CndxYcNjXU4g" "cchString": "392" "dwFlags": "1" "pcbBinary": "25010000"} "OEMFWGXWMYLVUJAK.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAALYh0LPj8fu4Etx63N3lgWs6sbRHZPtzFiEo2HHPdsvQAAAAADoAAAAACAAAgAAAAScMZiXF5UGqg9GZWr56DQJTVIJU/+1rBU0ZzLoRAjLIwAAAANd5CrqGqOi43CndxYcNjXU4g" "cchString": "392" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "25010000"} "OEMFWGXWMYLVUJAK.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACP+gxoCsmn4un5XF9qOL9aw9fh5zRmD80bq4JaEXL0dAAAAAAOgAAAAAIAACAAAABKexJXWzccnfiFJmhE+KfQTxCzjoECh3Sff43Rs47FfzAAAADm9teK1IOdo3bbNHaw9Hkl" "cchString": "396" "dwFlags": "1" "pcbBinary": "27010000"} "OEMFWGXWMYLVUJAK.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACP+gxoCsmn4un5XF9qOL9aw9fh5zRmD80bq4JaEXL0dAAAAAAOgAAAAAIAACAAAABKexJXWzccnfiFJmhE+KfQTxCzjoECh3Sff43Rs47FfzAAAADm9teK1IOdo3bbNHaw9Hkl" "cchString": "396" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "27010000"}39:T276e,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac9b07fb7f0000000000000000000051ed5209fb7f00000000000057020000000000000000000036ae7845facd00002a00000000000000a0566de9570200008fec5209fb7f0000e0ac9b07fb7f0000e0ac9b07fb7f0000000000000000000000000000fb7f0000ffffff7ffcbc000000000000000000000000000000000000d8ce8f07fb7f00002a0000000000000069c34807fb7f00003100000000000000e802000000000000ec02000000000000110001100000000020cc6f94c400000003a3b506fb7f000020cc6f94c400000000000000000000002b00000000000000000000000000000020b04e07fb7f0000b43f4d07fb7f0000e0ce8f07 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000091e9570200000b8e5009fb7f0000000091e957020000020000000000000038000000000000004000000000000000300391e957020000f8736f94c4000000000000000000000003000000000000000000000000000000000000000000000040115de957020000000000000000000000005de95702000000405e94c4000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000a8746ee95702000004000000000000003800000000000000f098b406fb7f00003800000000000000380000000000000070756f94c4000000c00cb5e2fa7f000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b03eeffa7f00000700000000000000000000000000000001000000000000006045c8eb57020000000000000000000030f3c6eb570200004c98b406fb7f0000f071c6eb57020000b3ceabe2fa7f0000b0f3c6eb57020000004f3eeffa7f0000d0b03eeffa7f000000000000000000000000000000000000b0f3c6eb570200006045c8eb57020000b090c1eb57020000c8756f94c40000004c98b406fb7f00000100000000000000c8756f94c4000000b090c1eb57020000b0f3c6eb57020000010000000000000002bcabe2fa7f000080f9c6eb570200002003c6eb57020000feffffff040000007df03deffa7f0000d089c1eb (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000700000000000000000000000000000001000000000000006045c8eb57020000000000000000000030f3c6eb570200004c98b406fb7f00007077c6eb57020000b3ceabe2fa7f0000b0f3c6eb57020000384f3eeffa7f0000d0b03eeffa7f000000000000000000000000000000000000b0f3c6eb570200006045c8eb57020000b090c1eb57020000c0756f94c40000004c98b406fb7f00000100000000000000c0756f94c4000000b090c1eb57020000b0f3c6eb57020000010000000000000002bcabe2fa7f000000000000000000002003c6eb5702000080f9c6eb04000000feffffffffffffff6045c8eb570200007df03deffa7f000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000020a56f94c40000000400000000000000106801559301000006000000000000000300000000000000a740ee05fb7f000040a66f94c400000030a66f94c400000000000000000000000101000000000000701071e9570200000a00000000000000ccad6f94c4000000b9eeed05fb7f000043003a005c005500730065007200730000004c0044004100500049002e0064006c006c0000000000000000000000000030a66f94c4000000f0780a07fb7f0000000000000000000030a66f94c4000000040000000000000008a66f94c4000000a0a56f94c400000004985009fb7f000008a66f94c4000000fcffffffffffffff00000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000fc710000020000000000000000000000c0125de957020000000000000000000000005de95702000000405e94c4000000d8125de95702000001000000fb7f0000e0566ce95702000090666ae95702000028002a0000000000c00c5de9570200000a000000000000004000000000000000c09d6f94c4000000000000000000000000000000000000000000000000000000000000000000000004000000000000004000000000000000320000000000000000006ae95702000032895009fb7f000040000000570200000000000000000000320000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002a0d000000000000f09d6f94c400000068409271367f0000c08400559301000002ffff7f000000000800000000000000a740ee05fb7f0000a09e6f94c400000000000000000000001a9d00a144570000fb00000000000000e02270e957020000100000000000000094a16f94c400000010a26f94c400000043003a005c00550073006500720073005c005000750062006c00690063000000b8a16f94c400000036fbed05fb7f0000340000c0c4000000209f6f94c4000000e203000000000000b10eee05fb7f000090000000c4000000789e6f94c4000000709e6f94c400000004985009fb7f000081210000c400000000006ae95702000081210000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b58e05fb7f00002400000000000000c8946f94c4000000000f5de95702000000000000fa7f000000005de95702000000405e94c400000008000000020000000000000000000000000000000000000036976f94c400000036003800fa7f0000c00c5de9570200000c00000000000000500000000000000090966f94c4000000000000000000000000000000000000000000000000000000000000000000000005000000000000005000000000000000400000000000000000006ae95702000032895009fb7f000040000000000000000000000000000000400000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001c0d000000000000c0966f94c40000008a479271367f000060b3fd549301000009ffff7f000000000f00000000000000a740ee05fb7f000090966f94c400000096695409fb7f000000006ae902000000f40000000000000040f771e95702000018000000000000000200000000000000ee2c5109fb7f000043003a005c00550073006500720073005c005000750062006c00690063005c004400650073006b0074006f0070000000e4c49f11e8f0980f7300650072007300c00c5de957020000000000000000000000005de9570200004000000000000000b0e771e95702000004985009fb7f0000001000000000000000926be95702000000926be9 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b58e05fb7f00002400000000000000988d6f94c4000000400e5de95702000000000000fa7f000000005de95702000000405e94c40000000800000002000000ffffffff00000000000000000000000004906f94c400000046004800fa7f0000c00c5de9570200000f000000000000006000000000000000608f6f94c4000000000000000000000000000000000000000000000000000000000000000000000006000000000000006000000000000000500000000000000000006ae95702000032895009fb7f000040000000000000000000000000000000500000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001e0d000000000000f09d6f94c40000005c409271367f000030acfd549301000008ffff7f000000000e00000000000000a740ee05fb7f00000500000000000000b001000000000000d4756ae957020000f50000000000000060f06ee957020000190000000000000000005de95702000000405e94c400000043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074000000000500000000300100000000000002000002570200000000000000000000000000000000000010316fe95702000050135de95702000004985009fb7f00003001000000000000230100000000000005000005 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000b58e05fb7f00002400000000000000c8946f94c4000000400e5de95702000000000000fa7f000000005de95702000000405e94c400000008000000020000000000000000000000000000000000000036976f94c400000048004a00fa7f0000c00c5de9570200001300000000000000600000000000000090966f94c4000000000000000000000000000000000000000000000000000000000000000000000006000000000000006000000000000000520000000000000000006ae95702000032895009fb7f000040000000000000000000000000000000520000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000032895009fb7f000040000000000000000000000000000000520000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000010636ee957020000d0a96f94c400000028f66fe957020000402d72e9570200000000000000000000000000000000000000000000000000000000000000000000000000000000000080f66fe95702000098f66fe95702000080f66fe957020000feffffffffffffff000000000000000002646ee95702000000000000000000000000000000000000000000000000000060976f94c4000000520000000000000090966f94c4000000b0966f94c400000000006ae9 (UID: 00000000-00006584) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c000000000000908f6f94c4000000984e9271367f0000c0cffe54930100001affff7f000000002000000000000000a740ee05fb7f00003900320065003900f3e45009fb7f0000001f000000000000e300000000000000f0646ee9570200002c000000000000001000020000000000010000000000000043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000007f03000057020000000000000000000004985009fb7f0000f03374e957020000e03372e957020000f03372e9 (UID: 00000000-00006584)3a:Ta48,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000f5dbf77f0000000000000000000018000000000000000000000000000000000000000000000036937845facd00002755a108289900000000f5dbf77f00003abd73e3fa7f000006000000c40000000000000000000000011f6ae9570200001f00000000000000060000000000000000000000000000000000f5db (UID: 00000000-00006584) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bf005fb7f00000000e9edfa7f0000000000000000000000000000000000000806eaedfa7f00000001000000000000f098b406fb7f00000001000000000000000100000000000000000000000000000006eaedfa7f000001000000000000000f18e9edfa7f000000000000000000000006eaedfa7f000000000000 (UID: 00000000-00006584) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c3174e6fa7f0000708b76e6fa7f00000200000000000000708b76e6fa7f000000000000000000000300000000000000b13174e6fa7f0000a81577e6fa7f000090c891e957020000a0c891e957020000888b76e6fa7f00000100000000000000239fb606fb7f00000000000000000000888b76e6fa7f000006000000 (UID: 00000000-00006584) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000080dbc2eb570200000000000000000000589512ee570200003f000000000000000200000000000000782291e9570200008000000000000000000091e95702000032895009fb7f0000801661e95702000000000000fa7f0000000061e957020000e0010fee570200000000000000000000703b6194c4000000589512ee (UID: 00000000-00006584) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303deee5fa7f0000c0feefe5fa7f00000400000000000000c0feefe5fa7f000000000000000000000500000000000000453deee5fa7f0000286af0e5fa7f0000be5af105fb7f000068de13ee570200005806f0e5fa7f0000b08ef105fb7f0000239fb606fb7f00000100000000000000d132eee5fa7f00000000ea05 (UID: 00000000-00006584) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5af105fb7f0000000026eafa7f000000000000000000000000000000000000883f27eafa7f00000001000000000000f098b406fb7f0000000100000000000000010000000000000000000000000000803f27eafa7f00000100000000000000bf1026eafa7f00000000000000000000803f27eafa7f000000000000 (UID: 00000000-00006584) "OEMFWGXWMYLVUJAK.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f3c52b506a2a778b895575feffffffb8f0c52bb71627772808000030080000a47f6003a4f0c52b000000000000600300004d03300800000000000000000000060100000300000000006003280800000000000020000000dcf0c52bee13277728080000ee1327770000000000000000280800000000000060000000f4f0c52b (UID: 00000000-00007024)3b:T75c,"OEMFWGXWMYLVUJAK.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3c:T9f4,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OEMFWGXWMYLVUJAK.EXE") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FOXMAIL.EXE") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FOXMAIL.EXE") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "DISPLAYNAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME")3d:T547,"OEMFWGXWMYLVUJAK.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3e:Taca,"OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-wal (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-shm to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-shm (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-wal (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-shm to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-shm (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-wal (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-shm to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-shm (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-wal (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-shm to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-shm (UID: 00000000-00007024)3f:T1438,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006584) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006584) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter Psapi (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter Shlwapi (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007024)40:T98e7,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00006584) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006584) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlCompareMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtFlushInstructionCache (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtSetInformationThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetExtendedTcpTable (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetExtendedUdpTable (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CredFree (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CredEnumerateW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptDeriveKeyPBKDF2 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FindFirstFileExA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SearchPathW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetInformationJobObject (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter AssignProcessToJobObject (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateJobObjectW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter QueueUserAPC (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007024)41:T93e,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6584:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6584:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6584:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:6584:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:6584:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:6584:120:WilError_01" Process WScript.exe created mutex with name "SM0:6584:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6584:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7024:168:WilStaging_02" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7024:64:WilError_01" Process OEMFWGXWMYLVUJAK.exe created mutex with name "Rmc-V77YNK" Process OEMFWGXWMYLVUJAK.exe created mutex with name "Local\SM0:7024:168:WilStaging_02" Process OEMFWGXWMYLVUJAK.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process OEMFWGXWMYLVUJAK.exe created mutex with name "Local\ZonesCacheCounterMutex" Process OEMFWGXWMYLVUJAK.exe created mutex with name "SM0:7024:168:WilStaging_02" Process OEMFWGXWMYLVUJAK.exe created mutex with name "SM0:7024:64:WilError_01" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7024:168:WilStaging_02" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\Rmc-V77YNK" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process OEMFWGXWMYLVUJAK.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"42:T1aca,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffae2d60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb03eb0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffb08cc0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffb08b60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffae2c90000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffaf0d50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffafce20000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffaef3d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb05ea0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb05ea0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb05ea0000 "WScript.exe" loaded module "KERNEL32" at base 7ffb08b60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\59XGCHL2.DLL" at base 7ffaebe00000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffb04920000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb09290000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb05e40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb04cd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffaf0ca0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffb088a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb05c50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffaede90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffae6740000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffae2a80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb08b60000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffb05760000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffafce20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffaea260000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffb094e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb01c30000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffb073d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb06110000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffae5ee0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ffad92e0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffae2870000 "WScript.exe" loaded module "USER32.DLL" at base 7ffb071d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffaf0aa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffb073d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffafaec0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffaf3c90000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffb05730000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb05ea0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb03c30000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73ac0000 "OEMFWGXWMYLVUJAK.exe" loaded module "KERNEL32.DLL" at base 74e70000 "OEMFWGXWMYLVUJAK.exe" loaded module "USER32.DLL" at base 74ab0000 "OEMFWGXWMYLVUJAK.exe" loaded module "NTDLL.DLL" at base 77230000 "OEMFWGXWMYLVUJAK.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "OEMFWGXWMYLVUJAK.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "OEMFWGXWMYLVUJAK.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 732f0000 "OEMFWGXWMYLVUJAK.exe" loaded module "GDI32.DLL" at base 74460000 "OEMFWGXWMYLVUJAK.exe" loaded module "AMSI.DLL" at base 73210000 "OEMFWGXWMYLVUJAK.exe" loaded module "WININET.DLL" at base 72f50000 "OEMFWGXWMYLVUJAK.exe" loaded module "MSCOREE.DLL" at base 72ef0000 "OEMFWGXWMYLVUJAK.exe" loaded module "SHELL32.DLL" at base 75ac0000 "OEMFWGXWMYLVUJAK.exe" loaded module "WINMM.DLL" at base 72ec0000 "OEMFWGXWMYLVUJAK.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74e70000 "OEMFWGXWMYLVUJAK.exe" loaded module "URLMON.DLL" at base 72d00000 "OEMFWGXWMYLVUJAK.exe" loaded module "GDIPLUS.DLL" at base 72970000 "OEMFWGXWMYLVUJAK.exe" loaded module "PSAPI" at base 748c0000 "OEMFWGXWMYLVUJAK.exe" loaded module "SHCORE" at base 770f0000 "OEMFWGXWMYLVUJAK.exe" loaded module "NTDLL" at base 77230000 "OEMFWGXWMYLVUJAK.exe" loaded module "KERNEL32" at base 74e70000 "OEMFWGXWMYLVUJAK.exe" loaded module "SHELL32" at base 75ac0000 "OEMFWGXWMYLVUJAK.exe" loaded module "SHLWAPI" at base 75510000 "OEMFWGXWMYLVUJAK.exe" loaded module "IPHLPAPI" at base 72940000 "OEMFWGXWMYLVUJAK.exe" loaded module "ADVAPI32.DLL" at base 75830000 "OEMFWGXWMYLVUJAK.exe" loaded module "RPCRT4.DLL" at base 76fe0000 "OEMFWGXWMYLVUJAK.exe" loaded module "SSPICLI.DLL" at base 73c50000 "OEMFWGXWMYLVUJAK.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76e00000 "OEMFWGXWMYLVUJAK.exe" loaded module "BCRYPT.DLL" at base 72920000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74c30000 "OEMFWGXWMYLVUJAK.exe" loaded module "IPHLPAPI.DLL" at base 72940000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72880000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 727d0000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72780000 "OEMFWGXWMYLVUJAK.exe" loaded module "CRYPT32.DLL" at base 74c90000 "OEMFWGXWMYLVUJAK.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72720000 "OEMFWGXWMYLVUJAK.exe" loaded module "WINHTTP.DLL" at base 72670000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72720000 "OEMFWGXWMYLVUJAK.exe" loaded module "MSISO.DLL" at base 72600000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 742d0000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72590000 "OEMFWGXWMYLVUJAK.exe" loaded module "MSKEYPROTECT.DLL" at base 72580000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 770a0000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72500000 "OEMFWGXWMYLVUJAK.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 724c0000 "OEMFWGXWMYLVUJAK.exe" loaded module "WS2_32.DLL" at base 742d000043:Tbc7,"WScript.exe" called "WScript.ScriptName" with result: "BL.JS" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.CreateObject" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.createElement" with result: "IDispatch" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").dataType" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").text" ... "WScript.exe" called "ADODB.Stream.6.0.CreateObject" ... "WScript.exe" called "ADODB.Stream.6.0.Type" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "local OEMFWG = "|E==;;;;;;;;;;;;;;;;;;;Ms!:`U?++g;++w5rzVX.IzwV:? gsMgN.z2.mhiT. w.KgiuhwPntI:/82i `XwGlgvP;gvPw+6|t<:yM!VI.z2.mhiO.j0.?hiuhwPntI:/81i rH?/81iqOP?/kziyxwPntI?/8li nne1LT;qPYYOgoUMoI+G:xP5so|T.j0LiwPxsY| T:x >nwLiX1Glne//v/`S4 `XIG/8Wi27.kM2XI!QvI;;;w/o ;;;wZ6Q8z!J612O:;;;Q>61LT;pPYY!J;iGo49GJ/iU.z7RLQw GQ4 SxPfl4zLu1U2+;G/82iU8zXL?;;;8e6!:xP3tI;?Y8;rL;i;ooxGJ8iK.j90hxPf1IwplW>yORxP5048L6zPf1I:0.sVU8zXNKH /8VixNsRH9zZJu1 m1IwO:;;;wOhPI!h 9TKL?HI/|3iuR:7 ?xPvt4wQQ8g2hXe6Z9L`s/gel+i+70Q/kSiQ70;HH88ONgw:f/;H7.?OHsw M0PxsI?IHszLO0PnlI./kziY8TKLyxPxsIpl?xP50o|`7.I/.zix:n`|8z`LixPftI.sP4wUQ8g2hXe6N9iHv4///ff.+g9<2uT>7../81iMQ8g47.;;;;Povm|Y8zXN62R/.Tig8zXJG2;gH8R/.ziQ8zXLi:x ?;; MN6r:wJ/8zXNqtT47..n;;;;.H6rJHG/8VjuxzLM0/g;>gxMQ8g;;w;8je|;|S9 sGx6GvI8L?:x +//iTN6;;;;w+ t/L3>/8zXNuG;7RxXGv3Pf147y;;V;yl .gYX:oI wol+ GvR79TMNeRMRMlz wl0O:QKp.?PM81xrL ;V:YX|!QMJ!1..go;K?:MXl/ge`k1L?yP31YHx4wUJ7UKw;vV PQOU91iz8y8WhxPntIwxYfh..T;tPI./8Vi.g+g?QxPpMI./81i3PQgPtI;3+;H/|2iU8zXL?hM;XI!0:;;<;I6r!8;;;;;s+ t/ " ..., "WScript.exe" called "ADODB.Stream.6.0.Write" ... , "WScript.exe" called "ADODB.Stream.6.0.Position" ... , "WScript.exe" called "ADODB.Stream.6.0.SaveToFile" ... , "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "MZ" ..., "WScript.exe" called "WScript.CreateObject" with result: "IDispatch" ..., "WScript.exe" called "WScript.Shell.1.CreateObject" ... 44:T741,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")45:T6f2,"OEMFWGXWMYLVUJAK.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections"- Location: [%USERPROFILE%\Documents\OEMFWGXWMYLVUJAK.exe]- [targetUID: 00000000-00006584] "KAJUVLYMWXGWFMEO" has type "ASCII text with very long lines (65536) with no line terminators"- Location: [%USERPROFILE%\Documents\KAJUVLYMWXGWFMEO]- [targetUID: 00000000-00006584] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp]- [targetUID: 00000000-00007024] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp]- [targetUID: 00000000-00007024] "logs.dat" has type "data"- Location: [%ALLUSERSPROFILE%\folder\logs.dat]- [targetUID: 00000000-00007024] "line_1_.txt" has type "Unknown"- [targetUID: N/A] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp]- [targetUID: 00000000-00007024] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp]- [targetUID: 00000000-00007024]46:T444,"Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp]47:Ta06,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")48:Te46,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "")49:T924,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\FLTLIB.DLL" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\VCRUNTIME140.dll" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\USERENV.dll" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\WINMMBASE.dll" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\WINDOWS\system\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\WINDOWS\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\Wbem\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\nvm\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Program Files\nodejs\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\Foxmail.exe" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\Foxmail.exe"4a:T562,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\KAJUVLYMWXGWFMEO" "WScript.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\KAJUVLYMWXGWFMEO" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\BL.JS" "WScript.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\BL.JS" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\OEMFWGXWMYLVUJAK.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Users\QsIRTBA\Documents\OEMFWGXWMYLVUJAK.exe:Zone.Identifier" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\ProgramData\folder\LOGS.DAT" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "C:\ProgramData\folder\logs.dat" "OEMFWGXWMYLVUJAK.exe" trying to access non-existent file "\Device\RasAcd"4b:T913,"OEMFWGXWMYLVUJAK.exe" called "FindFirstFileW" with parameter %APPDATA%\Mozilla\Firefox\Profile Groups\*.sqlite (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\* (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\* (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter BL.JS (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter inetpub (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter mitmproxy.log (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00007024) "OEMFWGXWMYLVUJAK.exe" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00007024)4c:T11ae,Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18346806296") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18346806296") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18348864136") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18348864136") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18350544416") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18350544416") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18459230537") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18459230537") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18461427911") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18461427911") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18463123731") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00007024-00000C3D-18463123731") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18522036130") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18522036130") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18524297974") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18524297974") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18526176060") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18526176060") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18556198798") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18556198798") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18558234862") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18558234862") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18560361442") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00007024-00000C3D-18560361442")4d:Tb87,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\DOCUMENTS\OEMFWGXWMYLVUJAK.EXE"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "OEMFWGXWMYLVUJAK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")4e:Tc1a,"WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "DB0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830046000000A19F5E000400010000006C00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000030000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-V77YNK"; Key: "EXEPATH"; Value: "4ED67DD91E651BA21B39EFF77A38DB6A03048CE8582F9BCCC8E93C03C7FD33A40806EC289574FFCA9ABA8FFF5937DFFD733933E3BD213BA9E78DE433340CDC2073FDDD874E8469A0D72BDABEB035FC106060DCBE10C241419BBD0DF385E5BDC900") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-V77YNK"; Key: "LICENCE"; Value: "2804E15D57DBC6FF3D4208C573CCF109") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-V77YNK"; Key: "TIME"; Value: "9661D86A00") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-V77YNK"; Key: "UID"; Value: "1E7BDFEA00") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "OEMFWGXWMYLVUJAK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:")4f:T684,"WScript.exe" reads file "C:\Users\desktop.ini" "WScript.exe" reads file "C:\Users\Public\desktop.ini" "WScript.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" "WScript.exe" reads file "C:\Windows\Fonts\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "OEMFWGXWMYLVUJAK.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini"50:T13de,"OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000c0d8d22b" "pDataOut": "20000000c8336303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2001000078c1d22b" "pDataOut": "2000000008346303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000030fcd32b" "pDataOut": "20000000c8346303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "22010000e805d62b" "pDataOut": "20000000c8336303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000208ed32b" "pDataOut": "2000000008326303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000488fd32b" "pDataOut": "2000000088336303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "220100005866fd2b" "pDataOut": "2000000008346303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "20000000c8366303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000c092d32b" "pDataOut": "2000000048366303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "200100008898d32b" "pDataOut": "2000000088336303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000058b9d32b" "pDataOut": "2000000048346303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000058b9d32b" "pDataOut": "20000000c8336303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000f88cd32b" "pDataOut": "2000000008376303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000488fd32b" "pDataOut": "2000000048386303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "2000000088336303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "2000000088376303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000b099d32b" "pDataOut": "20000000c8316303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "200100009891d32b" "pDataOut": "2000000048386303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "20000000c8316303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000488fd32b" "pDataOut": "2000000008376303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000488fd32b" "pDataOut": "2000000048366303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "2000000008386303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "2201000010c36303" "pDataOut": "2000000008316303" "$dataout": "0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7"} "OEMFWGXWMYLVUJAK.exe" called "CryptUnprotectData" with parameters {"pDataIn": "20010000d08bd32b" "pDataOut": "2000000008386303" "$dataout": "8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d"}51:T690,"OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-WAL" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-SHM" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-WAL" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-SHM" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA.TMP-WAL" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA.TMP-SHM" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account.tmp" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-WAL" with delete access "OEMFWGXWMYLVUJAK.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-SHM" with delete access52:Ta7c,"OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "OEMFWGXWMYLVUJAK.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")53:T1c1c,"OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "f03e6203a4f5c52b71cc4c2c0000000011b9ee760000837504f5c52b000000000cf5c52b000000000af4bd73602f610300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "f840620344f6c52b71cc4c2c0000000011b9ee7600008375a4f5c52b00000000acf5c52b000000000af4bd73602f610300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": ">b"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "f03e6203f4f8c52b71cc4c2c0000000011b9ee760000837554f8c52b000000005cf8c52b000000000af4bd73d02f610300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "98426203c4f7c52b71cc4c2c0000000011b9ee760000837524f7c52b000000002cf7c52b000000000af4bd73b02e610300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "X?b"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "c8416203fcf7a52c71cc4c2c0000000011b9ee76000083755cf7a52c0000000064f7a52c000000000af4bd734030610300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "(@b"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "`Ab"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "a05af72b8cf4a52c71cc4c2c0000000011b9ee7600008375ecf3a52c00000000f4f3a52c000000000af4bd73e062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "8861f72bd4f7a52c71cc4c2c0000000011b9ee760000837534f7a52c000000003cf7a52c000000000af4bd730063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "0e"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "185ff72b94f7a52c71cc4c2c0000000011b9ee7600008375f4f6a52c00000000fcf6a52c000000000af4bd735062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "e05df72bf4f5a52c71cc4c2c0000000011b9ee760000837554f5a52c000000005cf5a52c000000000af4bd73d063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "e05df72b0cf5a52c71cc4c2c0000000011b9ee76000083756cf4a52c0000000074f4a52c000000000af4bd739063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "185ff72b3cf9a52c71cc4c2c0000000011b9ee76000083759cf8a52c00000000a4f8a52c000000000af4bd73c062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "@\\"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "d85bf72b6cf8a52c71cc4c2c0000000011b9ee7600008375ccf7a52c00000000d4f7a52c000000000af4bd734063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "185ff72b3cf6a52c71cc4c2c0000000011b9ee76000083759cf5a52c00000000a4f5a52c000000000af4bd735063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "8861f72b54faa52c71cc4c2c0000000011b9ee7600008375b4f9a52c00000000bcf9a52c000000000af4bd736063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "P`"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "Xb"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "185ff72b54f5c20371cc4c2c0000000011b9ee7600008375b4f4c20300000000bcf4c203000000000af4bd736063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "9063f72b84f9c20371cc4c2c0000000011b9ee7600008375e4f8c20300000000ecf8c203000000000af4bd737062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "085bf72becf6c20371cc4c2c0000000011b9ee76000083754cf6c2030000000054f6c203000000000af4bd733063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "hf"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "8861f72b74f3c20371cc4c2c0000000011b9ee7600008375d4f2c20300000000dcf2c203000000000af4bd739063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "a05af72b5cf7c20371cc4c2c0000000011b9ee7600008375bcf6c20300000000c4f6c203000000000af4bd736062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "185ff72b1cf3c20371cc4c2c0000000011b9ee76000083757cf2c2030000000084f2c203000000000af4bd734063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "805ff72b4cf4c20371cc4c2c0000000011b9ee7600008375acf3c20300000000b4f3c203000000000af4bd733063690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "b05ef72b4cf9c20371cc4c2c0000000011b9ee7600008375acf8c20300000000b4f8c203000000000af4bd739062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "d85bf72bacf9c20371cc4c2c0000000011b9ee76000083750cf9c2030000000014f9c203000000000af4bd73a062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "d85bf72bdcf8c20371cc4c2c0000000011b9ee76000083753cf8c2030000000044f8c203000000000af4bd739062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "8861f72b7cf3c20371cc4c2c0000000011b9ee7600008375dcf2c20300000000e4f2c203000000000af4bd73d062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "`d"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "e05df72ba4f6c20371cc4c2c0000000011b9ee760000837504f6c203000000000cf6c203000000000af4bd73f062690300000000"} "OEMFWGXWMYLVUJAK.exe" called "CredEnumerateW" with parameters {"Flags": "0" "Count": "01000000" "Credential": "e05df72bc4f5c20371cc4c2c0000000011b9ee760000837524f5c203000000002cf5c203000000000af4bd736063690300000000"}54:T1b4f,"OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "EMAIL") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "DISPLAY NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "ACCOUNT NAME") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "IMAP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "POP3 PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "SMTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "HTTP PASSWORD") "OEMFWGXWMYLVUJAK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\5430004994B7FC4E9FA8C66DEEDA72DE")55:T160d,"OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 7\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 7\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 8\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 8\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 9\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 9\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 10\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 10\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 11\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 11\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 12\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 12\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 13\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 13\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 14\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 14\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 15\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 15\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 16\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 16\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 17\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 17\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 18\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 18\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 19\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 19\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 20\LOGIN DATA" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 20\LOGIN DATA FOR ACCOUNT" "OEMFWGXWMYLVUJAK.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-WAL"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794260679784,"unified_at":"2026-11-09T21:44:39.784Z","metadata":{"hashes":{"sha256":"01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","sha1":"4cee793d3587f80ac2aa763c50e8ddcd69b92401","md5":"a26bf21c27f9197f1e6bd6f90e0ae1c9","sha512":"fc9f9e3ebd55853eae6337465ecc3b61d3c5e3c7c56594bfa4946390ccdadae694ed529cc4deb172b16cc3695af3920a02c3c5d032695faa8cc8cb752de7bdd5","ssdeep":"98304:sfLgl7LlFV8jHusxS7sVqkixA7lOKyuYC/qDaD8XK9ZiAvJ6O2B8bGPPTaWFLk88:sjgl/lr8jHusxS7sVqkixA7lOKyNC2a5","ssdeep_chunks":["98304:sfLgl7L","98304:fLgl7Ll","98304:Lgl7LlF","98304:gl7LlFV","98304:l7LlFV8","98304:7LlFV8j","98304:LlFV8jH","98304:lFV8jHu","98304:FV8jHus","98304:V8jHusx","98304:8jHusxS","98304:jHusxS7","98304:HusxS7s","98304:usxS7sV","98304:sxS7sVq","98304:xS7sVqk","98304:S7sVqki","98304:7sVqkix","98304:sVqkixA","98304:VqkixA7","98304:qkixA7l","98304:kixA7lO","98304:ixA7lOK","98304:xA7lOKy","98304:A7lOKyu","98304:7lOKyuY","98304:lOKyuYC","98304:OKyuYC/","98304:KyuYC/q","98304:yuYC/qD","98304:uYC/qDa","98304:YC/qDaD","98304:C/qDaD8","98304:/qDaD8X","98304:qDaD8XK","98304:DaD8XK9","98304:aD8XK9Z","98304:D8XK9Zi","98304:8XK9ZiA","98304:XK9ZiAv","98304:K9ZiAvJ","98304:9ZiAvJ6","98304:ZiAvJ6O","98304:iAvJ6O2","98304:AvJ6O2B","98304:vJ6O2B8","98304:J6O2B8b","98304:6O2B8bG","98304:O2B8bGP","98304:2B8bGPP","98304:B8bGPPT","98304:8bGPPTa","98304:bGPPTaW","98304:GPPTaWF","98304:PPTaWFL","98304:PTaWFLk","98304:TaWFLk8","98304:aWFLk88","196608:sfLgl7L","196608:fLgl7Ll","196608:Lgl7LlF","196608:gl7LlFV","196608:l7LlFV8","196608:7LlFV8j","196608:LlFV8jH","196608:lFV8jHu","196608:FV8jHus","196608:V8jHusx","196608:8jHusxS","196608:jHusxS7","196608:HusxS7s","196608:usxS7sV","196608:sxS7sVq","196608:xS7sVqk","196608:S7sVqki","196608:7sVqkix","196608:sVqkixA","196608:VqkixA7","196608:qkixA7l","196608:kixA7lO","196608:ixA7lOK","196608:xA7lOKy","196608:A7lOKyu","196608:7lOKyuY","196608:lOKyuYC","196608:OKyuYC/","196608:KyuYC/q","196608:yuYC/qD","196608:uYC/qDa","196608:YC/qDaD","196608:C/qDaD8","196608:/qDaD8X","196608:qDaD8XK","196608:DaD8XK9","196608:aD8XK9Z","196608:D8XK9Zi","196608:8XK9ZiA","196608:XK9ZiAv","196608:K9ZiAvJ","196608:9ZiAvJ6","196608:ZiAvJ6O","196608:iAvJ6O2","196608:AvJ6O2B","196608:vJ6O2B8","196608:J6O2B8b","196608:6O2B8bG","196608:O2B8bGP","196608:2B8bGPP","196608:B8bGPPT","196608:8bGPPTa","196608:bGPPTaW","196608:GPPTaWF","196608:PPTaWFL","196608:PTaWFLk","196608:TaWFLk8","196608:aWFLk88","98304:sjgl/lr","98304:jgl/lr8","98304:gl/lr8j","98304:l/lr8jH","98304:/lr8jHu","98304:lr8jHus","98304:r8jHusx","98304:A7lOKyN","98304:7lOKyNC","98304:lOKyNC2","98304:OKyNC2a","98304:KyNC2a5"],"imphash":"Unknown"},"file_info":{"file_name":"BL.JS","file_type":["script","javascript"],"file_type_id":"js","file_size":4858243,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792565549000,"last_seen":1792565549000,"last_multi_scan":1792565549000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","criminal","rat","remcos","evasive","infostealer","suspicious","new_domain"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":114,"suspicious_count":26,"malicious_count":8,"total":148},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.16862","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.16862 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDropper.ModiLoader.BZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Obfuscated.iv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Agent.ECX2!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cryxos.JS","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Chromium browser credentials files"},{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access recent files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Writes a PE file header to disc"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"suspicious","value":"Calls an API typically used to decrypt data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"malicious","value":"Creates a mutant that is known to appear in malware"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops executable files inside user directory"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006584)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006584)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006584)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2576642473985', 'hResInfo': '2576642475232'}\" (UID: 00000000-00006584)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2576642473985', 'hResInfo': '2576642475264'}\" (UID: 00000000-00006584)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2576642473985', 'hResInfo': '2576642475280'}\" (UID: 00000000-00006584)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2576642473985', 'hResInfo': '2576642475248'}\" (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\BL.JS contents: \nfunction anonymous() {\ndebugger\n}\n\n","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WScript.exe\" is protecting memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6584)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007024-00000C2C-1102038272\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007024-00000C2C-1102082490\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00007024-00000C2C-1102175819\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00007024-00000C2C-1102175931\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00007024-00000C2C-1102176023\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007024-00000C2C-1102176062\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$38","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"file/memory contains long string with (Indicator: \"AESNI\"; File: \"BL.JS\")\n Found string \"'OEMFWGXWMYLVUJAKOOO':'AESNI'\" (Indicator: \"AESNI\"; File: \"BL.JS\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"25948155\" in header \"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155 HTTP/1.1Host: pro.ip-api.comCache-Control: no-cache\"\n Contains base64 string in header \"comCache\" in header \"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155 HTTP/1.1Host: pro.ip-api.comCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"OEMFWGXWMYLVUJAK.exe\" at offset 198463; code bytes = 30d0\n Found XOR loop in file \"OEMFWGXWMYLVUJAK.exe\" at offset 345809; code bytes = 30d0\n Found XOR loop in file \"OEMFWGXWMYLVUJAK.exe\" at offset 355782; code bytes = 30d0\n Found XOR loop in file \"OEMFWGXWMYLVUJAK.exe\" at offset 412488; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007024-00000C2C-1099455422\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007024-00000C2C-1102176635\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007024-00000C2C-1102176674\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006584)\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"6584\" - (UID: 00000000-00006584)\n \"OEMFWGXWMYLVUJAK.exe\" called \"IsWow64Process\" with parameter \"7024\" - (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetWindowTextW\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"OpenMutexA\" with parameter \"Rmc-V77YNK-Sys\" - (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006584)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006584)\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetLocaleInfoA\" with parameter \"2048\" - (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"OEMFWGXWMYLVUJAK.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WScript.exe\" queried token user identity (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"WScript.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$3e","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\folder (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe\" %USERPROFILE%\\Documents\\KAJUVLYMWXGWFMEO\" - (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pro.ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"82.38.148.128:2404\"\n \"208.95.112.2:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"OEMFWGXWMYLVUJAK.exe\" as clean (type is \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\BL.JS\"\" (UID: 00000000-00006584)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"OEMFWGXWMYLVUJAK.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" - [base:0; Status:c000007b]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F0D50000\n \"OEMFWGXWMYLVUJAK.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73210000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 059E0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 05390000\n \"OEMFWGXWMYLVUJAK.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74C30000\n \"OEMFWGXWMYLVUJAK.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72920000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"OEMFWGXWMYLVUJAK.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 732F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 08CC0000\n \"OEMFWGXWMYLVUJAK.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76FE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$43","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00c400000040c70106fb7f0000@ntdll.dll\"\n \"22002300c400000018c70106fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"BL.JS\" was detected as \"plain text\" and name: \"Format\"\n \"OEMFWGXWMYLVUJAK.exe\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$44","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"OEMFWGXWMYLVUJAK.exe\" (UID: 00000000-00007024) was launched with new environment variables: \"USERDNSDOMAIN=\"IgPsurPBd1WNym3\"\"\n Process \"OEMFWGXWMYLVUJAK.exe\" (UID: 00000000-00007024) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pro.ip-api.com\"\n \"www.osamaphplogistices.com\"\n \"www.osamaphplogisticesbackup.com\"\n \"www.osamaphplogisticesbackup1.com\"\n \"www.osamaphplogisticesbackup2.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00006584-00000C2B-1086060271]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00006584-00000C2B-1086342249]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00006584-00000C2B-1087115118]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00007024-00000C2B-1095360563]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" [Source: 00000000-00007024-00000C2B-1095540880]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OEMFWGXWMYLVUJAK.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\KAJUVLYMWXGWFMEO\" (UID: 00000000-00007024)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"OEMFWGXWMYLVUJAK.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\KAJUVLYMWXGWFMEO\" (UID: 00000000-00007024)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB\" (SHA1: C4:3C:A1:3A:F5:DC:2D:C7:D5:63:0A:55:E7:E0:20:DB:85:D2:09:2E; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB\" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"OEMFWGXWMYLVUJAK.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"OEMFWGXWMYLVUJAK.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"OEMFWGXWMYLVUJAK.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe]- [targetUID: 00000000-00006584]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 6584)\n \"WScript.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\Documents\\OEMFWGXWMYLVUJAK.exe\" (UID: 6584)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\bl.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\VERSION.dll\"\n \"WScript.exe\" trying to touch file \"\\Device\\CNG\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"OEMFWGXWMYLVUJAK.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"OEMFWGXWMYLVUJAK.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"OEMFWGXWMYLVUJAK.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"OEMFWGXWMYLVUJAK.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\line[1].txt\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WScript.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\Documents\\OEMFWGXWMYLVUJAK.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\documents\\kajuvlymwxgwfmeo\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"OEMFWGXWMYLVUJAK.exe\" writes a file \"C:\\ProgramData\\folder\\logs.dat\"\n \"OEMFWGXWMYLVUJAK.exe\" writes a file \"%ALLUSERSPROFILE%\\folder\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007024-00000C2C-1099532343\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"InternetReadFile\" with parameter 65535 (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"InternetOpenA\" (UID: 00000000-00007024)\n \"OEMFWGXWMYLVUJAK.exe\" called \"InternetOpenW\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007024-00000C2C-1139001782\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://luajit.org/=\"\n Heuristic match: \"pro.ip-api.com\"\n Pattern match: \"www.osamaphplogistices.com\"\n Pattern match: \"www.osamaphplogisticesbackup.com\"\n Pattern match: \"www.osamaphplogisticesbackup1.com\"\n Pattern match: \"www.osamaphplogisticesbackup2.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155 HTTP/1.1\nHost: pro.ip-api.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"www.osamaphplogistices.com\" has high entropy\n Contacted domain: \"www.osamaphplogisticesbackup.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://pro.ip-api.com/line/?key=QPVvv1rHQJD2pd2&fields=25948155","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"208.95.112.2\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data For Account.tmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OEMFWGXWMYLVUJAK.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007024)\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetUserNameW\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"BL.JS\")\n Found string \"'OEMFWGXWMYLVUJAKOOO':'AESNI'\" (Indicator: \"aes\"; File: \"BL.JS\")\n Found string \"'OEMFWGXWMYLVUJAKOOO':'VAES'\" (Indicator: \"aes\"; File: \"BL.JS\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"OEMFWGXWMYLVUJAK.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"KAJUVLYMWXGWFMEO\" contains indicator \".Sleep(\" (Line: 1; Offset: 853456)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"OEMFWGXWMYLVUJAK.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe]- [targetUID: 00000000-00006584]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Login Data.tmp\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp]- [targetUID: 00000000-00007024]\n Dropped file: \"Login Data For Account.tmp\" - Location: [%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp]- [targetUID: 00000000-00007024]\n Dropped file: \"Login Data For Account.tmp\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp]- [targetUID: 00000000-00007024]\n Dropped file: \"Login Data.tmp\" - Location: [%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data.tmp]- [targetUID: 00000000-00007024]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe\" %USERPROFILE%\\Documents\\KAJUVLYMWXGWFMEO\" - (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00006584-00000C15-1094412684\n \"OEMFWGXWMYLVUJAK.exe\" at 00000000-00007024-00000C15-1138448386","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"OEMFWGXWMYLVUJAK.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"OEMFWGXWMYLVUJAK.exe queries ProcessDebugPort (UID: 7024)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155 HTTP/1.1\nHost: pro.ip-api.com\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nContent-Type: text/plain; charset=utf-8\nDate: Wed\n 21 Oct 2026 06:54:49 GMT\nContent-Length: 166 with response body ==>737563636573730A556E69746564205374617465730A55530A43616C69666F726E69610A53616E746120436C6172610A0A39353035300A33372E333534310A2D.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\OEMFWGXWMYLVUJAK.exe\" (Handle: 1420)\n \"WScript.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\OEMFWGXWMYLVUJAK.exe\" (Handle: 1420)\n \"WScript.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\OEMFWGXWMYLVUJAK.exe\" (Handle: 1420)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.2 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"OEMFWGXWMYLVUJAK.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt data","description":"$50","origin":"API Call","mitre_attack_id":"T1140","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"OEMFWGXWMYLVUJAK.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007024)\n \"OEMFWGXWMYLVUJAK.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"OEMFWGXWMYLVUJAK.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related files","description":"\"OEMFWGXWMYLVUJAK.exe\" read 40960 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"OEMFWGXWMYLVUJAK.exe\" read 100 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\"\n \"OEMFWGXWMYLVUJAK.exe\" read 4096 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"","origin":"API Call","mitre_attack_id":"T1119","relevance":10,"id":"api-44","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\THUNDERBIRD\\PROFILES.INI\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES.INI\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"OEMFWGXWMYLVUJAK.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\" for deletion\n \"OEMFWGXWMYLVUJAK.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp\" for deletion\n \"OEMFWGXWMYLVUJAK.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp\" for deletion\n \"OEMFWGXWMYLVUJAK.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$51","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"OEMFWGXWMYLVUJAK.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$52","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"OEMFWGXWMYLVUJAK.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"OEMFWGXWMYLVUJAK.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Remcos 3.x Unencrypted Checkin\" (SID: 2032776, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Remcos 3.x Unencrypted Server Response\" (SID: 2032777, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"OEMFWGXWMYLVUJAK.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data For Account\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"$53","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Remcos","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5011","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$54","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$55","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Creates a mutant that is known to appear in malware","description":"\"Rmc-\" in \"Remcos\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":7,"id":"mutant-1","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"intel_graph":{"map":{"Domain:pro.ip-api.com":{"type":"Domain","value":"pro.ip-api.com"},"Domain:www.osamaphplogistices.com":{"type":"Domain","value":"www.osamaphplogistices.com"},"Domain:www.osamaphplogisticesbackup.com":{"type":"Domain","value":"www.osamaphplogisticesbackup.com"},"Domain:www.osamaphplogisticesbackup1.com":{"type":"Domain","value":"www.osamaphplogisticesbackup1.com"},"Domain:www.osamaphplogisticesbackup2.com":{"type":"Domain","value":"www.osamaphplogisticesbackup2.com"},"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229":{"type":"File","value":"01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229"},"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247":{"type":"File","value":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},"File:29bfefd797632fa405b1cf551eba2643cbc0ec4bcd889e4da63594cdd2601aea":{"type":"File","value":"29bfefd797632fa405b1cf551eba2643cbc0ec4bcd889e4da63594cdd2601aea"},"File:4475997c741dae088951435bc67cf58cc5c30148f0de645e4d8e52e4564b99fd":{"type":"File","value":"4475997c741dae088951435bc67cf58cc5c30148f0de645e4d8e52e4564b99fd"},"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813":{"type":"File","value":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49":{"type":"File","value":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"},"File:f0d42aeb8f9b88eaf743981829c62ce009b48598091be785850730f2853af3b1":{"type":"File","value":"f0d42aeb8f9b88eaf743981829c62ce009b48598091be785850730f2853af3b1"},"Ip:208.95.112.2":{"type":"Ip","value":"208.95.112.2"},"Ip:82.38.148.128":{"type":"Ip","value":"82.38.148.128"},"Url:/line/?key=QPVvv1rHQJD2pd2&fields=25948155":{"type":"Url","value":"/line/?key=QPVvv1rHQJD2pd2&fields=25948155"}},"chains":[{"id":"sandbox_network","root":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","edges":[{"edge_kind":"contacted_ip","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Ip:82.38.148.128"},{"edge_kind":"contacted_ip","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Ip:208.95.112.2"},{"edge_kind":"contacted_domain","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Domain:pro.ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:pro.ip-api.com","to_key":"Ip:208.95.112.2"},{"edge_kind":"contacted_domain","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Domain:www.osamaphplogistices.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.osamaphplogistices.com","to_key":"Ip:82.38.148.128"},{"edge_kind":"contacted_domain","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Domain:www.osamaphplogisticesbackup.com"},{"edge_kind":"contacted_domain","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Domain:www.osamaphplogisticesbackup1.com"},{"edge_kind":"contacted_domain","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Domain:www.osamaphplogisticesbackup2.com"},{"edge_kind":"contacted_url","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"Url:/line/?key=QPVvv1rHQJD2pd2&fields=25948155"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","edges":[{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"},{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:29bfefd797632fa405b1cf551eba2643cbc0ec4bcd889e4da63594cdd2601aea"},{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:4475997c741dae088951435bc67cf58cc5c30148f0de645e4d8e52e4564b99fd"},{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},{"edge_kind":"extracted","from_key":"File:01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229","to_key":"File:f0d42aeb8f9b88eaf743981829c62ce009b48598091be785850730f2853af3b1"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":5,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["credentialharvesting","commodity","criminal","rat","remcos","evasive","infostealer","suspicious","new_domain"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6ad8612ce620aff5e0091fca","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"JS:Trojan.Cryxos","contacted_countries":["DEU","USA"],"submit_name":"BL.JS","analysis_start_time":"2026-10-21T06:52:29+00:00","indicators_count":{"informative":114,"suspicious":46,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"82.38.148.128","port":2404,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"address":"208.95.112.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"dns_resolutions":[{"domain":"pro.ip-api.com","address":"208.95.112.2","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"domain":"www.osamaphplogistices.com","address":"82.38.148.128","ttl":1799,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"domain":"www.osamaphplogisticesbackup.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"domain":"www.osamaphplogisticesbackup1.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"domain":"www.osamaphplogisticesbackup2.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"http_requests":[{"host":"pro.ip-api.com","host_ip":"208.95.112.2:443","url":"/line/?key=QPVvv1rHQJD2pd2&fields=25948155","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?key=QPVvv1rHQJD2pd2&fields=25948155 HTTP/1.1\nHost: pro.ip-api.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}],"processes":[{"pid":6584,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\BL.JS\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00006584","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":7024,"ppid":6584,"name":"OEMFWGXWMYLVUJAK.exe","command_line":"%USERPROFILE%\\Documents\\KAJUVLYMWXGWFMEO","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","normalized_path":"%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe","parent_uid":"00000000-00006584","uid":"00000000-00007024"}],"all_imported_dlls":["wshext.dll","bcryptprimitives.dll","fltLib.dll","vcruntime140.dll","msctf.dll","dwmapi.dll","rsaenh.dll","msdart.dll","nsi.dll","kernel32.dll","msvcp_win.dll","59xGChl2.dll","aepic.dll","sspicli.dll","VxSSL32.dll","ncryptsslp.dll","sechost.dll","cryptbase.dll","slc.dll","winhttp.dll","mskeyprotect.dll","oleaut32.dll","ucrtbase.dll","vcruntime140_1.dll","shlwapi.dll","clbcatq.dll","jscript.dll","profapi.dll","wintrust.dll","powrprof.dll","scrobj.dll","scrrun.dll","cldapi.dll","msado15.dll","iertutil.dll","vcruntime140_clr0400.dll","winmmbase.dll","kernel.appcore.dll","version.dll","cryptsp.dll","amsi.dll","sppc.dll","Windows.StateRepositoryPS.dll","ntdll.dll","combase.dll","ws2_32.dll","uxtheme.dll","cfgmgr32.dll","propsys.dll","edputil.dll","urlmon.dll","msvcrt.dll","userenv.dll","wow64cpu.dll","ucrtbase_clr0400.dll","psapi.dll","dhcpcsvc6.dll","dhcpcsvc.dll","OnDemandConnRouteHelper.dll","advapi32.dll","MpOAV.dll","mpr.dll","ncrypt.dll","KernelBase.dll","user32.dll","coml2.dll","msIso.dll","wow64.dll","mscoree.dll","GdiPlus.dll","rasadhlp.dll","msvcp140.dll","IPHLPAPI.DLL","dnsapi.dll","FWPUCLNT.DLL","dpapi.dll","schannel.dll","gdi32.dll","msxml3.dll","wow64win.dll","wininet.dll","msisip.dll","shell32.dll","gpapi.dll","apphelp.dll","winmm.dll","mswsock.dll","winnsi.dll","ntasn1.dll","rpcrt4.dll","gdi32full.dll","sxs.dll","wldp.dll","crypt32.dll","bcrypt.dll","windows.storage.dll","msasn1.dll","win32u.dll","imm32.dll","VxSSL64.dll","SHCore.dll","MpClient.dll","ntmarta.dll","imagehlp.dll","clr.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OEMFWGXWMYLVUJAK.exe","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Login Data For Account.tmp","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"KAJUVLYMWXGWFMEO","sha256":"29bfefd797632fa405b1cf551eba2643cbc0ec4bcd889e4da63594cdd2601aea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"logs.dat","sha256":"4475997c741dae088951435bc67cf58cc5c30148f0de645e4d8e52e4564b99fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Login Data.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"line_1_.txt","sha256":"f0d42aeb8f9b88eaf743981829c62ce009b48598091be785850730f2853af3b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%USERPROFILE%\\Documents\\KAJUVLYMWXGWFMEO","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%USERPROFILE%\\Documents\\OEMFWGXWMYLVUJAK.exe","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%ALLUSERSPROFILE%\\folder\\logs.dat","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data.tmp","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Local\\SM0:6584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Local\\SM0:6584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"SM0:6584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"SM0:6584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7024:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Rmc-V77YNK","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"Local\\SM0:7024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"SM0:7024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"SM0:7024:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Rmc-V77YNK","sources":[{"report_type":"sandbox","report_id":"6ad8612ce620aff5e0091fca"}]}]}},"report_ids":{"sandbox_job_ids":["6ad8612ce620aff5e0091fca"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Cryxos.JS Sample 01b5272358a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 01b5272358a2…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cryxos.JS Sample 01b5272358a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 01b5272358a2…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/01b5272358a27bfca8a7fa0ff5ee170a47d1a0eb2405e72b98b0c7ee4e398229"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cryxos.JS Sample 01b5272358a2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 01b5272358a2…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 5/26 AV engines flagged this file. 8 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]] 32:null