33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 41:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:Td33,Pattern match: "https://tfgames.site/game/1836/debt"", Heuristic match: " is bolted down, not because you'll struggle but because he believes in doing things properly. what happens in the room takes hours. what happens to your body in those hours is a curriculum: restraint, penetration, thresholds, the physics of how much ", Heuristic match: "= g; list += '

' + esc(groups[g]) + '

'; } list += '

'; var intro=m.total===0?'

=0){e+=wr.data[r];wr.data[r]=math.floor(e/t);e=e%t*wr.base}},numtostring:function numtostring(){var ", Pattern match: "http://purl.eligrey.com/github/classlist.js/blob/1.2.20171210/classlist.js", Heuristic match: "backup.endings[id] = true; delete seen[id]; var removed = (setup.crosslinks[id] || []).filter(function(target) { /* a reached target may have a purchased b. another reached source may independently grant it. preserve either kind ", Pattern match: "http://purl.eligrey.com/github/filesaver.js/blob/master/dist/filesaver.js", Pattern match: "https://tfgames.site/game/2719/rising-debt"", Heuristic match: "gangsteraccess') return (v.domsub || 0) > 50 || (v.iq || 0) <= 100 ? 1 : 0; if (key === 'employershifts') return (number(v.burnsshifts) || 0) + (number(v.receptionshifts) || 0); return typeof v[key] === 'boolean' ? (v[key] ? 1 : 0) : number", Heuristic match: " diligence. you don't object. the parish will keep saving you; you will keep falling - the same rhythm your body has already learned. <<if setup.scenebodyiswoman()>> <<vid "end/thevow/" 5>> <</if>> <b"36:T1506,Observed string: " he lays you back on the blanket and puts his mouth on you. His tongue finds the place you showed him; his fingers curl inside you at the angle you like. <</if>> He steadies your hip. "Like that?" he asks, once, into you. "You're doing your homework," you breathe, and feel him smile against you, and the homework goes on and on, patient as everything he has ever decided to be good at. <<linkreplace "Continue">><<replace "#inthome-stage">><<include "IntHome05">><</replace>><</linkreplace>><<vid "scene/internhome/" "04">> Then: "The couch," he says " (Indicator: " curl ") in Source: sample.bin, Observed string: "> <<if _v == 0>> You give up trying to remember the drinks and stay where the men want you instead. You curl into laps, you let hands wander right out in the open, you follow whoever tugs your wrist off into the dark booths, soft and giggly and easy, while somewhere your fingers keep tucking the bills away because bills are good. Being told what to do is the nicest thing; you don't have to decide anything, you just have to say yes and smile. They take you in the little storage room among the crates, the wall cool on your back, one after another after another, and you go all warm and floaty and lovely, like a bath you never have to get out of. There's no big scary bottom to hit because there's no tall serious you left to fall from - just a sweet blank thing that gets used and hummed over and used again. When morning comes you're achy and empty and honestly kind of glowing, pockets fat, head quiet. Everybody wanted you all night. Lots and lots of somebodies. That'" (Indicator: " curl ") in Source: sample.bin, Observed string: "" You grab his shoulders. "Marcus." "Marcus." "Say it again." "Marcus." You say it into his neck. His fingers curl inside you and hit a spot that makes your vision blur and your thighs shake and your nails dig into his shoulders and the sound you make is not professional and not performed and not for anyone's benefit except the part of you that has been waiting for this since the third glass of wine. "That's it." His thumb finds your clit. Presses. "I want to hear you." You moan. Not quietly. The hotel room is soundproofed for people who have conversations they don't want overheard, and right now the conversation you're having is with his fingers and your body and the fire, and the fire doesn't mind. He pulls his hand away. You gasp at the loss. He lifts you by the hips. He positions you above him " (Indicator: " curl ") in Source: sample.bin, Observed string: " guiding. His fingers curl into your hair and he holds you still for a moment, with just the head in your mouth, and you look up at him. He's looking down at you. The fire is behind him and the light catches the edge of his jaw and the planes of his chest and the muscles in his thighs and he looks like a sculpture of a man who owns things. His expression holds open *appreciation.* The warm, proprietary satisfaction of a man looking at something beautiful that he's been given for the evening. "You are *gorgeous* like this," he says. You pull back. Strings of saliva connect your lip to his cock. You wipe your mouth with the back of your hand. "Flatterer." "Honest." He reaches down and cups your face. His thumb brushes your cheekbone. "Your boss wasn't lying." "He usually isn't." "Neither am I." You take him back in your mouth. Deeper this time " (Indicator: " curl ") in Source: sample.bin, Observed string: " unhurried, thorough, reading you like a statement that reconciles. Two fingers curl inside and press the spot that makes your spine lift off the mattress; his tongue keeps its meter above them, steady, a metronome. The coiling starts low, in the place where all your numbers live " (Indicator: " curl ") in Source: sample.bin, Observed string: "intment.<</if>> <br><<if _p gte 3>> <<set _w to window.drawFromDeck('deckTxtAthExtraB', [], 4)>> <<if _w == 0>>It's actually really nice - he's gentle and caring, not like the others, and something in your chest that you don't quite have a word for anymore. Maybe you like him? Liking someone feels good, and good is what you're for now.<<elseif _w == 1>>He asks you to stay, not because he wants anything rougher, but because he likes having you close. You curl against all that warm muscle and happily decide the extra money is only a bonus.<<elseif _w == 2>>The second round is slow and playful. He laughs with you instead of at you, and the sweetness makes you imagine that perhaps you are his girlfriend for tonight - girlfriends get paid sometimes, probably.<<else>>He remembers little things you said during the last visit and pays simply to keep you longer. Being remembered makes your chest glow. You " (Indicator: " curl ") in Source: sample.bin37:Tc8b,Observed email domain:"mr. burns keeps finding reasons to hover at your desk, and you've figured out the trick: if you undo a button or two and lean just so, he goes flustered and pink and nice to you all day, so you do it, because making the boss pink is fun and easy and means nobody makes you do the hard number-stuff. you give him the meaningful little smile and toss your hair and he practically trips over his own feet. at the end he calls you in and writes a big "diligence bonus" with a long look, and you take it and beam, delighted with your clever trick. you used to think trading your prettiness at work was a scary line to cross; you can't remember why. it's the easiest money there is, and burns is so happy, and happy bosses are the best kind. <<elseif _v == 1>> you wear the blouse with the stretchy buttons because mr. burns becomes extra generous whenever one looks ready to pop. all afternoon, you carry papers to his desk and lean close enough for him to forget what he asked for. " [Source: sample.bin], Observed email domain:"our shift ends the car is already waiting outside - the same one as always, with the driver who has never once looked at you in the mirror. "dinner?" you ask, for the record, getting in. "later," he says. the driver starts the car before you can ask anything else. the elevator climbs a long time; your ears pop. the penthouse greets you with light and white leather - a lot of light, a lot of leather, not one spare object. in the dressing room the set is already laid out: white hold-up stockings and pale blue lingerie, nearly weightless; the silk settles <<bodytext 'on your breasts' 'on your chest'>> with a chill. on the table lies his card, the first he has ever written by hand: "there is no hurry." you sit on the edge of the white couch exactly as long as it takes to understand: he really is in no hurry. not tonight. not with you. <<linkreplace "begin">><<replace "#penthouse-stage">><<include "pe" [Source: sample.bin], Observed email domain:"mine," the gangster says, not turning his head. "business partner. big deal. keep him company for me, yeah?" he says nothing more the whole way. the city changes from yours to someone else's, from someone else's to glass; the lift climbs so long your ears pop. the flat at the top is bright, empty, windows full of sky: no curtains, no cupboards - a couch, a bed, and the city below your feet. there is nowhere to change out of sight. the guest is big, slow, heavy as a safe; he looks you over the way a new phone model is looked over: without lust, sizing up the features. the gangster settles by the window with his coffee and lets the guest speak. tonight he is following someone else's lead. he waits while the guest looks you over. you wait too, unsure whether to sit down. <<linkreplace "introductions">><<replace "#theguest-stage">><<include "theguest02">><</replace>><</linkreplace>>

<h2>The Protocol</h2> <div id="ownproto-stage"><<include "OwnP" (Indicator: " finger ") in Source: sample.bin, Observed string: " his knees between your legs, his hands spreading your cheeks, and then the cool shock of lube against your asshole, his finger pressing gently, tentatively, the touch of a man who is touching something he's only ever seen. "Like this?" "Slower." "Sorry." "Slower is good. Just " (Indicator: " finger ") in Source: sample.bin, Observed string: " thoroughly, without cruelty, watching the principal's breathing the way Marla once watched yours, calling the changes with one finger off your own folded arms. When the principal asks " (Indicator: " finger ") in Source: sample.bin, Observed string: "nd finds the relevant line. You watch where her finger rests." ], "replies": [ "\"You asked about the account last time,\" she says, turning your file toward you. \"Check the current quote, including any change to the rate. The price beside a treatment isn't the only figure that matters.\"", "\"You asked about repeat work,\" she says. \"The later adjustments are smaller. That doesn't make them free, or undo the first operation.\" She waits for you to finish reading before taking the file back." ] } ], "thoughts": [ "You keep a finger on the paragraph you are reading. The room makes it very easy to let someone turn the page for you.", "You ask for the quote again. You would rather sound difficult at the desk than remember the question afterward.", "The page keeps going on the back. You turn it over carefully so she knows you saw." ], "greeting": "The receptionist opens your file. You pull the chair close enough to read it with " (Indicator: " finger ") in Source: sample.bin, Observed string: " to show. <<if not setup.sceneBodyIsWoman()>> <<vid "place/model-studio-" "01">> <<else>> <<vid "end/face/" 1>> <</if>> The good job found you by itself. A trading company was looking for the face of a campaign - not a top model, but "a person people believe": that kind of advertising sells better than glamour. Test shoots, a second round, a tenth; on the eleventh the art director jabbed a finger at your freeze-frame: "That's the one." You never did understand what exactly he saw. Then you stopped asking. <<vid "end/face/" 2>> The agency sends you a sample of the campaign. They've cropped it close enough that all you can see is your face. It looks like you on a day you got enough sleep. In the brand stores they already wear your shade of lipstick. You consider that the best review. <<vid "end/face/" 3>> The new manager builds your schedule a ye" (Indicator: " finger ") in Source: sample.bin, Observed string: " work it in." He works it in. One finger, slick with lube, sliding into your ass with the careful, measured pace of a man who is afraid of breaking something. His touch feels unfamiliar because it is so *careful.* Different because his hands are shaking. Different because he's whispering *sorry, sorry, sorry* under his breath like a mantra while his finger opens you up. "Are you okay?" he asks. To *you.* He's the one who's shaking and he's asking if *you're* okay. "I'm fine. Add another." "Another " (Indicator: " finger ") in Source: sample.bin, Observed string: " he says, and buckles the gag. He checks the strap with one finger before making a mark on his clipboard. Then the vibrator " (Indicator: " finger ") in Source: sample.bin, Observed string: " you can smell cold stone and faint machine oil. Your knees are together. The latex catches the light of the hanging lamp. <</if>> He stands in front of you. He unzips. He doesn't speak. The folder is open on the bench. From the floor you can still read *Position one: 22:00.* You glance up at the clock. You take him into your mouth. He's already hard. He hooks a finger through the D-ring and holds it, keeping your chin raised. He starts slowly, testing how far you can take him. Then he increases the pace. His finger stays in the ring. <<linkreplace "Continue">><<replace "#ownproto-stage">><<include "OwnProto04">><</replace>><</linkreplace>>

<<vid "scene/ownerprotocol/" "03">> The clock reads 22:18 when he pulls out. "Position two." He bends you over t" (Indicator: " finger ") in Source: sample.bin, Observed string: "Day to $days>> <<set _course to setup.payClinicCourse("feminine")>> <<set $femBody to Math.min(100, $femBody + 20)>> <div class="media-container"><img class="game-media" src="img/venue-stories/clinic-welcome-v1.png" alt="The clinic waiting room"></div> The nurse turns the statement around so you can read the number. You run your finger down to the line where the next review is listed. " (Indicator: " finger ") in Source: sample.bin, Observed string: "h lean over the work until she is satisfied.", "\"That reader you asked about is in again,\" the librarian says. \"If he wants a lesson, make him tell you what he expects to learn.\" She gives the booking sheet a dry, appraising look." ] } ], "thoughts": [ "You have started noticing books left in the wrong place. The building is becoming a place you can put right.", "The shelves are easier to read than the readers. You take your time with both.", "You remembered where the book goes. You run a finger along its neighbors, pleased with the neat row." ], "greeting": "The librarian leaves the cart beside your aisle. The damaged books are in a separate pile.", "kind": "work" }, "smith": { "label": "Mr. Smith's office", "counter": "smithShifts", "thresholds": [ 0, 2, 4 ], "image": "img/place/smith-office-01.png", "beats": [ { "title": "The spare chair", "pages": [ "Smith turns a" (Indicator: " finger ") in Source: sample.bin, Observed string: " "title": "The table by the wall", "pages": [ "Two men choose the same table despite the empty window seats. One leaves a generous tip beneath his saucer. The woman at the machine watches you find it.\n\n\"Some come for the coffee,\" she says. \"Some want you to remember them.\"\n\n\"And some?\"\n\nShe glances at the table. \"Want you to forget what time your shift ends.\"", "She shows you the schedule. There are ordinary mornings, familiar customers, and enough small tasks to get good at. Then her finger stops beside a name written in pencil.\n\n\"People make requests. Some pay for attention. Some ask for more. Don't mistake the size of a tip for how small the favor will be.\"\n\nThe bell above the door rings. She lets you choose the next question before she turns to it." ], "question": "What do you ask her about?", "options": [ "Learning the regular morning shift", "The customers who ask for more" ], "answers": [ " (Indicator: " finger ") in Source: sample.bin, Observed string: " you ask. He puts his finger on the signature box. At the clinic they fit you for a new uniform after the last appointment. You tell the attendant the old one used to sit differently. She says she'll see if it can be taken in. Customers tip you to remember their names. A man hands you a little extra because you laugh when he tells you his again. At home you write it in the diary. In the morning it looks like a word somebody else wanted you to learn. <<else>> <<vid "end/bimbo" 6>> <h1>DEFEAT: EMPTY DOLL</h1> You notice the mistakes in your diary before you notice anything else. Sums crossed out, names written three different ways, sentences abandoned halfway through. You go back a week and find an entry you don't remember writing. It takes you so long to read it that you forget why you were looking. Smith puts a sheet of paper in front of you. "Will you sign?" You know that word. The others are harder. You start the first line again, lose your" (Indicator: " finger ") in Source: sample.bin, Observed string: " and open your blouse button by button while he watches. The pencil skirt follows. You step out of it and leave it on the carpet, and what's left of the firm's dress code is stockings, heels, and nothing the compliance folder mentions. "Conditions first. My terms." "Your terms." Delighted. Men like this have never once heard those two words in that order. "Name one." "One." You walk your fingers down your stomach <<if setup.sceneHasPenis()>>and slip them under your waistband<<else>>and part your folds<</if>>, showing him exactly where these negotiations will be conducted. "The signature comes after. Nobody signs anything until the closing condition is fulfilled. To my satisfaction." <<if setup.sceneHasPenis()>>You catch him looking and let him look for a moment longer.<<else>>You slide one finger through your own wetness and hold it up to the gold light.<</if>> "This is the" (Indicator: " finger ") in Source: sample.bin, Observed string: "t the crossing. You wait for the noise to pass and try again." ], "replies": [ "She remembers your question about working alone and leaves an index guide beside your notes. \"Try this before you get stuck looking for the same answer in three books.\"", "\"For that lesson you asked about,\" she says, \"bring the bit you got wrong. A tutor can do more with an honest mistake than a page you copied perfectly.\"" ] } ], "thoughts": [ "For a while, there is a question you can answer without deciding what to give up.", "You work through the passage slowly. You are tired of pretending you understand things just to get them over with.", "You keep your place with a finger. When your eyes wander, the finger is still there to help." ], "greeting": "The librarian nods toward the reading room. You know which shelf holds the guides.", "kind": "service" }, "prayer": { "label": "The church " (Indicator: " finger ") in Source: sample.bin, Observed string: "till smart. You mouth each word slowly and use your finger to keep your place. You finish two pages. In your head, the strict tutor says, "Well done," and the praise feels better than the coffee. For the rest of the morning goes smoother. You go back and read them once more, just to be sure. <<elseif _v == 2>> The textbook has been under your coffee cup for three days. This morning you wipe off the ring and try again. The words feel heavy. Your eyes keep slipping toward the mirror and your nails. Then one formula suddenly makes sense. You gasp and clap once before remembering you're alone. It used to be this easy all the time, didn't it? You write the formula on your wrist before it can disappear. <<else>> You use lipstick to mark every sentence you understand. Soon the page is covered in bright little lines, and although some marks circle the same sentence twice, the color makes progress look real. You wipe the lipstick from your finger before turning the page. On" (Indicator: " finger ") in Source: sample.bin, Observed string: " back bowing, thighs clamping his waist, the conference table walking an inch across the carpet. <</if>> Then, wrecked and gracious, you open your arms. "Now finish the negotiation." At your nod he finishes on your stomach, long hot ropes reaching the underside of your chest. The draft agreement is still beside your head, unsigned. "The clause," he says afterward, when he can speak. "You never wrote it in." "There's no clause, Daniel." You sit up and drag one finger through the mess on your stomach. "There's only the market. And the market says you sign at forty-five days." He initials each page with a fountain pen the size of a small sailboat, hand still shaking. Afterward he dresses like a man who won something. You straighten the contract while he buttons his shirt. <<linkreplace "Continue">><<replace "#offsecond-stage">><<include "OffSecond06">><</replace>" (Indicator: " finger ") in Source: sample.bin39:T44a,Found reference to API "e(Math,"imul",function imul(e,t){return ce.Call(Lr,Math,arguments)})}var Fr=function(){var e=S.setTimeout;if(typeof e!=="function"&&typeof e!=="object"){return}ce.IsPromise=function(e){if(!ce.TypeIsObject(e)){return false}if(typeof e._promise==="undefined"){return false}return true};var r=function(e){if(!ce.IsConstructor(e)){throw new TypeError("Bad promise constructor")}var t=this;var r=function(e,r){if(t.resolve!==void 0||t.reject!==void 0){throw new TypeError("Bad Promise implementation!")}t.resolve=e;t.reject=r};t.resolve=void 0;t.reject=void 0;t.promise=new e(r);if(!(ce.IsCallable(t.resolve)&&ce.IsCallable(t.reject))){throw new TypeError("Bad promise constructor")}};var n;if(typeof window!=="undefined"&&ce.IsCallable(window.postMessage)){n=function(){var e=[];var t="zero-timeout-message";var r=function(r){M(e,r);window.postMessage(t,"*")};var n=function(r){if(r.source===window&&r.data===t){r.stopPropagation();if(e.length===0){return}var n=N(e);n()}};window.addEventListener("message",n,true);return r}}var" (Indicator: "postmessage"; Source: "sample.bin")3a:T4ec,"WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004128) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004128)3b:T751,"WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000000000d6bcf67f000000000000000000001800000000000000000000000000000000000000000000003aaccf73de7b0000289c72045b7f000000000000000000004abd2554fd7f00000600000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000d6bc (UID: 00000000-00004128) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000032a99201000000603600000000008e53777efd7f0000b0f08fb8820000007e85067dfd7f0000020000000000000000000000000000007457360000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000033b2d7bcf67f000040f08fb8 (UID: 00000000-00004128) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000080e51ca792010000c0fb9662fd7f00000001000000000000b8fb9662fd7f0000000000000000000080cbab7efd7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a9662fd7f00000000000000000000b8fb9662fd7f000000000000 (UID: 00000000-00004128) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863c2961fd7f0000104c2961fd7f000040b32b61fd7f0000104c2961fd7f000040b32b61fd7f000020b32b61fd7f00009d3c2961fd7f000060262c61fd7f000050ba18a79201000060ba18a79201000000005b7efd7f00000100000000000000bddbad7efd7f0000000000000000000038b32b61fd7f000000000000 (UID: 00000000-00004128) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004128)3c:T1ae8,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00004128) "WScript.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00004128)3d:T855,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd541a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd7a240000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffd7f3c0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffd7e760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffd54100000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffd6f6b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7d000000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7d000000 "WScript.exe" loaded module "KERNEL32" at base 7ffd7e760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd725f0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffd6f610000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7d000000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WCXI5NPP.DLL" at base 7ffd638a0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffd7c400000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd7e340000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd7bbd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffd63580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd7ce90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffd62960000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffd61290000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffd7f690000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffd7f5e0000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffd7e5b0000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffd7e5b0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffd7e340000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffd7eda00003e:T55e,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")3f:Tcba,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBADF775-48AA-4BF3-8F8E-EC68D113C98E"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F0558438-F56A-5987-47DA-040CA75AEF05"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C7E09E2A-C663-5399-AF79-2FCCD321D19A"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "")40:T4b2,"WScript.exe" trying to touch file "C:\WINDOWS\System32\VERSION.dll" "WScript.exe" trying to touch file "C:\Windows\System32\version.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\FLTLIB.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\MSVCP140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140_1.dll" "WScript.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\WScript.exe" "WScript.exe" trying to touch file "\Global??\FltMgrMsg" "WScript.exe" trying to touch file "C:\WINDOWS\System32\CRYPTSP.DLL"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 315ba2147e14… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 315ba2147e14…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"DebtLoop 0.8a.html\",\"applicationCategory\":[\"script\",\"vbs\"],\"identifier\":\"315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794288655379,"unified_at":"2026-11-10T05:30:55.379Z","metadata":{"hashes":{"sha256":"315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","sha1":"9a7a6701808e9cd263ce5719ef7f20e3daef1f44","md5":"f3fc41577f6c0d27d88d817eb618ac55","sha512":"6a5dac4ad66ca686bdc72970a22171bf2a2ab4b079538264b9442883137acd42f106cdadc29a58c3b15e646eda1f833a501fb8e5be85c8083069a636da3b22e3","ssdeep":"49152:ykuSR4U0kTam4l8E4q/nEvSsPiBb2+UEstr15pO+Lar0VzS3L8Q+KY6txCwvEmIS:rqL","ssdeep_chunks":["49152:ykuSR4U","49152:kuSR4U0","49152:uSR4U0k","49152:SR4U0kT","49152:R4U0kTa","49152:4U0kTam","49152:U0kTam4","49152:0kTam4l","49152:kTam4l8","49152:Tam4l8E","49152:am4l8E4","49152:m4l8E4q","49152:4l8E4q/","49152:l8E4q/n","49152:8E4q/nE","49152:E4q/nEv","49152:4q/nEvS","49152:q/nEvSs","49152:/nEvSsP","49152:nEvSsPi","49152:EvSsPiB","49152:vSsPiBb","49152:SsPiBb2","49152:sPiBb2+","49152:PiBb2+U","49152:iBb2+UE","49152:Bb2+UEs","49152:b2+UEst","49152:2+UEstr","49152:+UEstr1","49152:UEstr15","49152:Estr15p","49152:str15pO","49152:tr15pO+","49152:r15pO+L","49152:15pO+La","49152:5pO+Lar","49152:pO+Lar0","49152:O+Lar0V","49152:+Lar0Vz","49152:Lar0VzS","49152:ar0VzS3","49152:r0VzS3L","49152:0VzS3L8","49152:VzS3L8Q","49152:zS3L8Q+","49152:S3L8Q+K","49152:3L8Q+KY","49152:L8Q+KY6","49152:8Q+KY6t","49152:Q+KY6tx","49152:+KY6txC","49152:KY6txCw","49152:Y6txCwv","49152:6txCwvE","49152:txCwvEm","49152:xCwvEmI","49152:CwvEmIS","98304:ykuSR4U","98304:kuSR4U0","98304:uSR4U0k","98304:SR4U0kT","98304:R4U0kTa","98304:4U0kTam","98304:U0kTam4","98304:0kTam4l","98304:kTam4l8","98304:Tam4l8E","98304:am4l8E4","98304:m4l8E4q","98304:4l8E4q/","98304:l8E4q/n","98304:8E4q/nE","98304:E4q/nEv","98304:4q/nEvS","98304:q/nEvSs","98304:/nEvSsP","98304:nEvSsPi","98304:EvSsPiB","98304:vSsPiBb","98304:SsPiBb2","98304:sPiBb2+","98304:PiBb2+U","98304:iBb2+UE","98304:Bb2+UEs","98304:b2+UEst","98304:2+UEstr","98304:+UEstr1","98304:UEstr15","98304:Estr15p","98304:str15pO","98304:tr15pO+","98304:r15pO+L","98304:15pO+La","98304:5pO+Lar","98304:pO+Lar0","98304:O+Lar0V","98304:+Lar0Vz","98304:Lar0VzS","98304:ar0VzS3","98304:r0VzS3L","98304:0VzS3L8","98304:VzS3L8Q","98304:zS3L8Q+","98304:S3L8Q+K","98304:3L8Q+KY","98304:L8Q+KY6","98304:8Q+KY6t","98304:Q+KY6tx","98304:+KY6txC","98304:KY6txCw","98304:Y6txCwv","98304:6txCwvE","98304:txCwvEm","98304:xCwvEmI","98304:CwvEmIS"],"imphash":"Unknown"},"file_info":{"file_name":"DebtLoop 0.8a.html","file_type":["script","vbs"],"file_type_id":"vbs","file_size":3561332,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794288540000,"last_seen":1794288540000,"last_multi_scan":1794288540000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":70,"suspicious_count":1,"malicious_count":0,"total":71},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set the value of an HTTP request header"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to retrieve remote user information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-623","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://tfgames.site\", Found HTTPS url \"https://www.patreon.com\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://boosty.to\", Found HTTPS url \"https://subscribestar.adult\", Found HTTPS url \"https://f95zone.to\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$36","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \"@gmail.\"; Source: \"sample.bin\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -o\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1595.002","id":"string-996","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"100', 'Changes some client fees, church branches, route checks and endings. Take a quiet hour at noon to lower it by up to 6 for 20 base stamina.'],\n ['Stamina', '0\" (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[end]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where do you want my hands?\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"$38","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-579","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$39","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"file/memory contains long string with (Indicator: \" Sleep \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceA\" with parameter \"65\" - (UID: 00000000-00004128)\n \"WScript.exe\" called \"FindResourceA\" with parameter \"257\" - (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '140726013788160', 'hResInfo': '1729408010416'}\" (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '140726013788160', 'hResInfo': '1729408010464'}\" (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00004128-00000C15-3281168161 [PID: 4128]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004128-00000C15-3281174771 [PID: 4128]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004128-00000C15-3281353808 [PID: 4128]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004128-00000C15-3281360419 [PID: 4128]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004128)\n \"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WScript.exe\" called \"GetActiveWindow\" (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004128)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"DebtLoop 0.8a.html\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WScript.exe\" queried token user identity (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00004128)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4128:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4128:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4128:120:WilError_03\"\n Process WScript.exe created mutex with name \"Local\\SM0:4128:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"SM0:4128:120:WilError_03\"\n Process WScript.exe created mutex with name \"SM0:4128:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"thomasmedwards@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6F6B0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7D4D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7F3C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042277dfd7f0000@ntdll.dll\"\n \"22002300000000004042277dfd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"DebtLoop 0.8a.html\" was detected as \"HTML\" and name: \"source\"\n \"DebtLoop 0.8a.html\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")\n \"WScript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00004128-00000C2B-3281756043]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00004128-00000C2B-3282048076]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpswww.patreon.comcYellowArachnid\" has type \"HTML document Unicode text UTF-8 text with very long lines (22434)\"- [targetUID: 00000000-00004128]\n \"urlref_httpsboosty.toyellowarachnid\" has type \"HTML document Unicode text UTF-8 text with very long lines (60652)\"- [targetUID: 00000000-00004128]\n \"urlref_httpsf95zone.tothreadsrising-debt-v1-5-1-horatiothegreat.115269\" has type \"HTML document Unicode text UTF-8 text with very long lines (5956)\"- [targetUID: 00000000-00004128]\n \"urlref_httpssubscribestar.adultyellowarachnid\" has type \"HTML document Unicode text UTF-8 text with very long lines (10196)\"- [targetUID: 00000000-00004128]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"WScript.exe\" monitors \"HKCU_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"WScript.exe\" monitors \"HKCU_Classes\" (Filter: 268435461; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 4128)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\debtloop0.8a.html.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"WScript.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10b3f\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\DebtLoop0.8a.html.vbs\"\" (UID: 00000000-00004128)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}],"intel_graph":{"map":{"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da":{"type":"File","value":"315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da"},"File:5ac85216691a801f9a60a3f9f7e078cb38f61aec38bc73d15362cb977856c43e":{"type":"File","value":"5ac85216691a801f9a60a3f9f7e078cb38f61aec38bc73d15362cb977856c43e"},"File:7debc46a5d1aa119015028db2dc1a9a45047b4642eb472333df4fca8c887e5ec":{"type":"File","value":"7debc46a5d1aa119015028db2dc1a9a45047b4642eb472333df4fca8c887e5ec"},"File:a14bd57eceee05ac547bcea8231d4b1553e79b313b7267c0611aba8c48960d11":{"type":"File","value":"a14bd57eceee05ac547bcea8231d4b1553e79b313b7267c0611aba8c48960d11"},"File:dcf997c0f742e22c4a430318ecc11ddf0facf41620bcf609278248d9775aef81":{"type":"File","value":"dcf997c0f742e22c4a430318ecc11ddf0facf41620bcf609278248d9775aef81"}},"chains":[{"id":"sandbox_files","root":"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","edges":[{"edge_kind":"extracted","from_key":"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","to_key":"File:a14bd57eceee05ac547bcea8231d4b1553e79b313b7267c0611aba8c48960d11"},{"edge_kind":"extracted","from_key":"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","to_key":"File:7debc46a5d1aa119015028db2dc1a9a45047b4642eb472333df4fca8c887e5ec"},{"edge_kind":"extracted","from_key":"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","to_key":"File:dcf997c0f742e22c4a430318ecc11ddf0facf41620bcf609278248d9775aef81"},{"edge_kind":"extracted","from_key":"File:315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da","to_key":"File:5ac85216691a801f9a60a3f9f7e078cb38f61aec38bc73d15362cb977856c43e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6af2ab9ba789b860c00f8238","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"DebtLoop 0.8a.html","analysis_start_time":"2026-11-10T05:29:00+00:00","indicators_count":{"informative":70,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}],"processes":[{"pid":4128,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\DebtLoop0.8a.html.vbs\"","sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00004128","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["TextShaping.dll","ntdll.dll","kernel32.dll","oleaut32.dll","msvcp_win.dll","rpcrt4.dll","vcruntime140_1.dll","cryptsp.dll","iertutil.dll","gdi32.dll","sechost.dll","userenv.dll","wldp.dll","crypt32.dll","msasn1.dll","scrobj.dll","bcryptprimitives.dll","amsi.dll","rsaenh.dll","TextInputFramework.dll","CoreUIComponents.dll","gdi32full.dll","version.dll","VxSSL64.dll","vbscript.dll","MpOAV.dll","shlwapi.dll","sxs.dll","wintrust.dll","CoreMessaging.dll","ole32.dll","KernelBase.dll","msvcrt.dll","ucrtbase.dll","win32u.dll","kernel.appcore.dll","wcXI5nPP.dll","wshext.dll","imm32.dll","ws2_32.dll","fltLib.dll","msvcp140.dll","msctf.dll","clbcatq.dll","profapi.dll","WinTypes.dll","combase.dll","user32.dll","advapi32.dll","vcruntime140.dll","uxtheme.dll","cryptbase.dll","msisip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpswww.patreon.comcYellowArachnid","sha256":"a14bd57eceee05ac547bcea8231d4b1553e79b313b7267c0611aba8c48960d11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"urlref_httpsboosty.toyellowarachnid","sha256":"7debc46a5d1aa119015028db2dc1a9a45047b4642eb472333df4fca8c887e5ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"urlref_httpsf95zone.tothreadsrising-debt-v1-5-1-horatiothegreat.115269","sha256":"dcf997c0f742e22c4a430318ecc11ddf0facf41620bcf609278248d9775aef81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"urlref_httpssubscribestar.adultyellowarachnid","sha256":"5ac85216691a801f9a60a3f9f7e078cb38f61aec38bc73d15362cb977856c43e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4128:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"Local\\SM0:4128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"SM0:4128:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]},{"name":"SM0:4128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2ab9ba789b860c00f8238"}]}]}},"report_ids":{"sandbox_job_ids":["6af2ab9ba789b860c00f8238"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 315ba2147e14… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 315ba2147e14…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da"}],["$","meta","4",{"property":"og:title","content":"Sample 315ba2147e14… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 315ba2147e14…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/315ba2147e147b9ee8f522133f2b52554d16e4d3cd34434c8990f2bad3c786da"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 315ba2147e14… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 315ba2147e14…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]] 32:null