24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a332d0013114… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a332d0013114…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0"],"about":{"@type":"SoftwareApplication","name":"Pending Required Documents for AuthorizationP.js","applicationCategory":["script","javascript"],"identifier":"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T64f,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\PIFFILE\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\PROGIDS\PIFFILE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\PIFFILE\SHELL\OPEN\DDEEXEC") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE\SHELL\OPEN\DDEEXEC") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GVROBANFGPGAORKT.PIF")26:Ta50,"WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1481485162 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1481493664 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1481896434 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1481905501 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1482056678 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1482065592 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1482484724 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1482492640 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1483008319 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1483016138 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1490567374 [PID: 7544] "WScript.exe" queried SystemProcessInformation at 00000000-00007544-00000C15-1490574577 [PID: 7544] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1491139441 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1491146190 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1491271707 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1491278655 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493561395 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493568164 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493707442 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493714597 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493989945 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1493997002 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1494450159 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1494456944 [PID: 6688] "GVROBANFGPGAORKT.PIF" queried SystemProcessInformation at 00000000-00006688-00000C15-1494633597 [PID: 6688]27:T68c,"GVROBANFGPGAORKT.PIF" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAALYh0LPj8fu4Etx63N3lgWs6sbRHZPtzFiEo2HHPdsvQAAAAADoAAAAACAAAgAAAAScMZiXF5UGqg9GZWr56DQJTVIJU/+1rBU0ZzLoRAjLIwAAAANd5CrqGqOi43CndxYcNjXU4g" "cchString": "392" "dwFlags": "1" "pcbBinary": "25010000"} "GVROBANFGPGAORKT.PIF" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAALYh0LPj8fu4Etx63N3lgWs6sbRHZPtzFiEo2HHPdsvQAAAAADoAAAAACAAAgAAAAScMZiXF5UGqg9GZWr56DQJTVIJU/+1rBU0ZzLoRAjLIwAAAANd5CrqGqOi43CndxYcNjXU4g" "cchString": "392" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "25010000"} "GVROBANFGPGAORKT.PIF" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACP+gxoCsmn4un5XF9qOL9aw9fh5zRmD80bq4JaEXL0dAAAAAAOgAAAAAIAACAAAABKexJXWzccnfiFJmhE+KfQTxCzjoECh3Sff43Rs47FfzAAAADm9teK1IOdo3bbNHaw9Hkl" "cchString": "396" "dwFlags": "1" "pcbBinary": "27010000"} "GVROBANFGPGAORKT.PIF" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACHJsnUgX4+S6XXxVYYgVOmEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACP+gxoCsmn4un5XF9qOL9aw9fh5zRmD80bq4JaEXL0dAAAAAAOgAAAAAIAACAAAABKexJXWzccnfiFJmhE+KfQTxCzjoECh3Sff43Rs47FfzAAAADm9teK1IOdo3bbNHaw9Hkl" "cchString": "396" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "27010000"}28:T24f7,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac51befc7f0000000000000000000051ed45bffc7f000000000000680100000000000000000000a06bc163ad3b00002a000000000000005057de97680100008fec45bffc7f0000e0ac51befc7f0000e0ac51befc7f0000000000000000000000000000fc7f0000ffffff7fd247000000000000000000000000000000000000d8ce45befc7f00002a0000000000000069c3febdfc7f00003100000000000000e802000000000000ec020000000000001100011000000000a0ce4f6e2b00000003a304bdfc7f0000a0ce4f6e2b00000000000000000000002b00000000000000000000000000000020b004befc7f0000b43f03befc7f0000e0ce45be (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000f397680100000b8e43bffc7f00000000f3976801000002000000fc7f0000380000000000000040000000000000003003f3976801000028624f6e2b000000f1624f6e2b0000000300000000000000000000000000000000000000000000002010da976801000000000000680100000000da976801000000a02c6e2b0000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000005862df976801000004000000000000003800000000000000f09803bdfc7f000038000000000000003800000000000000a0634f6e2b000000c00cc398fc7f000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b02ea3fc7f0000070000000000000000000000000000000100000000000000c0ab669a680100000000000000000000d0310f9a680100004c9803bdfc7f0000e0320c9a68010000b3ceb998fc7f000030340f9a68010000004f2ea3fc7f0000d0b02ea3fc7f00000000000000000000000000000000000030340f9a68010000c0ab669a68010000d0f80d9a68010000f8634f6e2b0000004c9803bdfc7f00000100000000000000f8634f6e2b000000d0f80d9a6801000030340f9a68010000010000000000000002bcb998fc7f0000c0340f9a6801000090740d9a68010000feffffff040000007df02da3fc7f000030f50d9a (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000c0ab669a680100000000000000000000d0310f9a680100004c9803bdfc7f0000e02c0c9a68010000b3ceb998fc7f000070360f9a68010000384f2ea3fc7f0000d0b02ea3fc7f00000000000000000000000000000000000070360f9a68010000c0ab669a68010000d0f80d9a68010000f0634f6e2b0000004c9803bdfc7f00000100000000000000f0634f6e2b000000d0f80d9a6801000070360f9a68010000010000000000000002bcb998fc7f0000000000000000000090740d9a68010000c0340f9a04000000feffffffffffffffc0ab669a680100007df02da3fc7f000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000040a64f6e2b0000000400000000000000900793293d01000006000000000000000300000000000000a740e6bbfc7f0000000000000000000000000000000000000000000000000000010100000000000050a7e297680100000a000000000000000000000000000000000000000000000043003a005c005500730065007200730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000049843bffc7f00000000000000000000000000000000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000b002da976801000000100000000000003e003c0004000000a011da976801000000000000000000000000da976801000000a02c6e2b00000000000000000000000000000000000000000000000000000000000000020000000c00000000000000c00cda97680100003c000000000000004000000000000000e09e4f6e2b00000000000000000000000000000000000000000000000000000000000000000000000400000000000000400000000000000032000000000000000000db9768010000328943bffc7f0000e00dda976801000000000000000000000000da976801000000a02c6e2b0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002a0d000000000000109f4f6e2b000000483faa4dd17f000040c493293d01000002ffff7f000000000800000000000000a740e6bbfc7f0000c09f4f6e2b0000000000000000000000fddd9bcfeb710000fb00000000000000d061e397680100001000000000000000b4a24f6e2b00000030a34f6e2b00000043003a005c00550073006500720073005c005000750062006c00690063000000d8a24f6e2b00000036fbe5bbfc7f0000340000c02b00000040a04f6e2b0000002604000000000000b10ee6bbfc7f0000900000002b000000989f4f6e2b000000909f4f6e2b000000049843bffc7f0000693b00002b0000000000db9768010000693b0000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e00dda976801000000000000000000000000da976801000000a02c6e2b0000000000000000000000000000000000000000000000000000000000000000000000360038003473e3bdc00cda976801000004000000000000005000000000000000b0974f6e2b00000000000000000000000000000000000000000000000000000000000000000000000500000000000000500000000000000040000000000000000000db9768010000328943bffc7f0000e00dda976801000000000000000000000000da976801000000a02c6e2b0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001c0d000000000000e0974f6e2b0000006a46aa4dd17f0000f0d693293d01000009ffff7f000000000f00000000000000a740e6bbfc7f0000b0974f6e2b000000020000002b00000000c5ffff02000000f4000000000000009072e3976801000018000000000000000200000000000000ff0300000000000043003a005c00550073006500720073005c005000750062006c00690063005c004400650073006b0074006f007000000000000000000000000000000000000000f0984f6e2b00000026e9d2bbfc7f00007075e19768010000400000000000000040994f6e2b000000049843bffc7f00002cff2c3a8486000093d349a3fc7f0000c0cce297 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000200dda976801000000000000000000000000da976801000000a02c6e2b00000000000000000000000000000000000000000000000000000000000000000000004600480000000000c00cda97680100000d00000000000000600000000000000080904f6e2b00000000000000000000000000000000000000000000000000000000000000000000000600000000000000600000000000000050000000000000000000db9768010000328943bffc7f0000200dda976801000000000000000000000000da976801000000a02c6e2b0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001e0d000000000000109f4f6e2b0000003c3faa4dd17f000040d093293d01000008ffff7f000000000e00000000000000a740e6bbfc7f00000500000000000000b001000000000000e476db9768010000f5000000000000005073e3976801000019000000000000000000da976801000000a02c6e2b00000043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f0066007400000000050000000030010000000000000200000268010000000000000000000000000000000000001039e097680100000000000000000000049843bffc7f00003001000000000000230100000000000005000005 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000200dda976801000000000000000000000000da976801000000a02c6e2b000000000000000000000000000000000000000000000000000000000000000000000048004a0000000000c00cda976801000019000000000000006000000000000000b0974f6e2b00000000000000000000000000000000000000000000000000000000000000000000000600000000000000600000000000000052000000000000000000db9768010000328943bffc7f0000e013da976801000000000000000000000000da976801000000a02c6e2b0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007544) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000606fdf9768010000f0aa4f6e2b000000189de19768010000508ee3976801000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff00000000000000005270df9768010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544)29:T1024,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000301645bffc7f0000650c000000000000000068cef77f00000600000000000000180000000000000000000000000000000000000000000000a05cc163ad3b0000d826e852273200000000000000000000f5a847a3fc7f000006000000680100001f000000000000000f00100000000000d065dc976801000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000bcf34f6e2b000000000000000000000070f74f6e2b0000009868de9768010000d0ed4f6e2b00000000000000000000004ef7e7bbfc7f0000bcf34f6e2b0000000000000000000000000000000000000099ddddbcfc7f0000000000000000000060ed4f6e2b00000070ed4f6e2b000000010000002b00000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7be8bbfc7f00000000eca2fc7f0000000000000000000000000000000000000806eda2fc7f00000001000000000000f09803bdfc7f00000001000000000000000100000000000000000000000000000006eda2fc7f000001000000000000000f18eca2fc7f000000000000000000000006eda2fc7f000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31b69cfc7f0000708bb89cfc7f00000200000000000000708bb89cfc7f000000000000000000000300000000000000b131b69cfc7f0000a815b99cfc7f0000a0d3f39768010000b0d3f39768010000888bb89cfc7f00000100000000000000239f05bdfc7f00000000000000000000888bb89cfc7f000006000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000d20b0000000000000600000000000000d50b0000c83d416e2b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d9898fc7f0000c0fe9998fc7f00000400000000000000c0fe9998fc7f000000000000000000000500000000000000453d9898fc7f0000286a9a98fc7f0000be5ae9bbfc7f000008ab109a6801000058069a98fc7f0000b08ee9bbfc7f0000239f05bdfc7f00000100000000000000d1329898fc7f000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5ae9bbfc7f00000000e4a2fc7f000000000000000000000000000000000000883fe5a2fc7f00000001000000000000f09803bdfc7f0000000100000000000000010000000000000000000000000000803fe5a2fc7f00000100000000000000bf10e4a2fc7f00000000000000000000803fe5a2fc7f000000000000 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000ab3f000002000000000000008be0e7bbfc7f00004843919a6801000001ac47a3fc7f0000000000000000000004000000fc7f000000100000fc7f000004000000000000000100000000000000873b61a3fc7f000000009a9a68010000002000000000000000000000000000000100000000000000b09897a3fc7f00001b4261a3fc7f0000208997a3 (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000208997a3fc7f00000000000000000000d81c7852273200009c0000000a00000000000000ab3f000002000000000000008be0e7bbfc7f00004843919a6801000001ac47a3fc7f0000000000000000000004000000fc7f000000100000fc7f000004000000000000000100000000000000873b61a3fc7f000000009a9a (UID: 00000000-00007544) "WScript.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000ab3f000002000000000000008be0e7bbfc7f00004843919a6801000001ac47a3fc7f0000000000000000000004000000fc7f000000100000fc7f000004000000000000000100000000000000873b61a3fc7f000000009a9a6801000000200000000000008945da864b2add010100000000000000208997a3fc7f0000875661a3fc7f0000208997a3 (UID: 00000000-00007544) "GVROBANFGPGAORKT.PIF" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b8e9ef18000000002200000000000000030000000000000060155f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000b802000000000b8e43bffc7f00005499bb020000000000ebef180000000001000000 (UID: 00000000-00006688)2a:Ta0a,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GVROBANFGPGAORKT.PIF") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FOXMAIL.EXE") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FOXMAIL.EXE") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "GVROBANFGPGAORKT.PIF" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")2b:Taca,"GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-wal (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-shm to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-shm (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-wal (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-shm to new location %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-shm (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-wal (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-shm to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-shm (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-wal (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-shm to new location %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-shm (UID: 00000000-00006688)2c:T1493,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007544) "WScript.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00007544) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter Psapi (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter shcore (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter Shlwapi (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter KERNEL32 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006688)2d:T99ad,"WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007544) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007544) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlCompareMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtFlushInstructionCache (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetExtendedTcpTable (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetExtendedUdpTable (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CredFree (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CredEnumerateW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptDeriveKeyPBKDF2 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SearchPathW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetInformationJobObject (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter AssignProcessToJobObject (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateJobObjectW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlPcToFileHeader (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006688)2e:T6e1,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7544:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "SM0:7544:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:7544:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:7544:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "SM0:7544:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7544:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7544:120:WilError_01" Process GVROBANFGPGAORKT.PIF created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6688:304:WilStaging_02" Process GVROBANFGPGAORKT.PIF created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6688:304:WilStaging_02" Process GVROBANFGPGAORKT.PIF created mutex with name "\Sessions\1\BaseNamedObjects\Rmc-0KPZYP" Process GVROBANFGPGAORKT.PIF created mutex with name "Local\SM0:6688:304:WilStaging_02" Process GVROBANFGPGAORKT.PIF created mutex with name "Rmc-0KPZYP" Process GVROBANFGPGAORKT.PIF created mutex with name "SM0:6688:304:WilStaging_02"2f:T1960,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc9cfe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffcb9ea0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffcbdd50000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffcbcdd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffc9b9b0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffca35f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffcb2e60000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffca32d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcbbe20000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcbbe20000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcbbe20000 "WScript.exe" loaded module "KERNEL32" at base 7ffcbcdd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\H8JEUAYG.DLL" at base 7ffca0360000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffcba850000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffcbd940000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffcbb810000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffcbac00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffca7df0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffcbd7f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffcbb890000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffca2ec0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffc9cb60000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc98b60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffcbcdd0000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffcbb690000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffcb2e60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffca2e40000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffcbf410000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffcb7bc0000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffcbdf30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffcbc140000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffc98980000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ffc96cc0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffc98760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffca63e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffcbdf30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffca5ab0000 "WScript.exe" loaded module "COMCTL32.DLL" at base 7ffcaa030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\TWEXT.DLL" at base 7ffc98940000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CSCUI.DLL" at base 7ffca3510000 "WScript.exe" loaded module "%PROGRAMFILES%\MICROS~1\OFFICE14\GROOVEEX.DLL" at base 7ffca3610000 "WScript.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 168ab140000 "WScript.exe" loaded module "USER32.DLL" at base 7ffcbdb60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffcb0ea0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffcae1a0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffcbb660000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffcbbe20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffcb9b60000 "GVROBANFGPGAORKT.PIF" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc9cfe0000 "GVROBANFGPGAORKT.PIF" loaded module "KERNEL32.DLL" at base 7ffcbcdd0000 "GVROBANFGPGAORKT.PIF" loaded module "USER32.DLL" at base 7ffcbdb60000 "GVROBANFGPGAORKT.PIF" loaded module "NTDLL.DLL" at base 7ffcbf410000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc96430000 "GVROBANFGPGAORKT.PIF" loaded module "WININET.DLL" at base 7ffca9c50000 "GVROBANFGPGAORKT.PIF" loaded module "MSCOREE.DLL" at base 7ffc98bd0000 "GVROBANFGPGAORKT.PIF" loaded module "SHELL32.DLL" at base 7ffcbdf30000 "GVROBANFGPGAORKT.PIF" loaded module "WINMM.DLL" at base 7ffcb3b20000 "GVROBANFGPGAORKT.PIF" loaded module "URLMON.DLL" at base 7ffcb0ea0000 "GVROBANFGPGAORKT.PIF" loaded module "GDIPLUS.DLL" at base 7ffc989c0000 "GVROBANFGPGAORKT.PIF" loaded module "PSAPI" at base 4a50000 "GVROBANFGPGAORKT.PIF" loaded module "SHCORE" at base 7ffcbd2f0000 "GVROBANFGPGAORKT.PIF" loaded module "NTDLL" at base 7ffcbf410000 "GVROBANFGPGAORKT.PIF" loaded module "KERNEL32" at base 7ffcbcdd0000 "GVROBANFGPGAORKT.PIF" loaded module "SHELL32" at base 7ffcbdf30000 "GVROBANFGPGAORKT.PIF" loaded module "SHLWAPI" at base 7ffcbd120000 "GVROBANFGPGAORKT.PIF" loaded module "IPHLPAPI" at base 7ffcbad80000 "GVROBANFGPGAORKT.PIF" loaded module "ADVAPI32.DLL" at base 7ffcbd940000 "GVROBANFGPGAORKT.PIF" loaded module "RPCRT4.DLL" at base 7ffcbdd50000 "GVROBANFGPGAORKT.PIF" loaded module "SSPICLI.DLL" at base 7ffcbb660000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "BCRYPT.DLL" at base 7ffcbb2c0000 "GVROBANFGPGAORKT.PIF" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcbba60000 "GVROBANFGPGAORKT.PIF" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffcbaff0000 "GVROBANFGPGAORKT.PIF" loaded module "CRYPT32.DLL" at base 7ffcbb890000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcbbe20000 "GVROBANFGPGAORKT.PIF" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcbbe2000030:Tc05,"WScript.exe" called "WScript.ScriptName" with result: "a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.CreateObject" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.createElement" with result: "IDispatch" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").dataType" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").text" ... "WScript.exe" called "ADODB.Stream.6.0.CreateObject" ... "WScript.exe" called "ADODB.Stream.6.0.Type" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "local GVROBAN = "|2=...................?TWw0kgvPIgvP#+6Kt`<+N8Qgw.IL?Y?9tNhZo4`9oIXI0SVLSQL$t4wk|MNJ47?.47?svuSJRgfTP`>9tNhZoo?9JNhQoIXI0SVLSQLNt4wohQLNtoqzjQLnsIYM0SVLiQLNp4wnhW9+|g6?+k?I>`?KiPNQ0yJL>2`9J$hwv4X`0STLyQL$t4wnZ8il7Hw|KmY////wiee90I?t03/////8iO>t03/PZPPfN#.gPo>Je.6...#.?P$so/g04n9|KG0L>...8P6....#mO`tUWiMtNP....kme9+|Q6?+0S>go`8g<`+gU0STJ+8iJ|ktPgRL$tI|t00i....vn+SQ0SZL>g.GPw6>gI.K!MN>vo>9ZfhY0SXL2uf#h..Q.$heWU0STN>..+|Q..2TLVtY6?`NNQ0SZLWvfMP....sT4?SXYMtU3ieRLnsIGtU3i#0SfLSRLVtYplW!pQ0yJN>228.SL9t4Xex|Ht01iY0STL><7?OM|`PIZm$G!Tv4xL+///vGhPYfhtzj28.RLNtI?`PI+8....o>6ZMoYMtU1i10SfJ!PP10yJL>G?t0UitzzXe+9fWM43/Q43/U43/Y43/s4Xy|>y6Mk3iMk0i5k0iflMP....Y`!@svoX??....Jx/iQQ8g//v4UjO....stQ7/glVLt0UjZ?N$86+#f2XI<9|Q7?>RLNlIRLNt49?`YPL>wtPwRLVtI|t00iQ4Hw|KmY..Q<.ieWHP.....rtQ7/." ..., "WScript.exe" called "ADODB.Stream.6.0.Write" ... , "WScript.exe" called "ADODB.Stream.6.0.Position" ... , "WScript.exe" called "ADODB.Stream.6.0.SaveToFile" ... , "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "MZ" ..., "WScript.exe" called "WScript.CreateObject" with result: "IDispatch" ..., "WScript.exe" called "WScript.Shell.1.CreateObject" ... 31:Ta07,"WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Copy as Path Menu" (Path: "HKCU\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}") "WScript.exe" touched "Microsoft SendTo Service" (Path: "HKCU\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}") "WScript.exe" touched "Groove GFS Context Menu Handler" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6C467336-8281-4E60-8204-430CED96822D}") "WScript.exe" touched "Start Menu Pin" (Path: "HKCU\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\NOADDTORECENT") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WScript.exe" touched "Previous Versions Property Page" (Path: "HKCU\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\NOADDTORECENT") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS")32:T658,"GVROBANFGPGAORKT.ttf" has type "ASCII text with very long lines (65536) with no line terminators"- Location: [%USERPROFILE%\Documents\GVROBANFGPGAORKT.ttf]- [targetUID: 00000000-00006688] "GVROBANFGPGAORKT.PIF" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 10 sections"- Location: [%USERPROFILE%\Documents\GVROBANFGPGAORKT.PIF]- [targetUID: 00000000-00006688] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp]- [targetUID: 00000000-00006688] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp]- [targetUID: 00000000-00006688] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp]- [targetUID: 00000000-00006688] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp]- [targetUID: 00000000-00006688]33:T444,"Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp] "Login Data For Account.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp] "Login Data.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp]34:T8bb,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\.PIF"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.PIF"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.PIF"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\.PIF\OPENWITHPROGIDS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.PIF\OPENWITHPROGIDS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.PIF\OPENWITHPROGIDS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\PIFFILE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\PIFFILE\CURVER"; Key: ""; Value: "")35:T9cb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".PIF"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.PIF"; Key: "CONTENT TYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.PIF"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE\SHELLEX\ICONHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: "DOCOBJECT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: "BROWSEINPLACE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: "ISSHORTCUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: "ALWAYSSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\PIFFILE"; Key: "NEVERSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\CONTEXTMENUHANDLERS\COPYASPATHMENU"; Key: "SUPPRESSIONPOLICY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\CONTEXTMENUHANDLERS\COPYASPATHMENU"; Key: ""; Value: "")36:T8f4,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\FLTLIB.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\MSVCP140.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\VCRUNTIME140.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\VCRUNTIME140_1.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\CRYPTSP.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\CRYPTSP.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\VCRUNTIME140_CLR0400.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\VCRUNTIME140_CLR0400.dll" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\UCRTBASE_CLR0400.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\ucrtbase_clr0400.dll" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\WININET.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\wininet.dll" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\MSCOREE.DLL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\mscoree.dll" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\WINMM.DLL"37:T715,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\GVROBANFGPGAORKT.TTF" "WScript.exe" trying to access non-existent file "C:\Users\yR1OfRc\Documents\GVROBANFGPGAORKT.ttf" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\A332D0013114183C5FEEF385E24A99330CF86166CBD9B36A80CB316EFA32E4F0.JS" "WScript.exe" trying to access non-existent file "C:\Users\yR1OfRc\Documents\a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WSCRIPT.EXE.LOCAL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WScript.exe.Local\" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\GVROBANFGPGAORKT.PIF:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Users\yR1OfRc\Documents\GVROBANFGPGAORKT.PIF:Zone.Identifier" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\GVROBANFGPGAORKT.UBF" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\Documents\GVROBANFGPGAORKT.PIF.LOCAL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\yR1OfRc\Documents\GVROBANFGPGAORKT.PIF.Local\" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-WAL" "GVROBANFGPGAORKT.PIF" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-SHM"38:Ta02,"GVROBANFGPGAORKT.PIF" called "FindFirstFileW" with parameter %APPDATA%\Mozilla\Firefox\Profile Groups\*.sqlite (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter found.000 (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter inetpub (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Program Files (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Recovery (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter tempdir (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter TorService (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Users (UID: 00000000-00006688) "GVROBANFGPGAORKT.PIF" called "FindNextFileW" with parameter Windows (UID: 00000000-00006688)39:T11ae,Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15812769238") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15812769238") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15815080528") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15815080528") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15817430314") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data.tmp-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-15817430314") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16097311952") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16097311952") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16099952460") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-wal" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16099952460") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16102197354") Found string "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account.tmp-shm" (Indicator: "google\chrome\user data\default\login data"; Source: "00000000-00006688-00000C3D-16102197354") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16158565514") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16158565514") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16161194840") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16161194840") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16163207134") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data.tmp-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16163207134") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16191124962") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16191124962") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16193835488") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-wal" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16193835488") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16196671568") Found string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account.tmp-shm" (Indicator: "edge\user data\default\login data"; Source: "00000000-00006688-00000C3D-16196671568")3a:Tb3d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\DOCUMENTS\GVROBANFGPGAORKT.PIF"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "GVROBANFGPGAORKT.PIF" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")3b:T765,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "SLOWCONTEXTMENUENTRIES"; Value: "6024B221EA3A6910A2DC08002B30309D480100000114020000000000C0000000000000469D0000006078A409B011A54DAFA526D86198A7806E000000FB9A790967ADD111ABCD00C04FC309367D0000003673466C8182604E8204430CED96822D8601000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C10C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830069000000A19F5E000400010000004B00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000001F0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "GVROBANFGPGAORKT.PIF" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-0KPZYP"; Key: "EXEPATH"; Value: "v"U") "GVROBANFGPGAORKT.PIF" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-0KPZYP"; Key: "LICENCE"; Value: "F06165CBD7CB5BEAFD218A4D3ED0F20D") "GVROBANFGPGAORKT.PIF" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-0KPZYP"; Key: "TIME"; Value: "#z|j") "GVROBANFGPGAORKT.PIF" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-0KPZYP"; Key: "UID"; Value: "E11DE10200")3c:T684,"WScript.exe" reads file "C:\Users\desktop.ini" "WScript.exe" reads file "C:\Users\Public\desktop.ini" "WScript.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" "WScript.exe" reads file "C:\Windows\Fonts\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "GVROBANFGPGAORKT.PIF" reads file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini"3d:T690,"GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-WAL" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-SHM" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-WAL" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-SHM" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA.TMP-WAL" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA.TMP-SHM" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account.tmp" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-WAL" with delete access "GVROBANFGPGAORKT.PIF" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-SHM" with delete access3e:T960,"GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-WAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-SHM" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-JOURNAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-WAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA.TMP-SHM" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account.tmp" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT-WAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT-SHM" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-JOURNAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-WAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA FOR ACCOUNT.TMP-SHM" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data.tmp" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA-WAL"3f:T1b4f,"GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "EMAIL") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "DISPLAY NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "ACCOUNT NAME") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "IMAP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "POP3 PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "SMTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888"; Key: "HTTP PASSWORD") "GVROBANFGPGAORKT.PIF" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\5430004994B7FC4E9FA8C66DEEDA72DE")40:T168c,"GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 6\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 7\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 7\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 8\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 8\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 9\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 9\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 10\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 10\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 11\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 11\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 12\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 12\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 13\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 13\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 14\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 14\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 15\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 15\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 16\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 16\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 17\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 17\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 18\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 18\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 19\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 19\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 20\LOGIN DATA" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 20\LOGIN DATA FOR ACCOUNT" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-WAL" "GVROBANFGPGAORKT.PIF" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOGIN DATA-SHM"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790813409926,"unified_at":"2026-10-01T00:10:09.926Z","metadata":{"hashes":{"sha256":"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","sha1":"8f217d5f07b38a833f066a8146eff2c1c5701112","md5":"4633d64c1b619c268edbff8b0fab669f","sha512":"f409536e64fc7f598a18969494aa86ec6d5d28a793178c9abc3cbc2cf632dbcfcfa6cd3542d466897ff4abdca8f82584bff9acf50bc0e719c43a0c0da6739f74","ssdeep":"98304:IzdMSWk8N16j1mqdYdrwEWWc57GBMnIhtzJU+I8ffVi0BmLnSfSdy1pIjo1KZ1NF:hA4rwYc57GBMnYLIsNi0BmjSfp1uKI5","ssdeep_chunks":["98304:IzdMSWk","98304:zdMSWk8","98304:dMSWk8N","98304:MSWk8N1","98304:SWk8N16","98304:Wk8N16j","98304:k8N16j1","98304:8N16j1m","98304:N16j1mq","98304:16j1mqd","98304:6j1mqdY","98304:j1mqdYd","98304:1mqdYdr","98304:mqdYdrw","98304:qdYdrwE","98304:dYdrwEW","98304:YdrwEWW","98304:drwEWWc","98304:rwEWWc5","98304:wEWWc57","98304:EWWc57G","98304:WWc57GB","98304:Wc57GBM","98304:c57GBMn","98304:57GBMnI","98304:7GBMnIh","98304:GBMnIht","98304:BMnIhtz","98304:MnIhtzJ","98304:nIhtzJU","98304:IhtzJU+","98304:htzJU+I","98304:tzJU+I8","98304:zJU+I8f","98304:JU+I8ff","98304:U+I8ffV","98304:+I8ffVi","98304:I8ffVi0","98304:8ffVi0B","98304:ffVi0Bm","98304:fVi0BmL","98304:Vi0BmLn","98304:i0BmLnS","98304:0BmLnSf","98304:BmLnSfS","98304:mLnSfSd","98304:LnSfSdy","98304:nSfSdy1","98304:SfSdy1p","98304:fSdy1pI","98304:Sdy1pIj","98304:dy1pIjo","98304:y1pIjo1","98304:1pIjo1K","98304:pIjo1KZ","98304:Ijo1KZ1","98304:jo1KZ1N","98304:o1KZ1NF","196608:IzdMSWk","196608:zdMSWk8","196608:dMSWk8N","196608:MSWk8N1","196608:SWk8N16","196608:Wk8N16j","196608:k8N16j1","196608:8N16j1m","196608:N16j1mq","196608:16j1mqd","196608:6j1mqdY","196608:j1mqdYd","196608:1mqdYdr","196608:mqdYdrw","196608:qdYdrwE","196608:dYdrwEW","196608:YdrwEWW","196608:drwEWWc","196608:rwEWWc5","196608:wEWWc57","196608:EWWc57G","196608:WWc57GB","196608:Wc57GBM","196608:c57GBMn","196608:57GBMnI","196608:7GBMnIh","196608:GBMnIht","196608:BMnIhtz","196608:MnIhtzJ","196608:nIhtzJU","196608:IhtzJU+","196608:htzJU+I","196608:tzJU+I8","196608:zJU+I8f","196608:JU+I8ff","196608:U+I8ffV","196608:+I8ffVi","196608:I8ffVi0","196608:8ffVi0B","196608:ffVi0Bm","196608:fVi0BmL","196608:Vi0BmLn","196608:i0BmLnS","196608:0BmLnSf","196608:BmLnSfS","196608:mLnSfSd","196608:LnSfSdy","196608:nSfSdy1","196608:SfSdy1p","196608:fSdy1pI","196608:Sdy1pIj","196608:dy1pIjo","196608:y1pIjo1","196608:1pIjo1K","196608:pIjo1KZ","196608:Ijo1KZ1","196608:jo1KZ1N","196608:o1KZ1NF","98304:hA4rwYc","98304:A4rwYc5","98304:4rwYc57","98304:rwYc57G","98304:wYc57GB","98304:Yc57GBM","98304:57GBMnY","98304:7GBMnYL","98304:GBMnYLI","98304:BMnYLIs","98304:MnYLIsN","98304:nYLIsNi","98304:YLIsNi0","98304:LIsNi0B","98304:IsNi0Bm","98304:sNi0Bmj","98304:Ni0BmjS","98304:i0BmjSf","98304:0BmjSfp","98304:BmjSfp1","98304:mjSfp1u","98304:jSfp1uK","98304:Sfp1uKI","98304:fp1uKI5"],"imphash":"Unknown"},"file_info":{"file_name":"Pending Required Documents for AuthorizationP.js","file_type":["script","javascript"],"file_type_id":"js","file_size":4751654,"entropy":5.84,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786535173000,"last_seen":1787836097000,"last_multi_scan":1787836097000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":91,"suspicious_count":24,"malicious_count":8,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Generic.S3195","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Modiloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81091198","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81091198 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDropper.ModiLoader.BO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Obfuscated.kc!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Agent.ECX!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Agent.KCA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Donut","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"QUILTED TIGER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"malicious","value":"Creates a mutant that is known to appear in malware"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Calls an API typically used to decrypt data"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with misleading file extensions"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"suspicious","value":"Drops executable files inside user directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Chromium browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"file/memory contains long string with (Indicator: \"AESNI\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.001","id":"string-584","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007544)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007544)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007544)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '1548769492993', 'hResInfo': '1548769494240'}\" (UID: 00000000-00007544)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1548769492993', 'hResInfo': '1548769494272'}\" (UID: 00000000-00007544)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1548769492993', 'hResInfo': '1548769494288'}\" (UID: 00000000-00007544)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1548769492993', 'hResInfo': '1548769494256'}\" (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00007544-00000C15-1490714805","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js contents: \n昀甀渀挀琀椀漀渀愀渀漀渀礀洀漀甀猀⠀⤀ 笀਀搀攀戀甀最最攀爀਀紀\n\n","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WScript.exe\" is protecting memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7544)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006688-00000C2C-1497142464\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00006688-00000C2C-1497202972\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00006688-00000C2C-1497298913\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00006688-00000C2C-1497298978\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006688-00000C2C-1497299024\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006688-00000C2C-1497299044\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"WScript.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"a\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$27","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to decrypt data","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"GVROBANFGPGAORKT.PIF\" at offset 406744; code bytes = 30d0\n Found XOR loop in file \"GVROBANFGPGAORKT.PIF\" at offset 446904; code bytes = 30d0\n Found XOR loop in file \"GVROBANFGPGAORKT.PIF\" at offset 446912; code bytes = 30d0\n Found XOR loop in file \"GVROBANFGPGAORKT.PIF\" at offset 77563; code bytes = 8030\n Found XOR loop in file \"GVROBANFGPGAORKT.PIF\" at offset 443884; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00006688-00000C2C-1494248546\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006688-00000C2C-1497299349\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006688-00000C2C-1497299367\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007544)\n \"GVROBANFGPGAORKT.PIF\" called \"GetForegroundWindow\" (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"7544\" - (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetWindowTextW\" (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"GVROBANFGPGAORKT.PIF\" called \"OpenMutexA\" with parameter \"Rmc-0KPZYP-Sys\" - (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007544)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007544)\n \"GVROBANFGPGAORKT.PIF\" called \"GetLocaleInfoA\" with parameter \"2048\" - (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"GVROBANFGPGAORKT.PIF\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"GVROBANFGPGAORKT.PIF\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")\n \"GVROBANFGPGAORKT.PIF\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GVROBANFGPGAORKT.PIF\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"WScript.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2b","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF\" %USERPROFILE%\\Documents\\GVROBANFGPGAORKT.ttf\" - (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.11.231.147:2404\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js\"\" (UID: 00000000-00007544)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A35F0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BBA60000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BB2C0000\n \"GVROBANFGPGAORKT.PIF\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BBA60000\n \"GVROBANFGPGAORKT.PIF\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BB2C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"GVROBANFGPGAORKT.PIF\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 96430000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at BDD50000\n \"GVROBANFGPGAORKT.PIF\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at BDD50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$30","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a002b00000040c7f9bbfc7f0000@ntdll.dll\"\n \"\"#+@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js\" was detected as \"plain text\" and name: \"Format\"\n \"GVROBANFGPGAORKT.PIF\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"GVROBANFGPGAORKT.PIF\" (UID: 00000000-00006688) was launched with new environment variables: \"USERDNSDOMAIN=\"aOOypnbrNeEAZLM\"\"\n Process \"GVROBANFGPGAORKT.PIF\" (UID: 00000000-00006688) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"GVROBANFGPGAORKT.PIF\" (UID: 00000000-00006688) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"GVROBANFGPGAORKT.PIF\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"GVROBANFGPGAORKT.PIF\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007544-00000C2B-1481672218]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007544-00000C2B-1481977231]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00007544-00000C2B-1482621186]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00006688-00000C2B-1491595228]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"GVROBANFGPGAORKT.PIF\" with commandline \"%USERPROFILE%\\\\Documents\\\\GVROBANFGPGAORKT.ttf\" (UID: 00000000-00006688)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"GVROBANFGPGAORKT.PIF\" with commandline \"%USERPROFILE%\\\\Documents\\\\GVROBANFGPGAORKT.ttf\" (UID: 00000000-00006688)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GVROBANFGPGAORKT.PIF\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$32","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$33","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WScript.exe\" opens a process \"C:\\Windows\\System32\\wscript.exe\" (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 7544)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WScript.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\Documents\\GVROBANFGPGAORKT.PIF\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\documents\\gvrobanfgpgaorkt.ttf\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00006688-00000C2C-1494347454\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"45.11.231.147\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data For Account.tmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GVROBANFGPGAORKT.PIF\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WScript.exe\" called \"GetComputerNameW\" (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetUserNameW\" (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"$39","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"GVROBANFGPGAORKT.PIF\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Login Data.tmp\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp]- [targetUID: 00000000-00006688]\n Dropped file: \"Login Data For Account.tmp\" - Location: [%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp]- [targetUID: 00000000-00006688]\n Dropped file: \"Login Data For Account.tmp\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp]- [targetUID: 00000000-00006688]\n Dropped file: \"Login Data.tmp\" - Location: [%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data.tmp]- [targetUID: 00000000-00006688]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF\" %USERPROFILE%\\Documents\\GVROBANFGPGAORKT.ttf\" - (UID: 00000000-00007544)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"GVROBANFGPGAORKT.PIF\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"45.11.231.147\"\n \"pServiceName\": \"2404\"\n \"pHints\": \"0\"\n \"ppResult\": \"f0e6ba0200000000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping multiple times","description":"\"GVROBANFGPGAORKT.PIF\" (Thread ID: 7148) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\Documents\\GVROBANFGPGAORKT.PIF\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"GVROBANFGPGAORKT.PIF\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\.PURPLE\\ACCOUNTS.XML\"\n \"GVROBANFGPGAORKT.PIF\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/23 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"GVROBANFGPGAORKT.PIF\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF]- [targetUID: 00000000-00006688]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\GVROBANFGPGAORKT.PIF\" (Handle: 1576)\n \"WScript.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\GVROBANFGPGAORKT.PIF\" (Handle: 1576)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"1\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF\" connects to 45.11.231.147 on port 2404 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"GVROBANFGPGAORKT.PIF\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt data","description":"\"GVROBANFGPGAORKT.PIF\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"200100000000000010a86a0500000000\"\n \"pDataOut\": \"200000000000000060ecbb0200000000\"\n \"$dataout\": \"8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d\"}\n \"GVROBANFGPGAORKT.PIF\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"200100000000000060b06a0500000000\"\n \"pDataOut\": \"2000000000000000f0f7bb0200000000\"\n \"$dataout\": \"8c9b40fb9f096e8a4ee8d05dde44c5a4f613c64b882574669cb13ae82cf72c8d\"}\n \"GVROBANFGPGAORKT.PIF\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"220100000000000050a36a0500000000\"\n \"pDataOut\": \"2000000000000000d0f4bb0200000000\"\n \"$dataout\": \"0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7\"}\n \"GVROBANFGPGAORKT.PIF\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"220100000000000010bb6a0500000000\"\n \"pDataOut\": \"200000000000000000edbb0200000000\"\n \"$dataout\": \"0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7\"}","origin":"API Call","mitre_attack_id":"T1140","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"GVROBANFGPGAORKT.PIF\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006688)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"GVROBANFGPGAORKT.PIF\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related files","description":"\"GVROBANFGPGAORKT.PIF\" read 40960 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"GVROBANFGPGAORKT.PIF\" read 100 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\"\n \"GVROBANFGPGAORKT.PIF\" read 4096 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"GVROBANFGPGAORKT.PIF\" read 2048 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\"","origin":"API Call","mitre_attack_id":"T1119","relevance":10,"id":"api-44","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"GVROBANFGPGAORKT.PIF\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\THUNDERBIRD\\PROFILES.INI\"\n \"GVROBANFGPGAORKT.PIF\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES.INI\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"GVROBANFGPGAORKT.PIF\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp\" for deletion\n \"GVROBANFGPGAORKT.PIF\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp\" for deletion\n \"GVROBANFGPGAORKT.PIF\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp\" for deletion\n \"GVROBANFGPGAORKT.PIF\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"GVROBANFGPGAORKT.PIF\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF]- [targetUID: 00000000-00006688]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"GVROBANFGPGAORKT.ttf\" contains indicator \".Sleep(\" (Line: 1; Offset: 1031567)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"GVROBANFGPGAORKT.PIF\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"GVROBANFGPGAORKT.PIF\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF]- [targetUID: 00000000-00006688]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Remcos 3.x Unencrypted Checkin\" (SID: 2032776, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Remcos 3.x Unencrypted Server Response\" (SID: 2032777, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.11.231.147 on port 2404","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$3e","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"\"GVROBANFGPGAORKT.PIF\" called \"CredEnumerateW\" with parameters {\"Flags\": \"0\"\n \"Count\": \"01000000\"\n \"Credential\": \"100ebb02000000000100000000000000000000000000000078f2ef1800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\"}","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Remcos","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5011","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$40","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Creates a mutant that is known to appear in malware","description":"\"Rmc-\" in \"Remcos\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":7,"id":"mutant-1","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"intel_graph":{"map":{"Adversary:652d31112dc0f97dd85e4c2bf328b88caad129d40de96ba24c904fbd6ae51ced":{"type":"Adversary","value":"QUILTED TIGER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:0baca9874883b21cc5ba7e59ab831044be306bddfb220343874126b935773636":{"type":"File","value":"0baca9874883b21cc5ba7e59ab831044be306bddfb220343874126b935773636","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247":{"type":"File","value":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},"File:52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1":{"type":"File","value":"52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1"},"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0":{"type":"File","value":"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]},"filetype":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2963), with CRLF line terminators","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:a94d9f7ad39d5756db24b59119080fe40ad1298741933a4e2a107f7b3173403b":{"type":"File","value":"a94d9f7ad39d5756db24b59119080fe40ad1298741933a4e2a107f7b3173403b","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:b7d73ee5195baf32d8a36b1be09ec8589f265902ad15135f3b5d25154f93c194":{"type":"File","value":"b7d73ee5195baf32d8a36b1be09ec8589f265902ad15135f3b5d25154f93c194","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:b9b889aee54200ce7c1af3cc4c25951c1ea401cc957814cc843e7138b887339d":{"type":"File","value":"b9b889aee54200ce7c1af3cc4c25951c1ea401cc957814cc843e7138b887339d"},"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813":{"type":"File","value":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},"Ip:45.11.231.147":{"type":"Ip","value":"45.11.231.147"},"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d":{"type":"Threat","value":"Donut","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]}}},"chains":[{"id":"1542521165640347178","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Donut","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat Donut","confirmed relationship with an Adversary QUILTED TIGER"]}},{"id":"1542521172799026566","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with an Adversary QUILTED TIGER"]}},{"id":"1542521159343977110","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"memory","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:0baca9874883b21cc5ba7e59ab831044be306bddfb220343874126b935773636"},{"edge_kind":"is_threat","from_key":"File:0baca9874883b21cc5ba7e59ab831044be306bddfb220343874126b935773636","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542521159343977109","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"memory","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:a94d9f7ad39d5756db24b59119080fe40ad1298741933a4e2a107f7b3173403b"},{"edge_kind":"is_threat","from_key":"File:a94d9f7ad39d5756db24b59119080fe40ad1298741933a4e2a107f7b3173403b","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542521159343977108","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"memory","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:b7d73ee5195baf32d8a36b1be09ec8589f265902ad15135f3b5d25154f93c194"},{"edge_kind":"is_threat","from_key":"File:b7d73ee5195baf32d8a36b1be09ec8589f265902ad15135f3b5d25154f93c194","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542521168153835179","root":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d","edges":[{"edge_kind":"used_by","from_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d","to_key":"Adversary:652d31112dc0f97dd85e4c2bf328b88caad129d40de96ba24c904fbd6ae51ced"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542521168158029484","root":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"contacted_ip","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"Ip:45.11.231.147"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","edges":[{"edge_kind":"extracted","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1"},{"edge_kind":"extracted","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},{"edge_kind":"extracted","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:b9b889aee54200ce7c1af3cc4c25951c1ea401cc957814cc843e7138b887339d"},{"edge_kind":"extracted","from_key":"File:a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a7c79fe283f73cd5303bc5a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanDropper.ModiLoader","contacted_countries":["USA"],"submit_name":"a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js","analysis_start_time":"2026-08-12T13:49:51+00:00","indicators_count":{"informative":91,"suspicious":25,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.11.231.147","port":2404,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}],"processes":[{"pid":7544,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00007544","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":6688,"ppid":7544,"name":"GVROBANFGPGAORKT.PIF","command_line":"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.ttf","sha256":"52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1","normalized_path":"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF","parent_uid":"00000000-00007544","uid":"00000000-00006688"}],"all_imported_dlls":["vcruntime140_clr0400.dll","win32u.dll","cfgmgr32.dll","MpClient.dll","msvcr90.dll","wininet.dll","mscoree.dll","ole32.dll","ws2_32.dll","powrprof.dll","propsys.dll","iertutil.dll","IPHLPAPI.DLL","ucrtbase.dll","jscript.dll","windows.storage.dll","mpr.dll","Windows.StateRepositoryPS.dll","ATL90.dll","version.dll","sxs.dll","bcrypt.dll","msisip.dll","coml2.dll","gpapi.dll","msxml3.dll","msdart.dll","bcryptprimitives.dll","vcruntime140.dll","clbcatq.dll","sppc.dll","scrrun.dll","GROOVEEX.DLL","sspicli.dll","winmm.dll","msctf.dll","cryptbase.dll","SHCore.dll","slc.dll","BCP47Langs.dll","msvcp90.dll","clr.dll","dpapi.dll","user32.dll","msvcrt.dll","cldapi.dll","imagehlp.dll","ucrtbase_clr0400.dll","GdiPlus.dll","psapi.dll","vcruntime140_1.dll","dwmapi.dll","urlmon.dll","gdi32.dll","sechost.dll","shell32.dll","cscui.dll","VxSSL64.dll","msasn1.dll","apphelp.dll","twext.dll","comctl32.dll","msIso.dll","msvcp140.dll","kernel32.dll","advapi32.dll","amsi.dll","aepic.dll","mswsock.dll","wldp.dll","crypt32.dll","msado15.dll","AppResolver.dll","edputil.dll","ntdll.dll","KernelBase.dll","oleaut32.dll","imm32.dll","shlwapi.dll","rsaenh.dll","ELSCore.dll","winmmbase.dll","MpOAV.dll","h8jEuAyg.dll","wshext.dll","fltLib.dll","kernel.appcore.dll","gdi32full.dll","msvcp_win.dll","rpcrt4.dll","profapi.dll","combase.dll","cryptsp.dll","uxtheme.dll","userenv.dll","wintrust.dll","scrobj.dll","ntmarta.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"GVROBANFGPGAORKT.PIF","sha256":"52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Login Data For Account.tmp","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"GVROBANFGPGAORKT.ttf","sha256":"b9b889aee54200ce7c1af3cc4c25951c1ea401cc957814cc843e7138b887339d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Login Data.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.ttf","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%USERPROFILE%\\Documents\\GVROBANFGPGAORKT.PIF","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data For Account.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data For Account.tmp","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SYNCROOTMANAGER\\\\","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7544:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Local\\SM0:7544:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Local\\SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"SM0:7544:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7544:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Rmc-0KPZYP","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Local\\SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"Rmc-0KPZYP","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]},{"name":"SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7c79fe283f73cd5303bc5a"}]}]}},"report_ids":{"sandbox_job_ids":["6a7c79fe283f73cd5303bc5a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a332d0013114… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a332d0013114…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a332d0013114… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a332d0013114…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a332d0013114… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a332d0013114…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 8 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]