24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SVM:TrojanDownloader/JS.MalBehav.gen Sample fb952ba3d10a… — Score 53/100 — Hybrid Analysis","description":"Malicious verdict for sample fb952ba3d10a…. Malware family: SVM:TrojanDownloader/JS.MalBehav.gen. Threat score 53/100. 1/27 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe","keywords":["Malicious","SVM:TrojanDownloader/JS.MalBehav.gen","malware analysis","sandbox report","threat intelligence","fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe"],"about":{"@type":"SoftwareApplication","name":"Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js","applicationCategory":["script","javascript"],"identifier":"fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe","additionalType":"Malicious sample"},"threatScore":53,"malwareFamily":"SVM:TrojanDownloader/JS.MalBehav.gen","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T56c,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\PROGID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\PROGID") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP")26:T1c32,"WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "16cd87095f0" "pszBlobType": "OpaqueKeyBlob" "phKey": "a09770d86c010000" "pbKeyObject": "be0c000052555555f09570d86c010000c09770d86c0100000000000000000000800c00004b53534d020001000500000010000000010000008000000001000000d0ea6ed86c0100000000000000000000000000000000000010000000285f431732938abc7ec92666e1bc1f8d0000000000000000000000000000000000000000285f431732938abc7ec92666e1bc1f8d4c9f1eef7e0c945300c5b235e179adb8f80a72178606e64486c3547167baf9c90893af928e9549d608561da76fece46ecefa303a406f79ec4839644b27d58025dd370ff69d58761ad5611251f2b4927470789d7fed20eb653841f934caf56b40d607940b3b277f6e0366865ac993ed1a8a5236d6b17549b8b213cfe27b8022f85cc177f7edb43e4f5fa7f1ad2427d355a6a78bc14b13b58e14b4442330939776249b35974d09cea2c9d0348912c6f4a5045fc8ab6992fb3584d9fa2bdb16c02c7402aa926dcd339eed4b011e5fcf3a07024e208619cf990c80863280b2843b19fce508021b81b98a9949ab8c32020999a68d2431e764b18882c81206ab4ba2156e0e9e5841e995b965aca38e2983b0135acde5e52fe70be1244536374c2f139d8b749d40752aee040ba23dd6686a25aa285f431732938abc7ec92666e1bc1f8d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c09870d86c010000609970d86c01000000000000000000000000000000000000fbc196938536657eb93a94281d908a4d42fb02bb98a6ef33b93a94281d908a4dbadacb8392f4092e99b3a24be3e689ef236969c8711280c199b3a24be3e689efa2544ef248f34a159b29f1cd89c13526397dbf3fc1327f339b29f1cd89c13526f97e21c4a4c587d1800ac4f860d04dba7974e53cc415ca6b800ac4f860d04dbad9038ed3585413ed7c45e96cdc46200ea54667bf841233e37c45e96cdc46200e942d7e6395827874232cdb648df6b717b701a5071874cf63232cdb648df6b717d81d7300dec26faae5121110aff0c2e83d0f62107132ad42e5121110aff0c2e836048bb133eef83328037baf974547b61e07f01ea4abbf8528037baf974547b661f50744f525a59ca148b5af7f4a606dc0bdb2eb8a6fc5f1a148b5af7f4a606d86642f7055dd69f285d9d48f89cf2a3103bdfbffdc1243c385d9d48f89cf2a31ffe34dffe334464370b2285f5e5e6d928f5165a0bd6a2bd170b2285f5e5e6d92b62e6a5689037dda1d72264b1fff4647ab5c4c1d96fc3b9d1d72264b1fff4647cb9f40a55729f2f4c3180bc19f8bbb4f" "cbKeyObject": "3262" "pbInput": "300200004b53534d0200010005000000100000008000000010000000285f431732938abc7ec92666e1bc1f8d0000000000000000000000000000000000000000285f431732938abc7ec92666e1bc1f8d4c9f1eef7e0c945300c5b235e179adb8f80a72178606e64486c3547167baf9c90893af928e9549d608561da76fece46ecefa303a406f79ec4839644b27d58025dd370ff69d58761ad5611251f2b4927470789d7fed20eb653841f934caf56b40d607940b3b277f6e0366865ac993ed1a8a5236d6b17549b8b213cfe27b8022f85cc177f7edb43e4f5fa7f1ad2427d355a6a78bc14b13b58e14b4442330939776249b35974d09cea2c9d0348912c6f4a5045fc8ab6992fb3584d9fa2bdb16c02c7402aa926dcd339eed4b011e5fcf3a07024e208619cf990c80863280b2843b19fce508021b81b98a9949ab8c32020999a68d2431e764b18882c81206ab4ba2156e0e9e5841e995b965aca38e2983b0135acde5e52fe70be1244536374c2f139d8b749d40752aee040ba23dd6686a25aa285f431732938abc7ec92666e1bc1f8d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "16cd87095f0" "pszBlobType": "OpaqueKeyBlob" "phKey": "e0a470d86c010000" "pbKeyObject": "be0c000052555555f09570d86c01000000a570d86c0100000000000000000000800c00004b53534d020001000500000010000000010000008000000001000000d0ea6ed86c0100000000000000000000000000000000000010000000c0a4d48292ca314b89f1c1836b76472b0000000000000000000000000000000000000000c0a4d48292ca314b89f1c1836b76472bf90425fd6bce14b6e23fd5358949921ec04b575aab8543ec49ba96d9c0f304c7c9b991e0623cd20c2b8644d5eb7540125cb058093e8c8a05150aced0fe7f8ec29ea97db2a025f7b7b52f39674b50b7a5ed007b014d258cb6f80ab5d1b35a02741377e96c5e5265daa658d00b1502d27fe4c23b35ba905eef1cc88ee409ca5c9b8b882f34311871db2dd0ff3f241aa3a41f8266022e9a17d9034ae8e627504b42f3c3674f8f1cd2c267d1cf4498576d9b8aa9050e7cdfb58de8cd1d86ff86a2dfb6949556f676b0839412a80b174bbf5901b1a28540e225d56264188883591752280f20ff4153875022863d5de13d0fdaad8bc853695ca7af63d5ba0dc3bb32875b9f01c4c4d76ffc0a891da2a06e888a7dedfdeb9f486e38ce5e725eaae795285399c52ae2a593d351161c6664b9e776c0a4d48292ca314b89f1c1836b76472b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a670d86c010000a0a670d86c0100000000000000000000000000000000000051eaf29cbfc7f8f8bde88b7ae704ff42ec0279e658c307babde88b7ae704ff4265a13f6f5014d51c6a9055d99f7e35120f316ab6cf6ae00e6a9055d99f7e3512a8ec6b205375d2cf088d003e057cbb84a0616b1e5609694b088d003e057cbb84e39a13b962fb06946ef914eddd90dd978d630754bf6bdb036ef914eddd90dd9715e11dac510e3f120ebec7f9ce2d8b321b5fda559f23b4200ebec7f9ce2d8b3271af2bc3bc36b890ebff4f0f4084b4599a5064ccfcb20cc9ebff4f0f4084b459e0676cb62773160567a9fde926412e1087ce915f0132381567a9fde926412e10f5efe9dca985d454fc00380694e2be9a09efd1da3d676acefc00380694e2be9af3753fd0f3b667b11fa7219baff5b396ecd21e4b5c43d4271fa7219baff5b3961787fb9974e34bc16fcb75dcca9d0a9f784c8e45be7e415e6fcb75dcca9d0a9f7bb6fd37e4a3a233d0d576d612910b1fab638be1f632a92cd0d576d612910b1f5d496ed156bae7994d9c828d55660e2610d5ec5c03dce9bf4d9c828d55660e269d06b2e2bdeab88b5e9dec1e6d96ee9f" "cbKeyObject": "3262" "pbInput": "300200004b53534d0200010005000000100000008000000010000000c0a4d48292ca314b89f1c1836b76472b0000000000000000000000000000000000000000c0a4d48292ca314b89f1c1836b76472bf90425fd6bce14b6e23fd5358949921ec04b575aab8543ec49ba96d9c0f304c7c9b991e0623cd20c2b8644d5eb7540125cb058093e8c8a05150aced0fe7f8ec29ea97db2a025f7b7b52f39674b50b7a5ed007b014d258cb6f80ab5d1b35a02741377e96c5e5265daa658d00b1502d27fe4c23b35ba905eef1cc88ee409ca5c9b8b882f34311871db2dd0ff3f241aa3a41f8266022e9a17d9034ae8e627504b42f3c3674f8f1cd2c267d1cf4498576d9b8aa9050e7cdfb58de8cd1d86ff86a2dfb6949556f676b0839412a80b174bbf5901b1a28540e225d56264188883591752280f20ff4153875022863d5de13d0fdaad8bc853695ca7af63d5ba0dc3bb32875b9f01c4c4d76ffc0a891da2a06e888a7dedfdeb9f486e38ce5e725eaae795285399c52ae2a593d351161c6664b9e776c0a4d48292ca314b89f1c1836b76472b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "16cdadd55e0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0c973d86c010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "WScript.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "16cdadd4be0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90ca73d86c010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}27:T9da,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3cbef97f0000000000000000000051ed6ac0f97f0000000000006c0100000000000000000000953d29639f6600002a00000000000000f05568d86c0100008fec6ac0f97f0000e0ac3cbef97f0000e0ac3cbef97f0000000000000000000000000000f97f0000ffffff7fb40b000000000000000000000000000000000000d8ce30bef97f00002a0000000000000069c3e9bdf97f00003100000000000000dc02000000000000e0020000000000001100011000000000f0d058604e00000003a353bff97f0000f0d058604e00000000000000000000002b00000000000000000000000000000020b0efbdf97f0000b43feebdf97f0000e0ce30be (UID: 00000000-00005848) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005848)28:T5da,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000030166ac0f97f0000650c000000000000000043cbf77f00000600000000000000180000000000000000000000000000000000000000000000950e29639f660000386cc5af51f900000000000000000000457a69a8f97f0000060000006c0100001f000000000000000f00100000000000d06666d86c01000000000000 (UID: 00000000-00005848) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000cf658604e0000000000000000000000c0f958604e000000f86f68d86c01000020f058604e00000000000000000000004ef7cdbcf97f00000cf658604e0000000000000000000000000000000000000099dd46bff97f00000000000000000000b0ef58604e000000c0ef58604e000000010000004e00000000000000 (UID: 00000000-00005848) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bcebcf97f00000000caa1f97f0000000000000000000000000000000000000806cba1f97f00000001000000000000f09852bff97f00000001000000000000000100000000000000000000000000000006cba1f97f000001000000000000000f18caa1f97f000000000000000000000006cba1f97f000000000000 (UID: 00000000-00005848) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c3113a0f97f0000708b15a0f97f00000200000000000000708b15a0f97f000000000000000000000300000000000000b13113a0f97f0000a81516a0f97f000000d982d86c01000010d982d86c010000888b15a0f97f00000100000000000000239f54bff97f00000000000000000000888b15a0f97f000006000000 (UID: 00000000-00005848)29:T4ed,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2a:T18eb,"WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005848) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005848)2b:T999,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9a10b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9baff0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff9c0450000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff9bf460000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff99be30000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff9a4b90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9b4ca0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff9a24f0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9bcc80000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9bcc80000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9bcc80000 "WScript.exe" loaded module "KERNEL32" at base 7ff9bf460000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\3H9H3V0Q.DLL" at base 7ff9a0170000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff9bba10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9c0580000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff9bcef0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9bbe50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9aaa70000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff9bf610000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9bd910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9a1ca0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff9a0130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ff9a1c80000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ff9b8f90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff9a0620000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9bc240000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff9bc8b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff9bbd90000 "WScript.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff9ad030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff9ad0e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9bca600002c:Tc75,"WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)2d:T64b,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.1.1"; Key: ""; Value: "")2e:Tc4f,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: "ENABLETLSEXTERNALALGORITHMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLOCKCOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLISTCOUNT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.37!7"; Key: "NAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\STRINGCACHESETTINGS"; Key: "STRINGCACHEGENERATION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL,-100"; Value: "")2f:Tb16,"WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")30:T9fc,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":53,"unified_at_epoch_ms":1791722696295,"unified_at":"2026-10-11T12:44:56.295Z","metadata":{"hashes":{"sha256":"fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe","sha1":"1e787ae4c593cb20864dab2aec242b12c2b3bb52","md5":"6cf0d2d0df8483c81b8ab00e10127398","sha512":"541870e96cd3a3236293e8998942cdbc216cd5c87c1486d9a05a3f64e90caa00367a5f288490ffa09411202e7ac515579365f0ed194617c47bf8002673dccd83","ssdeep":"48:WnVpb2KIyxMckbLwzkbjexXyscBPS+iw9BnJYjQmA0o9zWv7vHE8PWPQD:WVd2wepbLwAb6t03XJY0pP9zc7vHE83D","ssdeep_chunks":["48:WnVpb2K","48:nVpb2KI","48:Vpb2KIy","48:pb2KIyx","48:b2KIyxM","48:2KIyxMc","48:KIyxMck","48:IyxMckb","48:yxMckbL","48:xMckbLw","48:MckbLwz","48:ckbLwzk","48:kbLwzkb","48:bLwzkbj","48:Lwzkbje","48:wzkbjex","48:zkbjexX","48:kbjexXy","48:bjexXys","48:jexXysc","48:exXyscB","48:xXyscBP","48:XyscBPS","48:yscBPS+","48:scBPS+i","48:cBPS+iw","48:BPS+iw9","48:PS+iw9B","48:S+iw9Bn","48:+iw9BnJ","48:iw9BnJY","48:w9BnJYj","48:9BnJYjQ","48:BnJYjQm","48:nJYjQmA","48:JYjQmA0","48:YjQmA0o","48:jQmA0o9","48:QmA0o9z","48:mA0o9zW","48:A0o9zWv","48:0o9zWv7","48:o9zWv7v","48:9zWv7vH","48:zWv7vHE","48:Wv7vHE8","48:v7vHE8P","48:7vHE8PW","48:vHE8PWP","48:HE8PWPQ","48:E8PWPQD","96:WnVpb2K","96:nVpb2KI","96:Vpb2KIy","96:pb2KIyx","96:b2KIyxM","96:2KIyxMc","96:KIyxMck","96:IyxMckb","96:yxMckbL","96:xMckbLw","96:MckbLwz","96:ckbLwzk","96:kbLwzkb","96:bLwzkbj","96:Lwzkbje","96:wzkbjex","96:zkbjexX","96:kbjexXy","96:bjexXys","96:jexXysc","96:exXyscB","96:xXyscBP","96:XyscBPS","96:yscBPS+","96:scBPS+i","96:cBPS+iw","96:BPS+iw9","96:PS+iw9B","96:S+iw9Bn","96:+iw9BnJ","96:iw9BnJY","96:w9BnJYj","96:9BnJYjQ","96:BnJYjQm","96:nJYjQmA","96:JYjQmA0","96:YjQmA0o","96:jQmA0o9","96:QmA0o9z","96:mA0o9zW","96:A0o9zWv","96:0o9zWv7","96:o9zWv7v","96:9zWv7vH","96:zWv7vHE","96:Wv7vHE8","96:v7vHE8P","96:7vHE8PW","96:vHE8PWP","96:HE8PWPQ","96:E8PWPQD","48:WVd2wep","48:Vd2wepb","48:d2wepbL","48:2wepbLw","48:wepbLwA","48:epbLwAb","48:pbLwAb6","48:bLwAb6t","48:LwAb6t0","48:wAb6t03","48:Ab6t03X","48:b6t03XJ","48:6t03XJY","48:t03XJY0","48:03XJY0p","48:3XJY0pP","48:XJY0pP9","48:JY0pP9z","48:Y0pP9zc","48:0pP9zc7","48:pP9zc7v","48:P9zc7vH","48:9zc7vHE","48:zc7vHE8","48:c7vHE83","48:7vHE83D"],"imphash":"Unknown"},"file_info":{"file_name":"Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js","file_type":["script","javascript"],"file_type_id":"js","file_size":2744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784271678000,"last_seen":1784315936000,"last_multi_scan":1784315936000}},"detections":{"summary":{"verdict":"malicious","score":53,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":29},"sandbox_signatures":{"informative_count":53,"suspicious_count":3,"malicious_count":2,"total":58},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.MalBehav.gen!G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"SVM:TrojanDownloader/JS.MalBehav.gen","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Script connects to a host without prior DNS lookup"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2444068423 [PID: 5848]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2444076136 [PID: 5848]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2444944673 [PID: 5848]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2444951705 [PID: 5848]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2445099504 [PID: 5848]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005848-00000C15-2445107441 [PID: 5848]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"\"WScript.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"HTTP/1.1 502 Bad GatewayServer: mitmproxy 8.1.1Connection: closeContent-Type: text/htmlcontent-length: 137 502 Bad Gateway

502 Bad Gateway

connection closed

\"}","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"\"WScript.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"c8c283ba0d126ef15f19a65a5fee82caf7a703212671c885d63f910b3bc2998f30a1aadda87906af00cbc2970c4edd97f4bad289f84b68afbc298a5ef46a864a4a003e17043047da1145d4dde07de5c1fe332750149c7959325f1e5746a450fd7c8cd8fb4c655d28db35ce886ddaf65d97a140223879ecd8b0929b18e2d2\"}\n \"WScript.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"6e62\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$26","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005848)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00005848)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"31.76.252.31:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5848:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5848:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"Local\\SM0:5848:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"SM0:5848:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js\"\" (UID: 00000000-00005848)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A4B90000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BCA60000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BC510000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0450000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WScript.Sleep\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.CreateObject\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.Option\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.Open\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.SetRequestHeader\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.Status\" with result: \"502\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a004e00000040c7dfbcf97f0000@ntdll.dll\"\n \"\"#N@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"JScript Language\" (Path: \"HKCU\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\")\n \"WScript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")\n \"WScript.exe\" touched \"WinHttpRequest Component version 5.1\" (Path: \"HKCU\\CLSID\\{2087C2F4-2CEF-4953-A8AB-66779B670495}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00005848-00000C2B-2444721737]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00005848-00000C2B-2445017003]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$2c","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 5848)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WScript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005848)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\vymoga_vr_registry_audit_forma_3_signed_17_07_2026.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\winhttpcom.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"31.76.252.31\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 31.76.252.31 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WScript.exe\" connects to 31.76.252.31 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"WScript.exe\" connects to 31.76.252.31:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script connects to a host without prior DNS lookup","description":"Process \"WScript.exe\" connected to \"31.76.252.31\" (Port: 443, Protocol: TCP) without a DNS lookup","origin":"Monitored Target","mitre_attack_id":"T1071.001","relevance":10,"id":"target-38","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":39,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":39,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","User Comment"],"sandbox_reports":[{"id":"6a5a8020c60092f1a8099959","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":53,"malware_family":"JS.MalBehav.gen","contacted_countries":["GBR"],"submit_name":"fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe.js","analysis_start_time":"2026-07-17T19:18:57+00:00","indicators_count":{"informative":47,"suspicious":3,"malicious":2},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":true},{"id":"6a59d33d4ee49367940ad974","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":53,"malware_family":"JS.MalBehav.gen","contacted_countries":["GBR"],"submit_name":"Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js","analysis_start_time":"2026-07-17T07:01:18+00:00","indicators_count":{"informative":52,"suspicious":3,"malicious":2},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"31.76.252.31","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}],"processes":[{"pid":5848,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00005848","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="}],"all_imported_dlls":["ncrypt.dll","version.dll","wldp.dll","msasn1.dll","windows.storage.dll","ncryptsslp.dll","shlwapi.dll","combase.dll","advapi32.dll","msctf.dll","clbcatq.dll","jscript.dll","gpapi.dll","ntdll.dll","bcryptprimitives.dll","msvcp140.dll","nsi.dll","ucrtbase.dll","vcruntime140_1.dll","kernel.appcore.dll","userenv.dll","MpOAV.dll","wintrust.dll","SHCore.dll","cryptbase.dll","cfgmgr32.dll","scrobj.dll","gdi32full.dll","sechost.dll","sxs.dll","winhttpcom.dll","fltLib.dll","profapi.dll","OnDemandConnRouteHelper.dll","IPHLPAPI.DLL","winnsi.dll","msvcrt.dll","wshext.dll","msvcp_win.dll","imm32.dll","uxtheme.dll","crypt32.dll","bcrypt.dll","msisip.dll","winhttp.dll","KernelBase.dll","ole32.dll","vcruntime140.dll","rsaenh.dll","coml2.dll","webio.dll","user32.dll","dwmapi.dll","3H9h3v0Q.dll","rpcrt4.dll","shell32.dll","mswsock.dll","ntasn1.dll","VxSSL64.dll","powrprof.dll","dpapi.dll","gdi32.dll","win32u.dll","ws2_32.dll","cryptsp.dll","amsi.dll","mskeyprotect.dll","kernel32.dll","oleaut32.dll","sspicli.dll","schannel.dll","aqnlJGS9.dll","iertutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"},{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5848:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5848:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"name":"Local\\SM0:5848:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"name":"SM0:5848:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a59d33d4ee49367940ad974"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1976:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"name":"SM0:1976:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]},{"name":"Local\\SM0:1976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a5a8020c60092f1a8099959"}]}]}},"report_ids":{"sandbox_job_ids":["6a5a8020c60092f1a8099959","6a59d33d4ee49367940ad974"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious SVM:TrojanDownloader/JS.MalBehav.gen Sample fb952ba3d10a… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fb952ba3d10a…. Malware family: SVM:TrojanDownloader/JS.MalBehav.gen. Threat score 53/100. 1/27 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe"}],["$","meta","4",{"property":"og:title","content":"Malicious SVM:TrojanDownloader/JS.MalBehav.gen Sample fb952ba3d10a… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fb952ba3d10a…. Malware family: SVM:TrojanDownloader/JS.MalBehav.gen. Threat score 53/100. 1/27 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious SVM:TrojanDownloader/JS.MalBehav.gen Sample fb952ba3d10a… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fb952ba3d10a…. Malware family: SVM:TrojanDownloader/JS.MalBehav.gen. Threat score 53/100. 1/27 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]