How to report a malicious repository
Asked by soex0101:

Hello  
I report a malicious repository which was hosted in bitbucket  
This is the url of that malicious repository - <https://bitbucket.org/ani_tail/roquecanacolina>  
The owner of that repository distributes this repository to developers and that repository executes malicious javascripts  
They execute an obfuscated javascript which was downloaded from <http://ipcheck.cloud:8353/api/user/thirdcookie/v10/106>  
I attach it here  
And then it executes a malicious javascript using C:\\Windows\\System32\\WScript.exe  
I want you to block that owner and the repository.  
He is a cheater definitely  
I attach here a report from <https://www.virustotal.com/>  

|------------------------------------------------------------------------------------------------------|
| [VirusTotal](https://www.virustotal.com/) VirusTotal [www.virustotal.com](http://www.virustotal.com) |

<https://www.virustotal.com/gui/file/f3294a2a1c1b7c391de4966c63a79de1236eb7edc22a3357d8bc63e57c9894cf/behavior>  

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [VirusTotal](https://www.virustotal.com/gui/file/f3294a2a1c1b7c391de4966c63a79de1236eb7edc22a3357d8bc63e57c9894cf/behavior) VirusTotal [www.virustotal.com](http://www.virustotal.com) |

Display grouped sandbox reports  
CAPE Sandbox  
0  
0  
0  
0  
0  
2  
Zenbox  
0  
0  
0  
0  
0  
0  
Activity Summary  
Detections  
NOT FOUND  
Mitre Signatures  
NOT FOUND  
IDS Rules  
NOT FOUND  
Sigma Rules  
NOT FOUND  
Dropped Files  
NOT FOUND  
Network comms  
2 IP  
Behavior Tags  
idle long-sleeps  
Network Communication  
IP Traffic  
TCP 204.79.197.203:443  
TCP 74.125.132.94:443  
Behavior Similarity Hashes  
CAPE Sandbox  
08df239d777097aab96f0c38c80217e9  
Zenbox  
80ed3249c9b50f650a0d11aee59523e3  
File system actions  
Files opened  
C:\\Users\\\<USER\>\\Desktop\\script.js  
C:\\Users\\user\\Desktop\\script.js  
C:\\Users\\user\\Desktop\\script.js\\  
C:\\Windows\\Globalization\\Sorting\\sortdefault.nls  
C:\\Windows\\SYSTEM32\\USERENV.dll  
C:\\Windows\\SYSTEM32\\WLDP.DLL  
C:\\Windows\\SYSTEM32\\amsi.dll  
C:\\Windows\\SYSTEM32\\cryptsp.dll  
C:\\Windows\\SYSTEM32\\ntmarta.dll  
C:\\Windows\\SYSTEM32\\sxs.dll  
C:\\Windows\\SYSTEM32\\wintypes.dll  
C:\\Windows\\System32\\AppLocker\\MDM  
C:\\Windows\\System32\\CRYPTBASE.dll  
C:\\Windows\\System32\\CoreMessaging.dll  
C:\\Windows\\System32\\CoreUIComponents.dll  
C:\\Windows\\System32\\MSISIP.DLL  
C:\\Windows\\System32\\TextInputFramework.dll  
C:\\Windows\\System32\\VERSION.dll  
C:\\Windows\\System32\\WScript.exe  
C:\\Windows\\System32\\bcrypt.dll  
C:\\Windows\\System32\\en-US\\USER32.dll.mui  
C:\\Windows\\System32\\en-US\\WScript.exe.mui  
C:\\Windows\\System32\\en-US\\jscript.dll.mui  
C:\\Windows\\System32\\jscript.dll  
C:\\Windows\\System32\\scrobj.dll  
C:\\Windows\\System32\\wscript.exe  
C:\\Windows\\System32\\wshext.dll  
C:\\Windows\\system32\\  
C:\\Windows\\system32\\IMM32.DLL  
C:\\Windows\\system32\\dwmapi.dll  
C:\\Windows\\system32\\rpcss.dll  
C:\\Windows\\system32\\rsaenh.dll  
C:\\Windows\\system32\\uxtheme.dll  
MountPointManager  
Registry actions  
Registry keys opened  
HKEY_CLASSES_ROOT\\.js  
HKEY_CLASSES_ROOT\\JSFile\\ScriptEngine  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\DisplayLogo  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\Enabled  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\LogSecuritySuccesses  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\Timeout  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\TrustPolicy  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script Host\\Settings\\UseWINSAFER  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe\\JScriptSetScriptStateStarted  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme  
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Script Host\\Settings  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.js\\(Default)  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wscript.exe  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ScriptEngine\\(Default)  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\CLSID  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JScript\\CLSID\\(Default)  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\COM+Enabled  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\DisplayLogo  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\Enabled  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\IgnoreUserSettings  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\LogSecuritySuccesses  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\Timeout  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\TrustPolicy  
HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows Script Host\\Settings\\UseWINSAFER  
HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy  
HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled  
HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled  
HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE  
HKEY_LOCAL_MACHINE\\Software\\Classes  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Script Host\\Settings  
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows Script\\Settings  
HKEY_CURRENT_USER\\Software\\Classes  
HKEY_CURRENT_USER\\Software\\Classes\\Local Settings  
HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys  
HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security  
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Hashes  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\UrlZones  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\Hashes  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\Paths  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\UrlZones  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Hashes  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Paths  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\UrlZones  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\Hashes  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\Paths  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\UrlZones  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\Hashes  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\Paths  
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\UrlZones  
HKEY_CURRENT_USER_Classes  
HKEY_CURRENT_USER_Classes\\.js  
HKEY_CURRENT_USER_Classes\\AppID\\WScript.exe  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\Elevation  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocHandler  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocHandler32  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocServer32  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\LocalServer  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\LocalServer32  
HKEY_CURRENT_USER_Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TreatAs  
HKEY_CURRENT_USER_Classes\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\Elevation  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocHandler  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocHandler32  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocServer32  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\LocalServer  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\LocalServer32  
HKEY_CURRENT_USER_Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\TreatAs  
HKEY_CURRENT_USER_Classes\\JSFile\\ScriptEngine  
HKEY_CURRENT_USER_Classes\\JScript  
HKEY_CURRENT_USER_Classes\\JScript\\CLSID  
HKEY_CURRENT_USER_Classes\\Local Settings\\Software\\Microsoft  
HKEY_CURRENT_USER_Classes\\Local Settings\\Software\\Microsoft\\Ole  
HKEY_CURRENT_USER_Classes\\Local Settings\\Software\\Microsoft\\Ole\\FeatureDevelopmentProperties  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\Elevation  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocHandler  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocHandler32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\InprocServer32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\LocalServer  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\LocalServer32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TreatAs  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\Elevation  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocHandler  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocHandler32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\InprocServer32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\LocalServer  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\LocalServer32  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\\TreatAs  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\AppModel\\Lookaside\\Packages  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\WScript.exe  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\WScript.exe  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Script\\Features  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE  
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore  
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager  
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Segment Heap  
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration  
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32  
HKEY_LOCAL_MACHINE\\Software\\Classes\\.js  
HKEY_LOCAL_MACHINE\\Software\\Classes\\AppID\\WScript.exe  
HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}  
HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\\InprocServer32  
HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}  
HKEY_LOCAL_MACHINE\\Software\\Classes\\JSFile\\ScriptEngine  
HKEY_LOCAL_MACHINE\\Software\\Classes\\JScript  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\DESHashSessionKeyBackward  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Offload  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Wintrust\\Config  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole\\FeatureDevelopmentProperties  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList  
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Cryptography  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MUI\\Settings  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Display  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Hashes  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\UrlZones  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\Hashes  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\Paths  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\131072\\UrlZones  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Hashes  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\Paths  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\262144\\UrlZones  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\Hashes  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\Paths  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\4096\\UrlZones  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\Hashes  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\Paths  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\65536\\UrlZones  
HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\LevelObjects  
HKEY_LOCAL_MACHINE\\System\\Setup  
\\REGISTRY\\USER  
Process and service actions  
Processes created  
"C:\\Windows\\system32\\wscript.exe" "C:\\Users\\\<USER\>\\Desktop\\script.js"  
C:\\Windows\\system32\\services.exe  
C:\\Windows\\System32\\wscript.exe C:\\Windows\\System32\\WScript.exe "C:\\Users\\user\\Desktop\\script.js"  
Shell commands  
C:\\Windows\\system32\\SecurityHealthService.exe  
C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding  
Processes terminated  
C:\\Windows\\System32\\wscript.exe  
Services opened  
WinDefend  
Processes tree  
5820 - "C:\\Windows\\system32\\wscript.exe" "C:\\Users\\\<USER\>\\Desktop\\script.js"  
6852 - C:\\Windows\\System32\\wscript.exe C:\\Windows\\System32\\WScript.exe "C:\\Users\\user\\Desktop\\script.js"


Answers:
author: Andy Heinzer
body: Hi,

Thanks for reporting this. Our team has removed the content from our site.

Andy


author: Charlie Misonne
body: Hi [@soex0101](/t5/user/viewprofilepage/user-id/5577589) and welcome to the Atlassian Community!

Thanks for raising this. I escalated your question to Atlassian so they can review the repo.


Tags: bitbucket-cloud

cloud