We saw a Waterbear loader named "ociw32.dll" inside one of the folders in the %PATH% environmental variable. mtxoci.dll” first tries to query the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value "OracleOciLib" exists. If the value doesn't exist, “mtxoci.dll” tries to load "ociw32.dll" instead. During our investigation, we noticed that the value "OracleOciLib" was deleted from the victim's machine, as shown in Figure 2