| Source: unknown |
Process created: C:\Users\user\Desktop\INVOICE-98656789.exe C:\Users\user\Desktop\INVOICE-98656789.exe |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x53686D28 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F772A36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72352E36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30292272 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A412D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6561763A -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x46696E3A -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x41286F7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72342273 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7838326F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3030326F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x70203273 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226B -bxor 607} |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30783A6F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30296B71 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72332272 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A5436 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7274773E -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C416E33 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F632A36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C6B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3078316F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30302E7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x69203227 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x34302B2F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723372 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A513A -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x74466B33 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6E74672D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2869706C -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3734306B -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x202C2236 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723072 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A503A -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x61644436 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C652A36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72332E7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6920706E -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C2A6B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B36 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F77522D -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F634377 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6972337F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B72 -bxor 607} |
|
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\INVOICE-98656789.exe |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x53686D28 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F772A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72352E36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30292272 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A412D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6561763A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x46696E3A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x41286F7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72342273 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7838326F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3030326F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x70203273 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30783A6F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A5436 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7274773E -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C416E33 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F632A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C6B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3078316F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30302E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x69203227 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x34302B2F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723372 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A513A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x74466B33 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6E74672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2869706C -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F772A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3734306B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x202C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723072 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A503A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x61644436 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C652A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72332E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x53686D28 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F77522D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F634377 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6972337F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B72 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2152:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4976:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8560:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8724:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1580:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9780:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9840:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6904:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8360:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2536:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3440:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10204:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9964:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3440:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9864:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8532:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8668:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1804:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10116:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10116:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4976:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9976:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8592:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9840:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10232:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8668:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2336:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9108:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9780:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9844:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2488:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9468:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9972:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2536:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1640:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9108:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9964:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1580:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:920:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10000:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9468:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9972:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10200:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8724:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9240:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4396:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9816:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10196:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:940:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9844:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10000:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5556:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2488:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10204:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9888:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4524:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9976:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1804:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10200:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10232:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5556:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8532:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10196:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4032:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4396:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8440:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4524:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8784:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4032:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8560:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8360:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6904:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9864:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8956:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2152:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9888:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9240:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6912:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9816:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:920:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8592:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2336:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:940:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1640:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8956:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8784:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:304:WilStaging_02 |
| Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8440:304:WilStaging_02 |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\System32\conhost.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
|
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x53686D28 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F772A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72352E36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30292272 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A412D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6561763A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x46696E3A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x41286F7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72342273 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7838326F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3030326F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x70203273 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2069226B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30783A6F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A5436 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7274773E -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C416E33 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F632A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C6B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3078316F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x30302E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x69203227 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x34302B2F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723372 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A513A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x74466B33 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6E74672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2869706C -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F772A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3734306B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x202C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302E36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2E723072 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x656C316D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3A3A503A -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x61644436 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6C652A36 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x72332E7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3539366B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x3131376D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x53686D28 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x7573672D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x33323865 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x57696C3B -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F77522D -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6F634377 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6972337F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C69226F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x2C206B7F -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x302C2236 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x20302B72 -bxor 607} |
Jump to behavior |
| Source: C:\Users\user\Desktop\INVOICE-98656789.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Invoke-Command -ScriptBlock{0x6B657031 -bxor 607} |
Jump to behavior |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet