Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 185.196.9.174 |
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabG5 |
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enen=b03f5f7& |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000002.00000002.2309860244.0000020BAA2B7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://osoft.co |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002742000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.00000000026C1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/wsdl/ |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000002.00000002.2311324939.0000020BAA37E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://www.microsoft. |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/winsvr-2022-pshelp |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF44F70 |
0_2_00007FF70BF44F70 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF44FE2 |
0_2_00007FF70BF44FE2 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF81C00 |
0_2_00007FF70BF81C00 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF88550 |
0_2_00007FF70BF88550 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF818D9 |
0_2_00007FF70BF818D9 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF464CC |
0_2_00007FF70BF464CC |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF5ED20 |
0_2_00007FF70BF5ED20 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF73D80 |
0_2_00007FF70BF73D80 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF5DDC0 |
0_2_00007FF70BF5DDC0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4BE10 |
0_2_00007FF70BF4BE10 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF50E10 |
0_2_00007FF70BF50E10 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF41E50 |
0_2_00007FF70BF41E50 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF69E80 |
0_2_00007FF70BF69E80 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4EF8C |
0_2_00007FF70BF4EF8C |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF79F90 |
0_2_00007FF70BF79F90 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4EFFB |
0_2_00007FF70BF4EFFB |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF88000 |
0_2_00007FF70BF88000 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF89040 |
0_2_00007FF70BF89040 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF52045 |
0_2_00007FF70BF52045 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF8C060 |
0_2_00007FF70BF8C060 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF77060 |
0_2_00007FF70BF77060 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F06B |
0_2_00007FF70BF4F06B |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6A06A |
0_2_00007FF70BF6A06A |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF87090 |
0_2_00007FF70BF87090 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4A950 |
0_2_00007FF70BF4A950 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F9A5 |
0_2_00007FF70BF4F9A5 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF729B0 |
0_2_00007FF70BF729B0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF459C2 |
0_2_00007FF70BF459C2 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF489F0 |
0_2_00007FF70BF489F0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF69A10 |
0_2_00007FF70BF69A10 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4FA24 |
0_2_00007FF70BF4FA24 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF46A45 |
0_2_00007FF70BF46A45 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF64A70 |
0_2_00007FF70BF64A70 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF5BAC0 |
0_2_00007FF70BF5BAC0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6DAD0 |
0_2_00007FF70BF6DAD0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4EB70 |
0_2_00007FF70BF4EB70 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF5FB80 |
0_2_00007FF70BF5FB80 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4EC30 |
0_2_00007FF70BF4EC30 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4FC94 |
0_2_00007FF70BF4FC94 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4CCD0 |
0_2_00007FF70BF4CCD0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF45526 |
0_2_00007FF70BF45526 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F583 |
0_2_00007FF70BF4F583 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F5A6 |
0_2_00007FF70BF4F5A6 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6C5B0 |
0_2_00007FF70BF6C5B0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F5F5 |
0_2_00007FF70BF4F5F5 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6A60F |
0_2_00007FF70BF6A60F |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4663B |
0_2_00007FF70BF4663B |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF45646 |
0_2_00007FF70BF45646 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF8F660 |
0_2_00007FF70BF8F660 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF73660 |
0_2_00007FF70BF73660 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF8F680 |
0_2_00007FF70BF8F680 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F69D |
0_2_00007FF70BF4F69D |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF466A5 |
0_2_00007FF70BF466A5 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF7A700 |
0_2_00007FF70BF7A700 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF77750 |
0_2_00007FF70BF77750 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4B760 |
0_2_00007FF70BF4B760 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F7AB |
0_2_00007FF70BF4F7AB |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F816 |
0_2_00007FF70BF4F816 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF87819 |
0_2_00007FF70BF87819 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF75850 |
0_2_00007FF70BF75850 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4C880 |
0_2_00007FF70BF4C880 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF81900 |
0_2_00007FF70BF81900 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF53120 |
0_2_00007FF70BF53120 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F166 |
0_2_00007FF70BF4F166 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF75160 |
0_2_00007FF70BF75160 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF8E1C0 |
0_2_00007FF70BF8E1C0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF7B1D0 |
0_2_00007FF70BF7B1D0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF441F8 |
0_2_00007FF70BF441F8 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF43200 |
0_2_00007FF70BF43200 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF87240 |
0_2_00007FF70BF87240 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF72260 |
0_2_00007FF70BF72260 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF46270 |
0_2_00007FF70BF46270 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF452E6 |
0_2_00007FF70BF452E6 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6A2E7 |
0_2_00007FF70BF6A2E7 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F37A |
0_2_00007FF70BF4F37A |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF5E3B0 |
0_2_00007FF70BF5E3B0 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF45406 |
0_2_00007FF70BF45406 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF6A419 |
0_2_00007FF70BF6A419 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF70420 |
0_2_00007FF70BF70420 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF7C430 |
0_2_00007FF70BF7C430 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF64470 |
0_2_00007FF70BF64470 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F47C |
0_2_00007FF70BF4F47C |
Source: C:\Users\user\Desktop\g3y89237.exe |
Code function: 0_2_00007FF70BF4F4E9 |
0_2_00007FF70BF4F4E9 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34784DFA |
2_2_00007FFD34784DFA |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD3478B9F2 |
2_2_00007FFD3478B9F2 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD3478264D |
2_2_00007FFD3478264D |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34788D70 |
2_2_00007FFD34788D70 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD3478BAFA |
2_2_00007FFD3478BAFA |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD3478B300 |
2_2_00007FFD3478B300 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34784270 |
2_2_00007FFD34784270 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34788AB5 |
2_2_00007FFD34788AB5 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34783812 |
2_2_00007FFD34783812 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 2_2_00007FFD34853C21 |
2_2_00007FFD34853C21 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36493C |
4_2_00007FFD8B36493C |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3627CB |
4_2_00007FFD8B3627CB |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36358F |
4_2_00007FFD8B36358F |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B377C20 |
4_2_00007FFD8B377C20 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B37DAB0 |
4_2_00007FFD8B37DAB0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38BB20 |
4_2_00007FFD8B38BB20 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36EB10 |
4_2_00007FFD8B36EB10 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B361B17 |
4_2_00007FFD8B361B17 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38E8E0 |
4_2_00007FFD8B38E8E0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B385910 |
4_2_00007FFD8B385910 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B398050 |
4_2_00007FFD8B398050 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B378010 |
4_2_00007FFD8B378010 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38CEB0 |
4_2_00007FFD8B38CEB0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36AED0 |
4_2_00007FFD8B36AED0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B392ED0 |
4_2_00007FFD8B392ED0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B382E90 |
4_2_00007FFD8B382E90 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B367E50 |
4_2_00007FFD8B367E50 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36237F |
4_2_00007FFD8B36237F |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38B400 |
4_2_00007FFD8B38B400 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3832F0 |
4_2_00007FFD8B3832F0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B379310 |
4_2_00007FFD8B379310 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3771A4 |
4_2_00007FFD8B3771A4 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38E210 |
4_2_00007FFD8B38E210 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B37E0B0 |
4_2_00007FFD8B37E0B0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3940D0 |
4_2_00007FFD8B3940D0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B39F060 |
4_2_00007FFD8B39F060 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B390090 |
4_2_00007FFD8B390090 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36A120 |
4_2_00007FFD8B36A120 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B38C7D0 |
4_2_00007FFD8B38C7D0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B390760 |
4_2_00007FFD8B390760 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B36182A |
4_2_00007FFD8B36182A |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3896F0 |
4_2_00007FFD8B3896F0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B393620 |
4_2_00007FFD8B393620 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B3735F0 |
4_2_00007FFD8B3735F0 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD8B396540 |
4_2_00007FFD8B396540 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_02416A1C |
4_2_02416A1C |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_02416DF8 |
4_2_02416DF8 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_02417228 |
4_2_02417228 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_0241A4D4 |
4_2_0241A4D4 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_02415B40 |
4_2_02415B40 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_02417CDC |
4_2_02417CDC |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD347914A8 |
4_2_00007FFD347914A8 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD34795F45 |
4_2_00007FFD34795F45 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD347A0E66 |
4_2_00007FFD347A0E66 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD3479719E |
4_2_00007FFD3479719E |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD347A1C12 |
4_2_00007FFD347A1C12 |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD3479CDCD |
4_2_00007FFD3479CDCD |
Source: C:\Windows\System32\regsvr32.exe |
Code function: 4_2_00007FFD34797362 |
4_2_00007FFD34797362 |
Source: 4.2.regsvr32.exe.23d130d.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.668bfd.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.23d130d.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 4.2.regsvr32.exe.668bfd.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 00000004.00000002.3418525753.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: 00000004.00000002.3417790081.000000000064B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13 |
Source: C:\Users\user\Desktop\g3y89237.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\g3y89237.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kdscli.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: aclayers.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: cryptnet.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sxs.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: devenum.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: devobj.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: msdmo.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: aclayers.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |